Drata MCP Server (2026): Admin-Chosen Scopes, Capped by Role

Not documented means the vendor's public documentation does not say; ask in a demo.

Does Drata have an MCP server?

Yes. Drata hosts an official MCP server at US, EU and APAC endpoints, documented in its help center and developer portal. Users sign in with OAuth, and Drata documents no API-key option for MCP. It launched in June 2025 as “experimental”; Drata’s current documentation carries no stage label.

Three other Drata products involve MCP but are not this server. AI Agent Governance, in limited availability since 4 August 2026, includes an “MCP Proxy” that evaluates a company’s own AI agents’ tool calls against policy; it is a separate product. The SafeBase MCP server (early access, 31 July 2026) and Trust Center account review via MCP (early access, 4 August 2026, read-only for visitors) belong to Drata’s Trust Center products. This page covers the server that connects an assistant to your Drata compliance data.

Everything below is what Drata documents, checked against Drata’s pages on 12 October 2026. We have not connected a Drata tenant to an assistant.

What can Drata’s MCP server read, create, update and delete?

Drata’s developer portal lists 36 tools: 22 read, 4 create, 6 update and 4 delete. Evidence, risks and vendors can be created, updated and deleted. Controls can be created and updated but not deleted. Policies and monitoring tests are read-only.

Four details affect how you grant these scopes.

• Update can still change evidence. The evidence update scope can replace, archive or restore the files inside an evidence item, so granting “update” lets an assistant change the files behind a control.
• Owner changes replace. Drata’s example prompts warn that asking to set the owner of a control or another relation list replaces the existing set unless the prompt says “without removing the current ones.”
• Some deletes are called permanent. The portal describes the evidence-file and vendor deletes that way. Drata’s MCP pages do not say whether a deleted item can be restored.
• Drata’s own caution. Its guide says create, update and delete scopes let the server modify Drata data on a user’s behalf and should be granted deliberately.

Before you tell a reviewer what the connection can reach, check which scopes your configuration screen shows and test with a real non-admin user. Drata documents the scopes in its setup guide and the tools in its developer portal.

How do you connect Drata’s MCP server?

An administrator goes first, then each user. The administrator opens Settings, then MCP OAuth Configuration, and creates a configuration with a name, description, expiry date and scopes. Each user then adds Drata as a remote connector in their AI client, using the endpoint for their Drata region, and signs in through OAuth. Drata says credentials are never shared with the AI client.

• US: https://mcp.drata.com/mcp/
• EU: https://mcp-euc1.drata.com/mcp/
• APAC: https://mcp-apse2.drata.com/mcp/

Click-by-click steps are in Drata’s setup guide. StackOne and other third-party “Drata MCP servers” come from other companies and are not Drata’s server; StackOne’s page lists 64 actions and does not say how it differs from Drata’s.

How do scopes and user roles limit what the assistant can do?

Two layers apply. The administrator’s OAuth configuration sets the scopes. Each user then receives only the intersection of those scopes and their own Drata role. Read-only roles cannot use create, update or delete scopes.

Yes, Drata’s MCP server can be read-only: grant only read: scopes in the OAuth configuration. Drata documents no separate read-only mode; this is the mechanism its scope list provides. Scopes are a tenant setting, so the only per-person limit is the Drata role, and the person who connects matters as much as the scopes. To add a scope later, the administrator edits the configuration and every user disconnects and reconnects, because existing tokens keep the scopes they were issued with.

The scope sets below are our suggestion, derived from Drata’s scope and role tables. Drata does not publish job-level sets. Read-only variants of a role can use the read jobs.

The roles read:controls allows come from the developer portal only; the setup guide does not list that scope (see the differences table above).

Roles do not stack evenly. Control Manager and Restricted Control Manager can delete evidence but not risks or vendors. Risk Manager and Restricted Risk Manager can delete risks and vendors but not evidence. Risk Register Owner can delete risks only, and DevOps Engineer appears on no delete scope. Admin, Workspace Administrator and Information Security Lead appear on all three. Drata also says its Service User (integration) role has equivalent access to every scope, so a Service User is the widest case.

Our suggestion for the rollout: start with the read jobs, add one write job at a time, add delete last and only for named objects, set a short expiry, and have people connect with the narrowest role that does their job.

The read tools include vendor documents and security reviews, which carry content that came from outside your company. An assistant holding a write or delete scope reads that content in the same session, so grant write and delete scopes only to the users whose work needs them.

Which AI assistants work with Drata’s MCP server?

Drata documents Claude, ChatGPT, Cursor and Microsoft Copilot, and says others work. The main difference is write behavior: in ChatGPT the Drata connector can only search and fetch until Developer Mode is on.

Source: Drata's setup guide, developer portal. Drata's launch blog also named Augment and other AI IDEs.

Drata describes a confirmation step before each write only for ChatGPT in Developer Mode. Whether Claude, Cursor or Copilot ask before a write call depends on the client, and Drata’s pages do not document it. Test that in your own tenant before you grant write scopes.

What are Drata’s AI agents, and does a person approve their output?

Drata’s own AI agents run inside Drata and are separate from the MCP server. Drata describes human approval for its vendor-risk, questionnaire and Trust Center agents. For changes an assistant makes through MCP, Drata’s documentation describes no approval step inside Drata. The controls it documents are scopes, roles and, in ChatGPT, a confirmation prompt.

Source: Drata's March 2026 agent announcement, Agentic TPRM page, AI Questionnaire Assistance page, AI Agent Governance announcement and AI page. These are Drata's descriptions, not results we measured.

“Drata Agent” is endpoint software that reports device state, not an AI agent.

None of these descriptions covers material an assistant creates through MCP and an auditor later sees, such as evidence, control text or risk entries, so none says whether a person approves it. Whether Drata marks such records as assistant-created is not documented. For the auditor’s side of that question, see what auditors check when AI agents and MCP servers are in scope.

What should your security reviewer check before you connect Drata’s MCP server?

Eight checks: who approves the connection, which role the assistant acts as, whether it needs write or delete, where its actions are recorded, which model provider sees the data, how to revoke access, which regional endpoint applies, and whether your plan includes it. Drata documents most of these. It does not document where MCP actions are logged, token lifetime or plan gating.

On data use, Drata’s Responsible AI statement (updated 17 September 2026) says Drata by default “does not use Customer Data to train shared or general-purpose AI models.” The same statement allows two exceptions: with a customer’s express authorization Drata may train or customize a tenant-specific model, and it may use aggregated or deidentified data derived from Customer Data to train and improve models. Third-party model providers are under contractual and technical safeguards against training their general-purpose models. Drata’s Trust Center subprocessor list names OpenAI, tagged for SafeBase and described as supporting questionnaire answering in AI Questionnaire Assistance, plus Vellum and Braintrust as opt-in AI tooling. It does not say which models sit behind Drata’s other AI features.

Tell your CPA before a write-enabled connection goes live. The auditor decides what the connection means for your scope, and what auditors check when AI agents and MCP servers are in scope covers the access, change and monitoring questions to expect.

How does Drata’s MCP server compare with Vanta’s and Sprinto’s?

Drata limits access with administrator-chosen scopes, can delete evidence, risks and vendors, and documents no API key; Vanta follows the user’s role and publishes no tool catalog; Sprinto follows the user’s role, offers a Developer API key and has an organization-wide off switch. The first table below shows the peers’ stage, access, connection rules and logging; the second adds what the first omits.

Not documented means the vendor's public documentation does not say; ask in a demo.

Source: Drata's developer portal; Vanta's MCP setup help and developer hub; Sprinto's MCP documentation, July 2026 update and Claude connector listing. Each vendor's own page governs; a count from a connector listing is not a vendor-published catalog.

Those rows describe documentation, not how well any server works. Compliance platforms’ MCP servers compared by access lists every platform that documents an official MCP server, with the same facts and a checked date for each, and what each platform’s AI agents do covers the agents inside the products. For Drata as a whole product, including pricing, manual work and auditor access, read the Drata review and the Drata profile, or compare it head to head in Vanta vs Drata and Drata vs Sprinto. The detail behind the other two columns is on Vanta’s MCP server and its role-based access and Sprinto’s MCP server and its admin-or-editor access.