Skip to content
Vanta

VantaMCP Server

by Vanta
Released
MIT
Repository Docs npm
Featured ProductivityCloud & Infrastructure

Summary

Vanta's official remote MCP server — query controls, tests, vendors, vulnerabilities and policies across SOC 2 and ISO 27001, and remediate failing tests from your agent.

Features

  • Hosted per region: mcp.vanta.com, mcp.eu.vanta.com and mcp.aus.vanta.com
  • OAuth against your Vanta account; Vanta Admin role required
  • Query controls, failing tests, vendors, vulnerabilities and policies
  • Remediate failing tests and analyse compliance gaps across SOC 2 and ISO 27001
  • Tested with Claude Code, Cursor, Perplexity and Claude Cowork
  • Open-source self-hosted alternative for teams that cannot use a hosted endpoint

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Vanta" tools will be available.
{
  "mcpServers": {
    "vanta-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.vanta.com/mcp"
      ]
    }
  }
}

Description

Vanta automates the evidence-gathering behind compliance frameworks: it watches your cloud, HR and device fleet, runs continuous tests against each control, and turns the results into an audit-ready record. The official Vanta MCP server puts that record behind an agent's tool calls, so a question like "which SOC 2 tests are failing and what's the fix?" gets answered from live data rather than a screenshot of a dashboard.

Remote, not local. Vanta hosts the server per region — https://mcp.vanta.com/mcp for the US, https://mcp.eu.vanta.com/mcp for Europe, https://mcp.aus.vanta.com/mcp for Australia. There is nothing to install and nothing to keep updated; a client that speaks remote MCP with OAuth connects directly. Authentication is OAuth against your Vanta account, and access is currently limited to Vanta Admins — a non-admin user cannot connect.

What an agent can do with it. Remediate failing tests, manage controls, assess vendor risk, track vulnerabilities, govern policies and analyse compliance gaps across the frameworks your organisation runs. Because the agent is talking to the same API the Vanta UI does, the work it proposes lands in the same audit trail.

Availability and alternatives. The remote server is in beta and has been released to all customers. Vanta officially tests Claude Code, Cursor, Perplexity and Claude Cowork, and says any client that can hold a remote MCP endpoint with OAuth — VS Code and Codex included — should work. If your organisation would rather not point at a hosted endpoint, Vanta also publishes an open-source, self-hosted server (@vantasdk/vanta-mcp-server), and a Claude Code plugin bundles the remote server with purpose-built remediation skills.

Related MCP Servers

MCP: Automox MCP Server

by Automox

Automox's official MCP server for endpoint management — 130+ tools over devices, patches, policies, groups and audit data, self-hosted or on Automox's hosted endpoint.

Cloud & Infrastructure

MCP: JFrog MCP Server

by JFrog

JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.

Developer Tools

MCP: Cloudsmith MCP

by Cloudsmith

Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.

Developer Tools

MCP: Transcend MCP Server

by Transcend

Transcend's privacy platform over MCP: data inventory, DSR automation, consent, preferences, assessments and workflows, each as its own OAuth-scoped server.

Developer Tools
Browse all MCP servers →