How prowler-cloud/prowler works
Prowler is a multi-cloud security and compliance platform: users scan cloud accounts with provider-specific checks, then review findings, compliance and risk results through CLI, dashboards, or the hosted/self-hosted web app. The repository also contains an API-backed attack-path feature and an MCP server. The tree and excerpts establish implementation locations, but most runtime wiring was not sampled; edges below are limited to README-documented flows, with uncertain links omitted.
Main entry points: attack_paths/scan.py Attack-path worker · finding.py Findings · factory.py Graph sink · scan/scan.py Scan orchestration
Components 22
Security scanning
- Prowler CLI
prowler/__main__.py - Provider access
prowler/providers/common/provider.py - Security checks
prowler/lib/check/check.py - Scan orchestration
prowler/lib/scan/scan.py
Findings and reporting
- Findings
prowler/lib/outputs/finding.py - Compliance frameworks
prowler/lib/check/compliance_models.py - Result exporters
prowler/lib/outputs/outputs.py
Prowler web app
- Local dashboard
dashboard/__main__.py - Application API
api/src/backend/api/v1/views.py - Application data
api/src/backend/api/models.py - Web interface
ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx - External integrations
api/src/backend/api/v1/serializer_utils/integrations.py
Attack paths
- Attack-path worker
api/src/backend/tasks/jobs/attack_paths/scan.py - Cloud inventory
contrib/inventory-graph/inventory_graph.py - Attack-path API
api/src/backend/api/attack_paths/database.py - Graph sink
api/src/backend/api/attack_paths/sink/factory.py
MCP interfaces
- Prowler MCP server
mcp_server/prowler_mcp_server/server.py
Other components
- Security team
- Cloud accounts
- Prowler Hub service
- Neo4j
- Amazon Neptune
Connections 22
- Security team → Prowler CLI: runs scans
README.md - Prowler CLI → Cloud accounts: assesses accounts
README.md - Cloud accounts → Provider access: provides inventory
- Provider access → Security checks: supplies resources
- Security checks → Scan orchestration: produces results
- Scan orchestration → Findings: records findings
- Findings → Compliance frameworks: maps compliance
- Findings → Result exporters: exports results
- Security team → Local dashboard: views results
README.md - Security team → Web interface: reviews assessments
README.md - Web interface → Application API: requests data
- Application API → Application data: persists app data
- Web interface → External integrations: configures integrations
- Scan orchestration → Attack-path worker: enqueues after AWS scan
README.md - Attack-path worker → Cloud inventory: combines inventory
README.md - Attack-path worker → Findings: combines findings
README.md - Attack-path worker → Graph sink: writes graph
README.md - Attack-path API → Graph sink: queries graph
- Graph sink → Neo4j: uses default sink
README.md - Graph sink → Amazon Neptune: optionally uses
README.md - Security team → Prowler MCP server: requests cloud security data
- Prowler MCP server → Prowler Hub service: queries check and framework data