Menu
On this page
- Does Vanta have an MCP server?
- What can the Vanta MCP server read and change?
- Is Vanta’s MCP server read-only?
- Who can connect Vanta to an AI assistant?
- How do you connect Vanta’s MCP server to Claude, ChatGPT or Cursor?
- What are Vanta’s AI agents, and do they need approval?
- What should your security reviewer check before you connect it?
- How does Vanta’s MCP server compare with Drata’s, Sprinto’s and Secureframe’s?
As of October 2026, Vanta's official hosted MCP server (public preview) lets Claude, ChatGPT, Cursor and other assistants read your Vanta data and change risks, issue status, policy uploads and privacy records. Tests and controls stay read-only. Any user can connect within their own role. Whether actions reach Vanta's audit log is not documented.
Compare with: Drata's MCP server: admin-set scopes and roles if you want an admin to set the scopes before anyone connects, or Sprinto's MCP server and its admin-or-editor access for an API-key alternative to OAuth.
| Platform | Official MCP server | Access | Who can connect | AI actions logged | Checked |
|---|---|---|---|---|---|
| Vanta | Official, public preview (its docs say beta) (docs) | Read, write and delete | Any user, limited to their role | Not documented | 12 Oct 2026 |
Not documented means the vendor's public documentation does not say; ask in a demo.
Does Vanta have an MCP server?
Yes. Vanta has an official, hosted MCP server with separate endpoints for the US, EU and Australia, in public preview as of October 2026. It opened to all customers on 15 April 2026 and replaced an open-source server that Vanta archived on 17 June 2026. Vanta’s developer docs call the hosted server beta; its release posts call it Public Preview.
Several pages that still rank in search describe the older server, so the history matters.
| Date | What changed |
|---|---|
| June 2025 | Vanta announces a local, open-source server with read-only tools for Claude and Cursor, labeled “public preview”. |
| 15 April 2026 | The hosted remote server becomes available to all customers in Public Preview, after a private beta. |
| 17 June 2026 | The local GitHub repository is archived and marked deprecated in favor of the hosted server. |
| July 2026 | The Vanta App for ChatGPT arrives, built on the hosted server. |
| Week of 23 August 2026 | Vanta’s release notes list “MCP Server for Non-Admins”. |
The archived local package (@vantasdk/vanta-mcp-server) is still mentioned in Vanta’s developer docs as a fallback for clients that cannot reach the hosted server. Vanta’s developer hub also runs a separate docs-only server, covered below.
Vanta’s pages use both labels for the hosted server, and the 2025 local server was also called a public preview, so a label alone does not say which server a page means. Vanta’s developer hub, help center and Claude Code plugin README say beta. The April 2026 post and the September 2026 What’s New page say Public Preview. The release notes say “public beta feature, following a private beta”. Vanta’s pages give no general-availability date.
Plan coverage differs by page. The April 2026 post lists Essentials, Plus, Professional and Enterprise. The help-center FAQ says all customers, and the September 2026 What’s New page says Public Preview “on Essentials plans and above”. Some areas return data only where that module is enabled on the account: risks, access reviews, audits, questionnaires, data processing and the knowledge base. Vanta’s pricing guide covers what the plans cost.
What can the Vanta MCP server read and change?
Vanta’s MCP server reads most of a Vanta account and writes to a short list: risks, issue status, policy uploads, privacy records, risk registers and the knowledge base. Tests and controls are read-only. Deletes are documented only for privacy records and risk registers.
| Area | Reads | Changes | Deletes |
|---|---|---|---|
| Tests and controls | Yes, with remediation guidance | No. Fixes happen in your assistant or repository; the Claude Code plugin can open a draft pull request | No |
| Risks and issues | Yes | Create and update risks; update issue status | None documented |
| Risk registers | Yes | Create, rename and update | Yes |
| Policies and documents | Yes | Upload policy documents; draft policy text with a generatePolicy tool (beta, Admin only) | None documented |
| Privacy records | Yes | Create and update processing activities and categories, impact assessments (DPIA, LIA, TRA) and data processing controllers; link and unlink them to risks and assessments | Yes |
| Knowledge base | Yes | Manage resources, Answer Library content and tags | None documented |
| Assessments and questionnaires | Yes | Vanta’s developer hub says the server can run security assessments and manage risk attributes on vendors; the detail is not documented | None documented |
| Frameworks, vulnerabilities, people, access reviews, audits, data processing, integrations | Yes | None documented | None documented |
Source: Vanta's MCP troubleshooting and FAQ, MCP overview and developer hub, read 12 October 2026. This is what Vanta documents; we have not connected to or tested the server. "None documented" means the pages do not describe one, not that none exists.
Fixing a failing test is the clearest case. The server returns what failed and how to fix it, and the change itself happens in your assistant or repository. Vanta’s quickstart says the assistant asks before running commands that change live resources.
Vanta does not publish a tool list or a tool total for the hosted server. Its release notes give increments only: 28 new tools in the week of 31 May 2026, 20 privacy tools in the week of 21 June 2026, and knowledge base tools in the week of 16 August 2026. The archived local server had 14 read-only tools. If your reviewer wants a tool-by-tool list, ask Vanta for it. Drata, by comparison, publishes a table of 36 tools.
Is Vanta’s MCP server read-only?
Vanta’s server can write. Its FAQ says a connection needs at least read access and that write actions need re-authorization with write permissions enabled. The FAQ does not show the consent screen step by step, so confirm the permissions you grant when you connect.
Vanta’s documented writes are the ones in the scope table above: risks, issue status, policy uploads, privacy records, risk registers and the knowledge base. If your reviewer requires a read-only assistant, the limit you can document without testing is the connecting user’s role.
Who can connect Vanta to an AI assistant?
Any Vanta user can connect, and the assistant acts with that person’s role and permissions, according to Vanta’s help center and August 2026 release notes. Vanta opened the server to non-admin users in late August 2026.
Vanta documents the change in two places:
- The help-center overview and FAQ (updated September 2026) say any user can connect, and what they can do mirrors their role. A few capabilities, such as generating draft policy text, stay Admin only.
- The release notes list “MCP Server for Non-Admins” in the week of 23 August 2026, covering editor, collaborator and custom-role users.
A quick test confirms it for your tenant: ask someone with a non-admin role to try the connection.
Vanta’s FAQ tells each person to connect with their own account, so actions are tied to the right user. That is attribution. It is not a statement that the actions are logged.
Vanta’s consent step is OAuth in the browser. A person approves the connection by clicking Allow on a Vanta consent page. No API-key route is documented for the hosted server.
How do you connect Vanta’s MCP server to Claude, ChatGPT or Cursor?
Add Vanta’s account server for your region, https://mcp.vanta.com/mcp for the US, then approve the OAuth consent page in Vanta. Claude, Cursor, Perplexity, Codex and ChatGPT can all connect. Vanta maintains setup steps for Claude Code, Claude Cowork, Cursor and Perplexity, and its developer quickstart also covers Codex. ChatGPT connects through the Vanta App for ChatGPT, which runs on the same server. Any other client that supports remote MCP with OAuth works but shows a warning banner, because Vanta does not publish its redirect URL.
Use the endpoint for the region your Vanta account is in:
| Region | Endpoint |
|---|---|
| United States | https://mcp.vanta.com/mcp |
| European Union | https://mcp.eu.vanta.com/mcp |
| Australia | https://mcp.aus.vanta.com/mcp |
In Claude Code, claude mcp add --transport http vanta https://mcp.vanta.com/mcp adds the US server. Open /mcp and approve the OAuth page in Vanta. The official Vanta plugin from Claude’s plugin marketplace bundles the same hosted URL with skills such as /vanta:fix-test and /vanta:list-tests. A manual connection reaches the same tools without the skills, and the plugin is built for Claude Code rather than browser chat. Vanta’s setup article has the steps for each client, including Claude Cowork, which needs permission to add custom connectors. If a connection stops working, remove it in the assistant and add it again, which issues a new token.
Connect to the account server, not the docs server. https://developer.vanta.com/mcp only searches Vanta’s developer documentation, as Vanta’s AI Skills page explains. It is separate from the product server and cannot act on your Vanta account. Third-party wrappers, such as Truto’s connector, and MCP directory listings are not Vanta’s server either. Vanta’s help center says the hosted server is available to all customers, and no enterprise or sandbox request appears in its setup steps.
What are Vanta’s AI agents, and do they need approval?
Vanta’s AI agents run inside Vanta. The MCP server is the opposite direction: an assistant you choose calls into Vanta. The two are separate products, and the agents differ in whether Vanta says a person approves their output.
| Agent | What Vanta says it does | Launch | Does a person approve? |
|---|---|---|---|
| Vanta AI Agent | Maps uploaded policies to controls with a rationale, summarizes policy changes, flags SLA inconsistencies and answers policy questions. Since August 2026 it can rebuild uploaded controls, policies or framework documents in Vanta | June 2025 | Vanta says you stay “firmly in control”; policy change summaries go “for approval”, and a review canvas sits in front of anything the onboarding flow writes |
| Agent 2.0 / Agentic Trust Platform | Evidence collection, audit preparation, questionnaires and vendor risk, with memory of your program | Announced 18 November 2025 | Not discussed in the announcement |
| Compliance Agent | Automates the evidence lifecycle, checks policies against the program, detects AI service accounts and gives remediation guidance | 19 March 2026 | Not discussed. The post says features are “generally available or in public preview” without saying which |
| Agent for Risk | Maps risks to assets, controls and vendors, suggests follow-ups and notifies stakeholders | 2 June 2026, generally available (some mappings in preview) | The post says to “act with a human in the loop, always” |
| Custom agents (What’s New) | Runs a recurring workflow you describe in plain language, on a schedule or when something in your program changes | Public Preview on Essentials and above (September 2026) | “Anything sensitive waits for your approval before it executes” |
| AI Governance | Inventories your own AI agents and runs impact assessments aligned to ISO 42001 and the EU AI Act. It is not an agent Vanta operates | 30 July 2026, early access | Not discussed; Vanta describes enforcement as what it is “building toward” |
A search for Vanta Agent 2.0 leads to the November 2025 announcement of the Agentic Trust Platform. That post says the new capabilities “will be available in the coming months”, so 18 November 2025 is an announcement date rather than a ship date. Later release notes show individual agent features shipping through 2026. The table reports Vanta’s own descriptions.
Vanta says it does not train AI models on customer data. That statement is on its AI commitments page and was repeated in a June 2026 post. The commitments post, dated 2024, qualifies it: Vanta “does not train models on customer data today” and promises advance notice before that changes. It adds that third-party AI providers are under data processing agreements that bar training on data Vanta shares, and that customers can switch AI features off product-wide in Settings. Vanta’s Trust Center subprocessor list tags OpenAI, Anthropic, Google and Microsoft for application AI functionality, plus supporting vendors for browser and sandbox infrastructure, evaluation, document parsing and AI security. The list is undated and does not say which provider handles which feature. These are public statements, not contract terms; ask for the data processing agreement language.
What should your security reviewer check before you connect it?
Before connecting Vanta’s MCP server, check seven things: who approves the connection, which role the assistant acts as, whether you need write or delete, where its actions are recorded, which provider processes the data, how you revoke it, and which regional endpoint it uses. Vanta’s pages leave several of them undocumented: whether an admin can restrict who connects, where actions are recorded, how to revoke beyond re-adding the connection, and whether MCP content reaches Vanta’s AI providers.
| Check | What Vanta documents | What to do or ask |
|---|---|---|
| Who approves the connection | Any user can connect with their own account. No admin approval step or allow-list for MCP connections is documented | Decide internally who may connect and whether non-admin roles should. Ask Vanta whether an admin can restrict it |
| Which role it acts as | The connecting user’s role and permissions; a few capabilities are Admin only | Connect from the least-privileged account that does the job, one account per person |
| Write or delete | Writes to risks, issue status, policies, privacy records, risk registers and the knowledge base; deletes of privacy records and risk registers. A connection needs at least read access, and write actions need re-authorization with write permissions enabled | Confirm the permissions you grant when you connect. List which of your roles can do those things in Vanta, since the role is the only documented limit |
| Where actions are recorded | Not documented. Vanta’s pages do not say whether MCP actions appear in its audit log or are marked as MCP-originated | Ask Vanta. Make one low-risk change through the assistant and look for it in Vanta’s change history |
| Which provider processes the data | Not covered for MCP. Vanta’s no-training statement and subprocessor list describe Vanta’s own AI features, and Vanta does not say whether MCP content reaches those providers | Whatever the assistant reads goes to its own provider. Add that provider to your vendor inventory and check its data terms for your plan |
| How to revoke | Remove the connection in the assistant and add it again to issue a new token. Token lifetime, an organization-wide switch, a role allow-list and an admin-side revoke screen are not documented | Ask whether removing a user in Vanta ends their MCP session |
| Which region | One endpoint each for the US, EU and Australia | Use the endpoint that matches your account’s region, and ask Vanta whether the endpoint changes where MCP data is processed |
For what an auditor asks once an agent has tool access, including logging and approvals, see SOC 2 controls for AI agents and MCP servers. This page stays with what Vanta documents.
How does Vanta’s MCP server compare with Drata’s, Sprinto’s and Secureframe’s?
Vanta, Drata, Sprinto and Secureframe differ most on who sets the limit and on delete access. Vanta ties access to the user’s role. Drata adds an admin-created scope list on top of the role. Sprinto requires admin or editor access, and Secureframe limits connection to admins and users who can create or already hold an API key. Vanta publishes no tool total. Drata’s and Secureframe’s docs give one, and Sprinto’s Claude listing shows one.
| Platform | Official MCP server | Access | Who can connect | AI actions logged | Checked |
|---|---|---|---|---|---|
| Drata | Official (docs) | Read, write and delete | Any user, limited to their role; an admin turns it on first | Drata's AI product page says it keeps full audit logging; its setup docs do not say where MCP actions are recorded | 12 Oct 2026 |
| Sprinto | Official (docs) | Read and write | Certain roles only; an admin turns it on first | Not documented | 12 Oct 2026 |
| Secureframe | Official (docs) | Read, write and delete | Certain roles only | Not documented | 12 Oct 2026 |
Not documented means the vendor's public documentation does not say; ask in a demo.
The table above covers status, access and logging for the three peers. The one below puts Vanta beside them and adds the details a reviewer asks next.
| Vanta | Drata | Sprinto | Secureframe | |
|---|---|---|---|---|
| Deletes | Privacy records, risk registers | Evidence, risks, vendors | No tool named delete in its Claude listing; archive, close and disable actions exist | Comments, knowledge base answers and questions, system security plan records (duties, roles, policies, vendors) |
| What caps access | The user’s role | Scopes an admin grants, intersected with the user’s role | Admin or editor access to connect (its docs also say read-only users can query); actions follow the user’s role | The connecting user’s own permissions |
| Authentication | OAuth | OAuth, through an admin-created configuration with scopes and an expiry date | OAuth or API key | OAuth 2.1 or API key and secret |
| Endpoint regions | US, EU, Australia | US, EU, APAC | US, EU, India, Australia | US, UK |
| Published tool count | None | 36 (developer portal) | 395 (Claude connector listing; Sprinto’s docs give none) | 112 (docs) |
| Plan coverage | Essentials and above in Vanta’s posts; “all customers” in its help center | Not stated | Not stated | Not stated |
Vanta, Drata, Sprinto and Secureframe rows reflect each vendor's documentation as of 12 October 2026. "Not stated" means the vendor's pages do not say. Sprinto's count is vendor-listed and its direct connection may expose more.
None of the four documents where MCP actions are recorded. Drata’s AI product page says it keeps “full audit logging” for its server, but its setup guide and developer portal do not say where actions land. Vanta, Sprinto and Secureframe say actions are attributed to the connecting user, which shows who acted rather than where the action is logged. Drata’s MCP server: admin-set scopes and roles and Sprinto’s MCP server and its admin-or-editor access answer the same questions for each. Compliance platforms’ MCP servers compared by access puts every platform with a documented MCP server in one comparison. What each platform’s AI agents do covers the agents inside the products, and Secureframe’s profile has its record.
To weigh Vanta beyond AI, see the Vanta review for where evidence and manual work fall, Vanta vs Drata for the head-to-head, and the Vanta software profile for its dated record.
More in Compliance Tools