Prowler plugin for Claude Code
Prowler for Claude Code
A plugin that takes a cloud account toward CIS, PCI-DSS and other frameworks: reads Prowler Cloud reports, fixes failures and proposes a rescan
- 15,121 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The agent changes a cloud account through Terraform, command-line utilities or the web console, and some changes cannot be rolled back
- The Prowler API key goes to a remote MCP server, and data about your account and its findings passes through it
- The report in the `.prowler/` folder holds account and finding identifiers and is easy to commit by mistake
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/prowler-for-claude-codeDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent changes a cloud account through Terraform, command-line utilities or the web console, and some changes cannot be rolled back
- The Prowler API key goes to a remote MCP server, and data about your account and its findings passes through it
- The report in the `.prowler/` folder holds account and finding identifiers and is easy to commit by mistake
This is third-party code. Review the repository files before installing.
What it does
The prowler plugin lives in the claude_plugins/prowler folder of the Prowler repository and connects the remote MCP server https://mcp.prowler.com/mcp to Claude Code. Alongside the server it installs the framework-compliance-triage skill, which takes a cloud account, such as AWS, Azure, GCP or GitHub, toward a chosen security framework: CIS 4.0, PCI-DSS or Prowler ThreatScore. The agent first asks for the provider and the framework and checks through Prowler Hub that the pair is supported. It then finds your account with `prowler_search_providers` and takes the latest completed scan that has a compliance report. If there is none, it offers to start a new one with `prowler_trigger_scan` and asks you to come back when it finishes. The agent records the result in `.prowler/compliance-<framework id>-<account uid>.md` at the project root: a scan summary, the failed requirements with their findings, manual review items and an activity log. For each requirement it fetches the finding details and the remediation hint from Prowler Hub, moves the status from FAIL through IN PROGRESS to FIXED-UNVERIFIED and appends a fix plan. Fixes are applied with the tool you choose: Terraform, the gh, az and aws command-line utilities or the web console. There are two modes. In assisted mode the agent shows the resource, commands, side effects and reversibility and waits for your approval on each requirement. In autonomous mode it shows one grouped plan, takes a single approval and works through the list, but stops if a finding is not applicable, needs a paid feature or touches many resources. When no failed requirements remain, the agent proposes a rescan to verify.
Who it is for. For security and DevOps engineers who have already connected a cloud account to Prowler Cloud and want to bring it up to a chosen standard with an agent.
Good fit when
- You need to bring an AWS account to CIS 4.0 and get a list of fixes with ready commands
- A Prowler scan exists and dozens of requirements fail, so working through them in order with status marks in a file is easier
- The fixes live in a Terraform project and the agent must change code based on the latest scan
- You are preparing a GCP project for PCI-DSS and want to see which requirements must be closed by hand
- After the changes you want to run a rescan and confirm the requirements moved to PASS
Not a fit when
- You want to run the scanner locally without an account: the plugin only talks to Prowler Cloud with an API key and never runs the scanner itself
- You work outside Claude Code: the repository describes the plugin for it only
- The framework you need is not in Prowler Hub for your provider: the skill then says so and ends the flow
- You need ISO 27001 or SOC 2 paperwork instead of cloud fixes: the catalog has the Claude Skills for Governance, Risk, Compliance (GRC) set for that
Example request
Bring my production AWS account in line with CIS 4.0 based on the latest Prowler scan, make the changes in Terraform and ask for approval on every requirementLimitations
- The plugin is in preview and under active development: it contains one skill for now, with more promised.
- A Prowler Cloud account and an API key from the profile are required. The plugin documentation says the free tier is enough to start. Claude Code keeps the key in the macOS keychain or in `~/.claude/.credentials.json`, and to change the key you reinstall the plugin.
- Scanning is driven by Prowler Cloud: if no completed scan with a report exists, the agent waits for it to finish and you come back later.
- The agent copies manual requirements into the report as reference. Requirement descriptions and finding IDs stay read-only after the file is created.
- Verifying a fix depends on the tool: after a web console change, only a rescan can confirm the result.
- Apache-2.0 license.
How to disable. In Claude Code run `/plugin uninstall prowler@prowler-plugins`, then `/plugin marketplace remove prowler-plugins`. The stored API key is removed with the plugin. Report files in the project's `.prowler/` folder stay, so delete them by hand.
FAQ
How do I install the Prowler plugin in Claude Code?
Run `/plugin marketplace add prowler-cloud/prowler`, then `/plugin install prowler@prowler-plugins`. During installation Claude Code asks for a Prowler API key, which you create in your profile on cloud.prowler.com. To verify, `/mcp` lists the prowler server as connected and `/plugin` shows the `prowler:framework-compliance-triage` skill.
What if the prowler server shows as failed in /mcp?
Most often the API key was rejected. Create a new key in Prowler Cloud and reinstall the plugin so it asks for the key again.
Why does the skill not start on my phrase?
The skill description did not match the request. Name the framework and add the word compliance or compliant, for example making my AWS account compliant with CIS 4.0.
How does assisted mode differ from autonomous mode?
In assisted mode the agent waits for approval on each requirement, which is why it is the default. In autonomous mode it shows one grouped plan but stops on non-applicable findings, paid features and changes that touch many resources. The skill treats just do it as autonomous mode and still requires a single approval of the plan.
Where is the fix progress stored?
In `.prowler/compliance-<framework id>-<account uid>.md` at the project root, one file per framework and account pair. If the scan in the file is older than the current one, the agent asks whether to refresh the report and carries the activity log and the chosen approach into the new one.
Discussion
No questions or reviews yet.
Related
PluginsA pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
An open set of Claude Code plugins for compliance: findings from cloud and SaaS, gap reports and OSCAL output
Burp Suite extension with AI: analyzes requests, runs scanners and opens Burp over MCP to Claude Desktop, Claude Code, Codex and Gemini CLI
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Prowler plugin for Claude Code (this entry) | yes | 15,121 | ||
| Claude Skills for GRC | no | 1,008 | a skill set on ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS and NIST frameworks, not fixes in a cloud account | |
| Terraform Skill | no | 2,432 | Terraform and OpenTofu authoring practices: tests, modules, state, CI/CD | |
| CloudSword: cloud security testing | no | API key | 626 | a security testing tool for Alibaba |
README in short
The main Prowler repository describes a scanner for AWS, Azure, GCP, Kubernetes, GitHub and other environments, plus an app with a web interface, an API and an MCP server. Claude Code users get a separate folder: a plugin description with requirements, installation, key setup, verification, example requests and a troubleshooting table, a manifest, the remote MCP setup and one skill. A marketplace file with a single prowler entry sits beside it.
README badge
Original SKILL.md
--- name: framework-compliance-triage description: Make a cloud account compliant with a security or industry framework using Prowler Cloud. --- # Framework compliance Iterative, interactive flow that takes a cloud account through setup, reporting, and remediation until it complies with the chosen security or industry framework. ## Checkpoints This skill uses **checkpoints** to mark moments where you must stop, post a clear question or summary to the user, and wait for the reply before continuing.