What it does

Reads compliance state from Vanta: controls, failing tests, and the evidence that still needs collecting. During an audit the useful question is 'what is still red', and this answers it without a dashboard tour. Keep it read-only; compliance records that change themselves are worse than stale ones.

Install

Terminal

npx -y @vantasdk/vanta-mcp-server

Client configuration

Paste this into your MCP client config (Claude Desktop, Cursor, or any client that reads mcpServers), then restart the client.

mcp.json

{
  "mcpServers": {
    "vanta": {
      "command": "npx",
      "args": [
        "-y",
        "@vantasdk/vanta-mcp-server"
      ]
    }
  }
}

Use it for

Pulling control status and evidence gaps during a SOC 2 push

Skip it if

Writing evidence or closing controls automatically

When to use it

Reach for this when the task needs compliance inside the agent loop. Skip it if a plain shell command or a one-off script is enough — every server you add costs context and adds a failure mode.

Other TypeScript servers

Filesystem — Gives an agent scoped read, write, and search access to directories you explicitly allow
Memory — A persistent knowledge graph stored in a local JSON file, exposed through entities, relations, and observations
Sequential Thinking — Gives the model a scratchpad for structured, revisable reasoning: numbered thoughts that can branch, revise, and conclude

Vanta MCP