Connect Codex / ChatGPT Desktop to Prowler MCP Server

Connect OpenAI Codex to the Prowler Cloud MCP Server at https://mcp.prowler.com/mcp so Codex can query findings, inspect checks, and manage your Prowler providers.

Preferred Setup: Install the Prowler Plugin

The Prowler plugin is the recommended setup for Codex CLI. It adds Prowler Cloud security and compliance skills and configures the Prowler MCP Server with the required User-Agent header.

Surface	Recommended Setup	Notes
Codex CLI	Prowler plugin	Reliably inherits the API key from the launching shell.
Codex / ChatGPT desktop app	Plugin when supported, otherwise manual MCP setup	May require configuring the application launch environment.
Codex IDE extension	Plugin when supported, otherwise manual MCP setup	May require configuring the IDE launch environment.
ChatGPT on the web	Not supported	Does not read local Codex configuration.

Prerequisites

Codex CLI with plugin support. Check with codex --version and codex plugin --help.
A Prowler Cloud account. The free tier is enough to start. Sign up at cloud.prowler.com.

Step 1: Get Your Prowler API Key

Create an API key in Prowler Cloud and copy it. The key is shown only once. Check the API Keys guide for details.

Step 2: Set the API Key Environment Variable

Export the key in the shell that launches Codex. Do not add a real key to a repository, shell history, or shared configuration file.

export PROWLER_API_KEY="<your-Prowler-Cloud-API-key>"

PROWLER_API_KEY must contain the raw API key, without the Bearer prefix. The plugin adds that prefix when it sends the Authorization header.

Codex CLI reliably inherits this variable when it starts from the shell where you exported it. Codex Desktop and IDE integrations may not inherit variables from your shell profile. Configure the desktop application or IDE launch environment with PROWLER_API_KEY when you use those surfaces.

Step 3: Install the Plugin

Add the Prowler marketplace, then install the Prowler plugin:

codex plugin marketplace add prowler-cloud/prowler --ref master
codex plugin add prowler@prowler-plugins

The marketplace does not install Prowler by default. The codex plugin add command explicitly installs it.

Step 4: Verify the Plugin

codex plugin list --marketplace prowler-plugins

Start Codex from the same shell, then ask it to list your Prowler providers or to help triage a compliance framework.

Manual MCP Setup: Advanced or Fallback

Use this setup only when the plugin is unavailable for your Codex surface or when you need a custom MCP configuration. The manual configuration must include the User-Agent header because Codex does not send one by default.

Codex CLI

codex mcp add prowler --url https://mcp.prowler.com/mcp

Then update ~/.codex/config.toml because codex mcp add has no flag for the required header:

[mcp_servers.prowler]
url = "https://mcp.prowler.com/mcp"
bearer_token_env_var = "PROWLER_API_KEY"
http_headers = { "User-Agent" = "codex" }

This manual CLI configuration uses the same secure environment-backed contract as the plugin: PROWLER_API_KEY holds the raw key, and Codex adds the Bearer prefix.

Codex / ChatGPT Desktop App

First configure PROWLER_API_KEY in the desktop application’s launch environment. An API key exported only in a shell profile may not be available when the app starts from Finder, the Dock, or a launcher. If you cannot configure the launch environment, add the server manually:

Open Settings and select Plugins → MCPs
Click Add server
Enter prowler as the name and choose type Streamable HTTP
Enter the URL https://mcp.prowler.com/mcp
Add the User-Agent header with the value codex
If the app supports a reference to its launch environment, use PROWLER_API_KEY. Otherwise, add an Authorization header with Bearer followed by the API key.

A literal Authorization header stores the API key in plain text in ~/.codex/config.toml. Use it only as a last resort, exclude the file from dotfile repositories and configuration sync, and revoke and re-issue the key if the file is shared.

Restart Codex after installing the plugin or changing the MCP configuration.

Local server: Replace the URL with your own HTTP endpoint. Keep the same authentication and User-Agent configuration.

Step 5: Verify the Connection

Run /mcp in the app or in a CLI session to list connected servers and their tools.

Codex composer showing the /mcp command output with Prowler tools listed

From the CLI you can also inspect the stored entry directly:

codex mcp list          # one row per server, with status and auth
codex mcp get prowler   # full entry, header values masked

Verify rather than assume. Codex silently ignores unrecognized keys in config.toml — a misspelled key name produces no error at all, and the server simply never receives your credentials. Always confirm with codex mcp get prowler after editing the file by hand.

Step 6: Start Using Prowler MCP

Ask Codex questions that use the Prowler tools:

“Show me all critical findings from my AWS accounts”
“What does the S3 bucket public access check do?”
“List my connected Prowler providers and their last scan date”

Codex answering a question about critical findings using Prowler MCP tools

Troubleshooting

Startup Fails With HTTP 403 Forbidden

Codex reports a handshake failure on startup, with an HTML error page rather than a JSON response:

⚠ MCP client for `prowler` failed to start: MCP startup failed: handshaking with MCP server
  failed: ... unexpected server response: HTTP 403: <html>
  <head><title>403 Forbidden</title></head>

The User-Agent header is missing. Codex’s HTTP client does not send one, and requests without it are rejected before reaching the MCP server. Note this is a 403, not a 401 — so it is not an API key problem. The plugin adds this header automatically. For a manual configuration, add it as shown in Manual MCP Setup; the value itself does not matter, only that the header is present.

Authentication Fails With 401

For a manual configuration, run codex mcp get prowler and confirm the entry has the headers you expect. Values are masked, but a missing header shows as -.
Verify the Codex process has PROWLER_API_KEY in its launch environment without printing the key: test -n "$PROWLER_API_KEY" && echo "PROWLER_API_KEY is set".
PROWLER_API_KEY must contain the raw key without Bearer . The plugin and the bearer_token_env_var manual configuration add the prefix automatically.
If the CLI works but Codex Desktop or an IDE fails, configure PROWLER_API_KEY in that application’s launch environment. Shell-profile exports may not be inherited. Use a literal Authorization header only as the last-resort desktop fallback described in Manual MCP Setup.
Confirm the key has not been revoked in Prowler Cloud.

Server Not Listed

Confirm your Codex CLI version is 0.46.0 or later with codex --version.
Run codex mcp get prowler. If it reports the server is not found, the entry was not written or the TOML table name is misspelled.
Check for a typo in the key names. Codex ignores unknown keys without warning.

Project-Scoped Config Is Ignored

A .codex/config.toml inside a project is loaded only when the project is trusted. If your entry lives there and does nothing, trust the project or move the entry to ~/.codex/config.toml.

Tools Do Not Appear After Editing the Config

Restart Codex. Configuration is read at startup. In the app, quit completely and reopen it, sometimes just closing the window is not enough.

Next Steps

Tools Reference

Explore all available tools and capabilities

All MCP Clients

Configuration reference for every supported client

Getting Help

Search for existing GitHub issues
Ask for help in our Slack community
Report a new issue on GitHub

Welcome

Prowler Products

Open Source

Prowler vs. Others

Connect Codex / ChatGPT Desktop to Prowler MCP Server

Preferred Setup: Install the Prowler Plugin

Prerequisites

Step 1: Get Your Prowler API Key

Step 2: Set the API Key Environment Variable

Step 3: Install the Plugin

Step 4: Verify the Plugin

Manual MCP Setup: Advanced or Fallback

Codex CLI

Codex / ChatGPT Desktop App

Step 5: Verify the Connection

Step 6: Start Using Prowler MCP

Troubleshooting

Startup Fails With HTTP 403 Forbidden

Authentication Fails With 401

Server Not Listed

Project-Scoped Config Is Ignored

Tools Do Not Appear After Editing the Config

Next Steps

Tools Reference

All MCP Clients

Getting Help

​Preferred Setup: Install the Prowler Plugin

​Prerequisites

​Step 1: Get Your Prowler API Key

​Step 2: Set the API Key Environment Variable

​Step 3: Install the Plugin

​Step 4: Verify the Plugin

​Manual MCP Setup: Advanced or Fallback

​Codex CLI

​Codex / ChatGPT Desktop App

​Step 5: Verify the Connection

​Step 6: Start Using Prowler MCP

​Troubleshooting

​Startup Fails With HTTP 403 Forbidden

​Authentication Fails With 401

​Server Not Listed

​Project-Scoped Config Is Ignored

​Tools Do Not Appear After Editing the Config

​Next Steps

Tools Reference

All MCP Clients

​Getting Help

Preferred Setup: Install the Prowler Plugin

Prerequisites

Step 1: Get Your Prowler API Key

Step 2: Set the API Key Environment Variable

Step 3: Install the Plugin

Step 4: Verify the Plugin

Manual MCP Setup: Advanced or Fallback

Codex CLI

Codex / ChatGPT Desktop App

Step 5: Verify the Connection

Step 6: Start Using Prowler MCP

Troubleshooting

Startup Fails With HTTP 403 Forbidden

Authentication Fails With 401

Server Not Listed

Project-Scoped Config Is Ignored

Tools Do Not Appear After Editing the Config

Next Steps

Getting Help