# prowler-cloud/prowler architecture

> Architecture diagram of the GitHub repository prowler-cloud/prowler, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-01). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/prowler-cloud/prowler
- Repository: https://github.com/prowler-cloud/prowler

## Overview

Prowler is a multi-cloud security and compliance platform: users scan cloud accounts with provider-specific checks, then review findings, compliance and risk results through CLI, dashboards, or the hosted/self-hosted web app. The repository also contains an API-backed attack-path feature and an MCP server. The tree and excerpts establish implementation locations, but most runtime wiring was not sampled; edges below are limited to README-documented flows, with uncertain links omitted.

Main entry points: [`api/src/backend/tasks/jobs/attack_paths/scan.py`](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/tasks/jobs/attack_paths/scan.py) (Attack-path worker), [`prowler/lib/outputs/finding.py`](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/finding.py) (Findings), [`api/src/backend/api/attack_paths/sink/factory.py`](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/attack_paths/sink/factory.py) (Graph sink), [`prowler/lib/scan/scan.py`](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/scan/scan.py) (Scan orchestration)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Security scanning"]
  node_cli["Prowler CLI<br/>[__main__.py]"]
  node_provider["Provider access<br/>[provider.py]"]
  node_checks["Security checks<br/>[check.py]"]
  node_scanrun["Scan orchestration<br/>[scan.py]"]
end

subgraph group_results["Findings and reporting"]
  node_findings["Findings<br/>[finding.py]"]
  node_frameworks["Compliance frameworks"]
  node_outputs["Result exporters<br/>[outputs.py]"]
end

subgraph group_application["Prowler web app"]
  node_dashboard["Local dashboard<br/>[__main__.py]"]
  node_api["Application API<br/>[views.py]"]
  node_models[("Application data<br/>[models.py]")]
  node_webui["Web interface"]
  node_integrations["External integrations<br/>[integrations.py]"]
end

subgraph group_attack["Attack paths"]
  node_attackjob["Attack-path worker<br/>[scan.py]"]
  node_inventory["Cloud inventory<br/>[inventory_graph.py]"]
  node_attackapi["Attack-path API<br/>[database.py]"]
  node_graphdb[("Graph sink<br/>[factory.py]")]
end

subgraph group_assistants["MCP interfaces"]
  node_mcp["Prowler MCP server<br/>[server.py]"]
end

node_user(("Security team"))
node_cloud[("Cloud accounts")]
node_hub["Prowler Hub service"]
node_neo4j[("Neo4j")]
node_neptune[("Amazon Neptune")]

node_user -->|"runs scans"| node_cli
node_cli -->|"assesses accounts"| node_cloud
node_cloud -.->|"provides inventory"| node_provider
node_provider -.->|"supplies resources"| node_checks
node_checks -.->|"produces results"| node_scanrun
node_scanrun -.->|"records findings"| node_findings
node_findings -.->|"maps compliance"| node_frameworks
node_findings -.->|"exports results"| node_outputs
node_user -->|"views results"| node_dashboard
node_user -->|"reviews assessments"| node_webui
node_webui -.->|"requests data"| node_api
node_api -.->|"persists app data"| node_models
node_webui -.->|"configures integrations"| node_integrations
node_scanrun -->|"enqueues after AWS scan"| node_attackjob
node_attackjob -->|"combines inventory"| node_inventory
node_attackjob -->|"combines findings"| node_findings
node_attackjob -->|"writes graph"| node_graphdb
node_attackapi -.->|"queries graph"| node_graphdb
node_graphdb -->|"uses default sink"| node_neo4j
node_graphdb -.->|"optionally uses"| node_neptune
node_user -.->|"requests cloud security data"| node_mcp
node_mcp -.->|"queries check and framework data"| node_hub

click node_cli "https://github.com/prowler-cloud/prowler/blob/master/prowler/__main__.py"
click node_provider "https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/common/provider.py"
click node_checks "https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/check/check.py"
click node_scanrun "https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/scan/scan.py"
click node_findings "https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/finding.py"
click node_frameworks "https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/check/compliance_models.py"
click node_outputs "https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/outputs.py"
click node_dashboard "https://github.com/prowler-cloud/prowler/blob/master/dashboard/__main__.py"
click node_api "https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/v1/views.py"
click node_models "https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/models.py"
click node_webui "https://github.com/prowler-cloud/prowler/blob/master/ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx"
click node_integrations "https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/v1/serializer_utils/integrations.py"
click node_attackjob "https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/tasks/jobs/attack_paths/scan.py"
click node_inventory "https://github.com/prowler-cloud/prowler/blob/master/contrib/inventory-graph/inventory_graph.py"
click node_attackapi "https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/attack_paths/database.py"
click node_graphdb "https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/attack_paths/sink/factory.py"
click node_mcp "https://github.com/prowler-cloud/prowler/blob/master/mcp_server/prowler_mcp_server/server.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_provider,node_checks,node_scanrun toneBlue
class node_findings,node_frameworks,node_outputs,node_cloud,node_neo4j,node_neptune toneAmber
class node_dashboard,node_api,node_models,node_webui,node_integrations toneMint
class node_attackjob,node_inventory,node_attackapi,node_graphdb toneRose
class node_mcp,node_user,node_hub toneIndigo
```

## Components

### Security scanning

- [Prowler CLI](https://github.com/prowler-cloud/prowler/blob/master/prowler/__main__.py): `prowler/__main__.py`
- [Provider access](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/common/provider.py): `prowler/providers/common/provider.py`
- [Security checks](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/check/check.py): `prowler/lib/check/check.py`
- [Scan orchestration](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/scan/scan.py): `prowler/lib/scan/scan.py`

### Findings and reporting

- [Findings](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/finding.py): `prowler/lib/outputs/finding.py`
- [Compliance frameworks](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/check/compliance_models.py): `prowler/lib/check/compliance_models.py`
- [Result exporters](https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/outputs.py): `prowler/lib/outputs/outputs.py`

### Prowler web app

- [Local dashboard](https://github.com/prowler-cloud/prowler/blob/master/dashboard/__main__.py): `dashboard/__main__.py`
- [Application API](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/v1/views.py): `api/src/backend/api/v1/views.py`
- [Application data](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/models.py): `api/src/backend/api/models.py`
- [Web interface](https://github.com/prowler-cloud/prowler/blob/master/ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx): `ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx`
- [External integrations](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/v1/serializer_utils/integrations.py): `api/src/backend/api/v1/serializer_utils/integrations.py`

### Attack paths

- [Attack-path worker](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/tasks/jobs/attack_paths/scan.py): `api/src/backend/tasks/jobs/attack_paths/scan.py`
- [Cloud inventory](https://github.com/prowler-cloud/prowler/blob/master/contrib/inventory-graph/inventory_graph.py): `contrib/inventory-graph/inventory_graph.py`
- [Attack-path API](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/attack_paths/database.py): `api/src/backend/api/attack_paths/database.py`
- [Graph sink](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/api/attack_paths/sink/factory.py): `api/src/backend/api/attack_paths/sink/factory.py`

### MCP interfaces

- [Prowler MCP server](https://github.com/prowler-cloud/prowler/blob/master/mcp_server/prowler_mcp_server/server.py): `mcp_server/prowler_mcp_server/server.py`

### Other components

- **Security team**
- **Cloud accounts**
- **Prowler Hub service**
- **Neo4j**
- **Amazon Neptune**

## Connections

- Security team → Prowler CLI: runs scans (evidence: `README.md`)
- Prowler CLI → Cloud accounts: assesses accounts (evidence: `README.md`)
- Cloud accounts → Provider access: provides inventory
- Provider access → Security checks: supplies resources
- Security checks → Scan orchestration: produces results
- Scan orchestration → Findings: records findings
- Findings → Compliance frameworks: maps compliance
- Findings → Result exporters: exports results
- Security team → Local dashboard: views results (evidence: `README.md`)
- Security team → Web interface: reviews assessments (evidence: `README.md`)
- Web interface → Application API: requests data
- Application API → Application data: persists app data
- Web interface → External integrations: configures integrations
- Scan orchestration → Attack-path worker: enqueues after AWS scan (evidence: `README.md`)
- Attack-path worker → Cloud inventory: combines inventory (evidence: `README.md`)
- Attack-path worker → Findings: combines findings (evidence: `README.md`)
- Attack-path worker → Graph sink: writes graph (evidence: `README.md`)
- Attack-path API → Graph sink: queries graph
- Graph sink → Neo4j: uses default sink (evidence: `README.md`)
- Graph sink → Amazon Neptune: optionally uses (evidence: `README.md`)
- Security team → Prowler MCP server: requests cloud security data
- Prowler MCP server → Prowler Hub service: queries check and framework data