Vanta MCP Server – Compliance Context for AI Agents
Vanta provides a remote MCP server and an open-source local MCP server for accessing Vanta trust-management data from AI tools. It lets authorized AI agents query compliance controls, tests, evidence documents, integrations, people, risks, and vulnerabilities so teams can investigate and remediate compliance issues with live Vanta context.
Overview
Vanta MCP connects AI tools to Vanta's trust-management platform through the Model Context Protocol. Vanta documents a hosted remote MCP server for Claude Code, Cursor, and Perplexity, and also maintains an open-source @vantasdk/vanta-mcp-server package for local stdio use. The integration is intended to give AI agents live compliance context rather than relying on static model knowledge.
What the MCP server enables
The Vanta MCP server exposes Vanta API-backed tools for common governance, risk, and compliance workflows. Agents can list and inspect security controls, review automated tests, enumerate evidence documents, explore frameworks and framework controls, inspect connected integrations and their resources, retrieve people metadata, track risks, and review vulnerabilities. Vanta's Claude Code plugin adds Vanta-specific remediation workflows such as listing prioritized failing tests and generating infrastructure-as-code fixes, but those plugin slash commands are separate from the generic MCP connection and are Claude Code-specific.
When to use it
Use Vanta MCP when an AI agent needs to answer questions about a live Vanta compliance program, summarize failing tests, inspect evidence mapped to controls, investigate risk-register entries, or help developers understand which cloud configuration changes are relevant to compliance failures. It is especially useful for GRC, security engineering, audit-readiness, and developer-remediation workflows where the agent needs current Vanta data.
Connection and authentication
Vanta's remote MCP server uses HTTP transport at https://mcp.vanta.com/mcp for US instances, with separate regional endpoints for EU and AUS tenants. The remote setup authenticates with OAuth in the user's browser after the MCP client connects. Vanta states the remote server is in beta and available to all customers, but currently requires a Vanta Admin role. The local stdio server can be launched with npx -y @vantasdk/vanta-mcp-server and requires VANTA_ENV_FILE, an absolute path to a file containing OAuth credentials.
Key considerations
Vanta's open-source server is marked as experimental and public preview, and Vanta warns users to verify AI-generated responses before taking compliance or security actions. Access is scoped by the authenticated Vanta user and tenant, so teams should grant least privilege, keep OAuth credentials out of source control, and avoid exposing MCP access to users who should not view compliance, risk, vendor, vulnerability, or personnel data.
Supported Transports
streamable_http
URL: https://mcp.vanta.com/mcp
stdio
Command: npx
Args:
-y@vantasdk/vanta-mcp-server
Frequently Asked Questions
- When should an AI agent use the Vanta MCP server?
- Use it when the agent needs current Vanta trust-management context, such as checking failed automated tests, reviewing controls, finding evidence documents, summarizing risk-register items, or helping engineers understand compliance-related remediation tasks.
- What does Vanta MCP add to an AI agent's capabilities?
- It gives the agent live access to Vanta-backed compliance and security data, including controls, tests, frameworks, evidence documents, integrations, people, risks, and vulnerabilities, instead of relying on general model knowledge about compliance programs.
- What can the AI agent access or manage through this server?
- The documented tools cover Vanta controls, control tests, control documents, documents and document resources, frameworks and framework controls, integrations and integration resources, people, risks, tests and test entities, and vulnerabilities. Access depends on the authenticated Vanta account and tenant permissions.
- How is authentication configured for Vanta MCP?
- The hosted remote server uses an OAuth browser authorization flow from the MCP client and currently requires a Vanta Admin role. The local stdio server uses the `VANTA_ENV_FILE` environment variable pointing to an absolute path for OAuth credentials; secrets should be stored outside source control.
- Which transport should be used for Vanta MCP?
- Use `streamable_http` with `https://mcp.vanta.com/mcp` for the hosted Vanta remote MCP server in supported AI tools. Use `stdio` with `npx -y @vantasdk/vanta-mcp-server` when you need to run the open-source Vanta MCP server locally with a credentials file.