Vanta MCP Server

A Model Context Protocol server that provides access to Vanta's automated security compliance platform. Vanta helps organizations achieve and maintain compliance with security frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and others through automated monitoring, evidence collection, and continuous security testing. This MCP server enables AI assistants to interact with Vanta's API to retrieve compliance test results, manage security findings, and access framework requirements.

⚠️ Important Disclaimer: This experimental server is currently in public preview and provides AI assistants with access to your Vanta compliance data. You may encounter bugs, errors or unexpected results. Always verify the accuracy and appropriateness of AI-generated responses before taking any compliance or security actions. Users are responsible for reviewing all outputs and ensuring they meet their organization's security and compliance requirements.

Features

Controls

• List security controls or fetch a specific control by ID
• Discover which automated tests validate each control
• Review evidence documents mapped to controls
• Create, update, delete, and re-map controls (write tools — require --dangerously-allow-writes)

Tool Name	Description
controls	Access security controls in your Vanta account. Provide controlId to get a specific control, or omit to list all controls with optional framework filtering.
list_control_tests	Enumerate automated tests that validate a specific security control, including status and failing entity details.
list_control_documents	List documents that provide evidence for a specific security control so you can quickly locate supporting artifacts.
create_custom_control ⚠️	Create a custom control. Requires --dangerously-allow-writes.
add_control_from_library ⚠️	Add a control from the Vanta control library. Requires --dangerously-allow-writes.
update_control ⚠️	Update a control's metadata. Requires --dangerously-allow-writes.
delete_control ⚠️	Deactivate (delete) a control. Requires --dangerously-allow-writes.
set_control_owner ⚠️	Set a control's owner. Requires --dangerously-allow-writes.
add_document_to_control ⚠️	Map a document to a control. Requires --dangerously-allow-writes.
remove_document_from_control ⚠️	Remove a document mapping from a control. Requires --dangerously-allow-writes.
add_test_to_control ⚠️	Map a test to a control. Requires --dangerously-allow-writes.
remove_test_from_control ⚠️	Remove a test mapping from a control. Requires --dangerously-allow-writes.

Documents

• Enumerate compliance documents across your organization
• Inspect the controls, links, or uploads associated with a document
• Create and delete documents, manage links and owners, upload evidence files, and submit collections (write tools — require --dangerously-allow-writes)

Tool Name	Description
documents	List documents in your Vanta account or retrieve a specific document by ID with metadata for compliance and evidence management.
document_resources	Retrieve resources linked to a document (controls, links, uploads) by specifying the desired resource type.
create_document ⚠️	Create a custom document (evidence request). Requires --dangerously-allow-writes.
delete_document ⚠️	Delete a document by ID. Requires --dangerously-allow-writes.
create_document_link ⚠️	Add an external link as document evidence. Requires --dangerously-allow-writes.
delete_document_link ⚠️	Remove an external link from a document. Requires --dangerously-allow-writes.
set_document_owner ⚠️	Set a document's owner. Requires --dangerously-allow-writes.
submit_document_collection ⚠️	Submit a document's collected evidence. Requires --dangerously-allow-writes.
delete_document_upload ⚠️	Delete an uploaded file from a document. Requires --dangerously-allow-writes.
upload_file_for_document ⚠️	Upload document evidence from base64 content (+ fileName) or a local filePath. Requires --dangerously-allow-writes.

Frameworks

• Review framework adoption and progress metrics across your organization
• Drill into the controls required by each framework

Tool Name	Description
frameworks	List compliance frameworks available in your Vanta account along with completion status and progress metrics.
list_framework_controls	Retrieve the controls associated with a framework, including descriptions, implementation guidance, and current compliance status.

Integrations

• Enumerate connected integrations and review their metadata
• Explore supported resource kinds and fetch integration resources on demand
• Assign owners, descriptions, and scope to discovered resources

Tool Name	Description
integrations	List integrations connected to your Vanta account or fetch details for a specific integration, including supported resource kinds and connection status.
integration_resources	Access integration resources by selecting the desired operation (list_kinds, get_kind_details, list_resources, or get_resource).
update_integration_resources ⚠️	Set the owner, description, and scope of up to 50 discovered resources. Requires --dangerously-allow-writes.

People

• List or retrieve people for compliance and access reviews
• Update people, manage leave, classify accounts, and offboard (write tools — require --dangerously-allow-writes)

Tool Name	Description
people	List people in your Vanta account or retrieve a specific person by ID, including role, email, and group membership metadata.
update_person ⚠️	Update a person's name and/or employment metadata. Requires --dangerously-allow-writes.
set_person_leave ⚠️	Mark a person as on leave between two dates. Requires --dangerously-allow-writes.
clear_person_leave ⚠️	Remove a person's leave information. Requires --dangerously-allow-writes.
mark_as_people ⚠️	Mark accounts as people (in-scope humans). Requires --dangerously-allow-writes.
mark_as_not_people ⚠️	Mark accounts as not people (e.g. service accounts). Requires --dangerously-allow-writes.
offboard_people ⚠️	Offboard one or more people. Requires --dangerously-allow-writes.

Risks

• Track risk scenarios, their status, scoring, and treatment plans
• Create and update risk scenarios, manage controls, and drive approvals (write tools — require --dangerously-allow-writes)

Tool Name	Description
risks	List risk scenarios managed in your risk register or fetch a specific scenario by ID to review status, scoring, and treatment information.
create_risk_scenario ⚠️	Create a risk scenario. Requires --dangerously-allow-writes.
update_risk_scenario ⚠️	Update a risk scenario's fields. Requires --dangerously-allow-writes.
submit_risk_for_approval ⚠️	Submit a risk scenario for approval. Requires --dangerously-allow-writes.
cancel_risk_approval_request ⚠️	Cancel a pending approval request. Requires --dangerously-allow-writes.
add_risk_scenario_control ⚠️	Add a control to a risk scenario. Requires --dangerously-allow-writes.
update_risk_scenario_control ⚠️	Change a risk scenario control's type. Requires --dangerously-allow-writes.
remove_risk_scenario_control ⚠️	Remove a control from a risk scenario. Requires --dangerously-allow-writes.

Tests

• Monitor automated security tests running in your environment
• Investigate the entities associated with a specific test
• Deactivate or reactivate monitoring for individual test entities (write tools — require --dangerously-allow-writes)

Tool Name	Description
tests	Retrieve Vanta's automated security and compliance tests. Filter by status, integration, or framework to understand which controls are passing or failing.
list_test_entities	Get the resources monitored by a specific security test, including failing entities that require remediation.
deactivate_test_entity ⚠️	Deactivate monitoring for a specific entity within a test. Requires --dangerously-allow-writes.
reactivate_test_entity ⚠️	Reactivate monitoring for a test entity. Requires --dangerously-allow-writes.

Vulnerabilities

• Review vulnerabilities surfaced by Vanta, including CVE metadata and affected assets
• Deactivate or reactivate vulnerability monitoring in bulk (write tools — require --dangerously-allow-writes)

Tool Name	Description
vulnerabilities	List vulnerabilities detected across your infrastructure or retrieve a specific vulnerability by ID with CVE details, severity, and impacted asset information.
deactivate_vulnerabilities ⚠️	Deactivate monitoring for 1–50 vulnerabilities, each with a reason and auto-reactivation flag. Requires --dangerously-allow-writes.
reactivate_vulnerabilities ⚠️	Reactivate monitoring for 1–50 vulnerabilities. Requires --dangerously-allow-writes.

Tools

Tool Name	Description
tests	Retrieve Vanta's automated security and compliance tests. Filter by status, integration, or framework to understand pass/fail posture quickly.
list_test_entities	Get resources monitored by a particular test, including failing entities that need remediation.
controls	List security controls in your Vanta account or retrieve a specific control by ID with framework mapping details.
list_control_tests	Enumerate automated tests that validate a specific control, complete with status and failing entity information.
list_control_documents	List documents mapped to a control to locate supporting evidence quickly.
documents	List compliance documents or fetch details for a specific document, including metadata.
document_resources	Retrieve resources linked to a document (controls, links, uploads) by choosing the desired resource type.
integrations	List integrations connected to your Vanta account or fetch details for a specific integration, including resource kinds and connection status.
integration_resources	Inspect integration resource kinds, schema information, full resource lists, or a specific resource by selecting from the supported operations.
frameworks	List compliance frameworks with completion status and progress metrics for each.
list_framework_controls	Retrieve the controls associated with a compliance framework, including descriptions and implementation guidance.
people	List people across your organization or look up a specific person by ID with role, email, and group membership metadata.
risks	List risk scenarios under management or fetch a specific scenario to review status, scoring, and treatment plans.
vulnerabilities	List detected vulnerabilities or retrieve a specific item with CVE metadata, severity, and impacted assets.

Write Tools

The following tools mutate data in your Vanta account and are only registered when the server is started with --dangerously-allow-writes. See Write Operations for setup.

Tool Name	Description
deactivate_vulnerabilities	Deactivate monitoring for 1–50 vulnerabilities.
reactivate_vulnerabilities	Reactivate monitoring for 1–50 vulnerabilities.
deactivate_test_entity	Deactivate monitoring for a specific entity within a test.
reactivate_test_entity	Reactivate monitoring for a test entity.
update_person	Update a person's name and/or employment metadata.
set_person_leave	Mark a person as on leave between two dates.
clear_person_leave	Remove a person's leave information.
mark_as_people	Mark accounts as people (in-scope humans).
mark_as_not_people	Mark accounts as not people (e.g. service accounts).
offboard_people	Offboard one or more people.
create_custom_control	Create a custom control.
add_control_from_library	Add a control from the Vanta control library.
update_control	Update a control's metadata.
delete_control	Deactivate (delete) a control.
set_control_owner	Set a control's owner.
add_document_to_control	Map a document to a control.
remove_document_from_control	Remove a document mapping from a control.
add_test_to_control	Map a test to a control.
remove_test_from_control	Remove a test mapping from a control.
create_document	Create a custom document (evidence request).
delete_document	Delete a document by ID.
create_document_link	Add an external link as document evidence.
delete_document_link	Remove an external link from a document.
set_document_owner	Set a document's owner.
submit_document_collection	Submit a document's collected evidence.
delete_document_upload	Delete an uploaded file from a document.
upload_file_for_document	Upload evidence from base64 content or a local file path.
create_risk_scenario	Create a risk scenario.
update_risk_scenario	Update a risk scenario's fields.
submit_risk_for_approval	Submit a risk scenario for approval.
cancel_risk_approval_request	Cancel a pending approval request.
add_risk_scenario_control	Add a control to a risk scenario.
update_risk_scenario_control	Change a risk scenario control's type.
remove_risk_scenario_control	Remove a control from a risk scenario.
update_integration_resources	Set owner/description/scope on up to 50 resources.

Configuration

Vanta OAuth Credentials

1. Create OAuth credentials from Vanta's developer dashboard
2. Save the client_id and client_secret to an env file:

   {
     "client_id": "your_client_id_here",
     "client_secret": "your_client_secret_here"
   }

Note: Vanta currently allows only a single active access_token per Application. More info here

Usage with Claude Desktop

Add the server to your claude_desktop_config.json:

{
  "mcpServers": {
    "vanta": {
      "command": "npx",
      "args": ["-y", "@vantasdk/vanta-mcp-server"],
      "env": {
        "VANTA_ENV_FILE": "/absolute/path/to/your/vanta-credentials.env"
      }
    }
  }
}

If you are unfamiliar with setting up MCP servers in Claude Desktop, here is an example in the official MCP documentation.

Usage with Cursor

Add the server to your Cursor MCP settings:

{
  "mcpServers": {
    "Vanta": {
      "command": "npx",
      "args": ["-y", "@vantasdk/vanta-mcp-server"],
      "env": {
        "VANTA_ENV_FILE": "/absolute/path/to/your/vanta-credentials.env"
      }
    }
  }
}

Write Operations

By default the server is read-only — only tools that read from Vanta are registered, and the OAuth token requests only the vanta-api.all:read scope. To enable the write tools, pass --dangerously-allow-writes when starting the server. This flag:

• Registers the write tools (e.g. deactivate_vulnerabilities, create_risk_scenario) that are otherwise hidden
• Requests the vanta-api.all:write OAuth scope in addition to vanta-api.all:read

⚠️ Warning: Write operations create, modify, and delete data in your Vanta account. Only enable this flag in environments and with credentials where mutations are intended.

To enable in Claude Desktop, add the flag to the args array:

{
  "mcpServers": {
    "vanta": {
      "command": "npx",
      "args": [
        "-y",
        "@vantasdk/vanta-mcp-server",
        "--dangerously-allow-writes"
      ],
      "env": {
        "VANTA_ENV_FILE": "/absolute/path/to/your/vanta-credentials.env"
      }
    }
  }
}

To enable in Cursor, add the flag to the args array:

{
  "mcpServers": {
    "Vanta": {
      "command": "npx",
      "args": [
        "-y",
        "@vantasdk/vanta-mcp-server",
        "--dangerously-allow-writes"
      ],
      "env": {
        "VANTA_ENV_FILE": "/absolute/path/to/your/vanta-credentials.env"
      }
    }
  }
}

Environment Variables

• VANTA_ENV_FILE (required): Absolute path to the JSON file containing your OAuth credentials

Installation

NPX (Recommended)

npx @vantasdk/vanta-mcp-server

Global Installation

npm install -g @vantasdk/vanta-mcp-server
vanta-mcp-server

From Source

git clone https://github.com/VantaInc/vanta-mcp-server.git
cd vanta-mcp-server
npm install
npm run build
npm start

Build from Source

To build from source:

npm run build

This will:

1. Compile TypeScript to JavaScript
2. Make the output executable
3. Place built files in the build/ directory

Now you can configure Claude Desktop or Cursor to use the built executable:

{
  "mcpServers": {
    "Vanta": {
      "command": "node",
      "args": ["/absolute/path/to/vanta-mcp-server/build/index.js"],
      "env": {
        "VANTA_ENV_FILE": "/absolute/path/to/your/vanta-credentials.env"
      }
    }
  }
}

Development

This server is built with TypeScript and includes the following development tools:

• TypeScript: For type safety and better development experience
• ESLint: For code quality and consistency
• Automated Tool Registry: Zero-maintenance tool registration system
• DRY Utilities: Centralized utilities to reduce code duplication

Project Structure

vanta-mcp-server/
├── src/
│   ├── operations/              # MCP tool implementations
│   │   ├── index.ts            # Barrel export for all operations
│   │   ├── common/             # Shared utilities and infrastructure
│   │   │   ├── descriptions.ts # Centralized parameter descriptions
│   │   │   ├── imports.ts      # Common imports barrel for operations
│   │   │   └── utils.ts        # DRY utilities and request handlers
│   │   ├── controls.ts         # Control-related operations
│   │   ├── vendors.ts          # Vendor-related operations
│   │   ├── people.ts           # People-related operations
│   │   ├── documents.ts        # Document-related operations
│   │   ├── frameworks.ts       # Framework-related operations
│   │   ├── risks.ts            # Risk scenario operations
│   │   ├── tests.ts            # Test-related operations
│   │   ├── integrations.ts     # Integration-related operations (consolidated)
│   │   ├── discovered-vendors.ts # Discovery operations (consolidated)
│   │   ├── trust-centers.ts    # Trust Center operations
│   │   └── ...                 # Other resource operations (18 total)
│   ├── eval/                   # Evaluation and testing framework
│   │   ├── eval.ts            # LLM evaluation test cases
│   │   └── README.md          # Evaluation documentation
│   ├── api.ts                  # Base API configuration
│   ├── auth.ts                 # Authentication handling
│   ├── config.ts               # Control enabled tools
│   ├── index.ts                # Main server entry point
│   ├── registry.ts             # Automated tool registration
│   └── types.ts                # Type definitions
├── build/                      # Compiled JavaScript output
└── README.md                   # This file

Architecture Highlights

• Consolidated Tool Pattern: Single tools intelligently handle both list and get operations with optional ID parameters
• Reduced Complexity: 43 tools (down from 53) through smart consolidation while maintaining full functionality
• Clean Organization: Operations files are cleanly separated from infrastructure code
• Common Subdirectory: All shared utilities, imports, and descriptions are organized in operations/common/
• Automated Registry: New tools are automatically discovered and registered without manual configuration
• DRY Principles: Extensive code reuse through centralized utilities and schema factories
• Type Safety: Full TypeScript coverage with comprehensive type definitions

For detailed architecture documentation, see src/operations/README.md.

Debugging

You can use the MCP Inspector to debug the server:

npx @modelcontextprotocol/inspector npx @vantasdk/vanta-mcp-server

The inspector will open in your browser, allowing you to test tool calls and inspect the server's behavior.

If you want to test a local build you can do so using:

npx @modelcontextprotocol/inspector node path/to/build/index.js

In the browser window you will then need to add the environment variable "VANTA_ENV_FILE": "/absolute/path/to/your/vanta-credentials.env"

Example Usage

Get failing AWS tests for SOC2

{
  "tool": "list_tests",
  "arguments": {
    "statusFilter": "NEEDS_ATTENTION",
    "integrationFilter": "aws",
    "frameworkFilter": "soc2",
    "pageSize": 50
  }
}

License

This project is licensed under the terms of the MIT open source license. Please refer to LICENSE file for details.