DeprecatedSAFE
mcp/vantainc/vanta-mcp-server
DEPRECATED: This project is no longer maintained. Please use the Vanta hosted MCP server instead.
Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
43 41r · 2w · 0d
Transport
stdio
License
MIT
Stars
63
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
⚠️ This repository is no longer maintained.
Please use the Vanta hosted MCP server instead.
No new issues or pull requests will be accepted here.
Vanta MCP Server
A Model Context Protocol server that provides access to Vanta's automated security compliance platform. Vanta helps organizations achieve and maintain compliance with security frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and others through automated monitoring, evidence collection, and continuous security testing. This MCP server enables AI assistants to interact with Vanta's API to retrieve compliance test results, manage security findings, and access framework requirements.
⚠️ Important Disclaimer: This experimental server is deprecated. You may encounter bugs, errors or unexpected results. Always verify the accuracy and appropriateness of AI-generated responses before taking any compliance or security actions. Users are responsible for reviewing all outputs and ensuring they meet their organization's security and compliance requirements.
Features
Controls
- List security controls or fetch a specific control by ID
- Discover which automated tests validate each control
- Review evidence documents mapped to controls
Read from source at commit
3154145829ceOBSERVED · 2026-10-1202
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code
claude mcp add vanta-mcp-server --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y @vantasdk/[email protected]claude-desktop
{
"mcpServers": {
"vanta-mcp-server": {
"command": "npx",
"args": [
"-y",
"@vantasdk/[email protected]"
],
"env": {
"OPENAI_API_KEY": "${OPENAI_API_KEY}"
}
}
}
}03
Exposed tools (43)
41 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
controls | read | Access security controls in your Vanta account. Provide controlId to get a specific control, or omit to list all controls with optional framework filtering. Returns control names, descriptions, framework mappings, and implementation status. |
documents | read | Access documents in your Vanta account. Provide documentId to get a specific document, or omit to list all documents. Returns document IDs, names, types, and metadata for compliance and evidence management. |
download_document_file | write | Download document file by upload ID. Get the actual uploaded document file. Intelligently handles different MIME types: returns text content for readable files (text/*, JSON, XML, CSV, JavaScript) and metadata information for binary files (images, videos, PDFs, etc.). |
frameworks | read | Access compliance frameworks in your Vanta account. Provide frameworkId to get a specific framework, or omit to list all frameworks. Returns frameworks (SOC 2, ISO 27001, HIPAA, GDPR, etc.) with completion status and progress metrics. |
get_trust_center | read | Get Trust Center information. Retrieve detailed information about a specific Trust Center including configuration, branding, and public visibility settings. Use this to access Trust Center details for compliance transparency and customer communication. |
get_trust_center_document | read | Get Trust Center document by ID. Retrieve detailed information about a specific document available in a Trust Center. Use this to access compliance certifications, policies, and other public-facing documentation. |
get_trust_center_subscriber | read | Get Trust Center subscriber by ID. Retrieve detailed information about a specific subscriber including subscription preferences and notification settings. |
get_vendor_security_review | read | Get vendor security review by ID. Retrieve detailed information about a specific security review for a vendor. |
groups | read | Access groups in your Vanta account. Provide groupId to get a specific group, or omit to list all groups. Returns group IDs, names, descriptions, and metadata for organizational structure and access management. |
integration_resources | read | Access integration resources including resource kinds, resource kind details, and specific resources. Specify operation to perform: |
integrations | read | Access connected integrations in your Vanta account. Provide integrationId to get a specific integration, or omit to list all integrations. Returns integration details, supported resource kinds, and connection status for compliance monitoring. |
list_control_documents | read | List a control |
list_control_tests | read | List control tests. Get all automated tests that validate a specific security control. Use this when you know a control ID and want to see which specific tests monitor compliance for that control. |
list_discovered_vendor_accounts | read | List accounts associated with a discovered vendor. Provide discoveredVendorId to retrieve account identifiers, connection details, and discovery metadata. |
list_discovered_vendors | read | List discovered vendors identified by Vanta |
list_framework_controls | read | List framework |
list_group_people | read | List group |
list_library_controls | read | List Vanta controls from the library. These are pre-built security controls available in Vanta |
list_test_entities | read | List a test |
list_trust_center_historical_access_requests | read | List Trust Center historical access requests. Get all historical access requests for a specific Trust Center for auditing and compliance tracking. Use this to review past access patterns and requests. |
list_trust_center_resources | read | List Trust Center resources. Get all downloadable resources and documents available in a specific Trust Center. Use this to see what compliance materials are provided to customers and prospects. |
list_trust_center_subscribers | read | List Trust Center subscribers. Get all subscribers for a specific Trust Center. Use this to manage notifications and communication with stakeholders. |
list_trust_center_viewer_activity_events | read | List Trust Center viewer activity events. Get all viewing and interaction events for a specific Trust Center to understand usage patterns and engagement. Use this for analytics and compliance tracking. |
list_vendor_risk_attributes | read | List all vendor risk attributes in your Vanta account. Returns attribute IDs, names, categories, and risk scoring criteria for vendor risk assessment. Use this to see all available risk attributes for evaluating vendor relationships. |
list_vendor_security_review_documents | read | List vendor security review |
list_vulnerability_remediations | read | List all vulnerability remediations in your Vanta account. Returns remediation IDs, vulnerability references, status, and progress for tracking security improvements. Use this to see all vulnerability remediation efforts and their current status. |
monitored_computers | read | Access monitored computers in your Vanta account. Provide monitoredComputerId to get a specific computer, or omit to list all monitored computers. Returns computer details, compliance status, and security measures for device management. |
people | read | Access people in your Vanta account. Provide personId to get a specific person, or omit to list all people. Returns person IDs, names, email addresses, and organizational information for identity and access management. |
policies | read | Access policies in your Vanta account. Provide policyId to get a specific policy, or omit to list all policies. Returns policy IDs, names, and metadata for governance and compliance management. |
risks | read | Access risk scenarios in your Vanta account. Provide riskId to get a specific risk scenario, or omit to list all risks with optional filtering and pagination. Returns risk details, impact assessments, and mitigation strategies for compliance reporting. |
tests | read | Access continuous monitoring tests in your Vanta account. Provide testId to get a specific test, or omit to list all tests. Returns test IDs, names, types, schedules, current status, and detailed configuration for compliance monitoring. |
trust_center_access_requests | read | Access Trust Center access requests. Provide accessRequestId to get a specific access request, or omit to list all access requests. Use this to manage and review Trust Center access requests including requester details, status, and approval workflow. |
trust_center_control_categories | read | Access Trust Center control categories. Provide controlCategoryId to get a specific control category, or omit to list all categories. Use this to understand how compliance controls are organized and categorized for public display. |
trust_center_controls | read | Access Trust Center controls. Provide trustCenterControlId to get a specific control, or omit to list all controls. Use this to see compliance controls displayed publicly to demonstrate your compliance posture. |
trust_center_faqs | read | Access Trust Center FAQs. Provide faqId to get a specific FAQ, or omit to list all FAQs. Use this to see frequently asked questions and answers published for customers regarding compliance and security practices. |
trust_center_subprocessors | read | Access Trust Center subprocessors. Provide subprocessorId to get a specific subprocessor, or omit to list all subprocessors. Use this to see third-party service providers and their compliance information for transparency. |
trust_center_subscriber_groups | read | Access Trust Center subscriber groups. Provide subscriberGroupId to get a specific subscriber group, or omit to list all subscriber groups. Use this for managing access permissions and organizing subscribers. |
trust_center_updates | write | Access Trust Center updates. Provide updateId to get a specific update, or omit to list all updates. Use this to see compliance status changes, security updates, and important notifications published in the Trust Center. |
trust_center_viewers | read | Access Trust Center viewers. Provide viewerId to get a specific viewer, or omit to list all viewers. Use this for access management and audit purposes to see who can view the Trust Center. |
vendor_compliance | read | Access vendor compliance data including documents, findings, and security reviews. Specify complianceType to get the specific type of compliance information for a vendor. Use this to explore vendor compliance documentation, security findings, and assessment history. |
vendors | read | Access vendors in your Vanta account. Provide vendorId to get a specific vendor, or omit to list all vendors. Returns vendor details, risk levels, and management status for third-party risk assessment. |
vulnerabilities | read | Access vulnerabilities in your Vanta account. Provide vulnerabilityId to get a specific vulnerability, or omit to list all vulnerabilities. Returns vulnerability details, severity levels, and status for security monitoring. |
vulnerable_assets | read | Access vulnerable assets in your Vanta account. Provide vulnerableAssetId to get a specific vulnerable asset, or omit to list all vulnerable assets. Returns asset details, vulnerability counts, and security status. |
04
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/operations/common/imports.ts:7
export { Tool } from "../../types.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/operations/common/utils.ts:1
import { getValidToken, refreshToken } from "../../auth.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/operations/common/utils.ts:4
import { BASE_API_URL } from "../../api.js";LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, zod, @eslint/js, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, eslint-config-prettier
Why it matters. 11 dependency range(s) float
Fix. pin exact versions or ship a lockfile
Gates applied: no_behavioural_pass.
Audited 2026-10-12 · audit v0.4.1 · source sha
3154145829cefull audit observations/trust-audit/mcp-server/vantainc__vanta-mcp-server.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 3154145829ce | SAFE | B | 89 | first audit |
06
Questions
What is the @vantasdk/vanta-mcp-server MCP server?
DEPRECATED: This project is no longer maintained. Please use the Vanta hosted MCP server instead.
What tools does @vantasdk/vanta-mcp-server expose?
43 in total: 41 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @vantasdk/vanta-mcp-server safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does @vantasdk/vanta-mcp-server need?
It reads OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @vantasdk/vanta-mcp-server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @vantasdk/vanta-mcp-server at 1.2.0.
How current is this page?
The grade is for one exact copy of the source (3154145829ce), read on 2026-10-12. The repository is watched and re-audited when it changes.