Vanta

NPM · @MINDSTONE/MCP-SERVER-VANTA · SCANNED AUG 3

Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs

Available components

+27 this week 73 73 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency84

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to mindstone/mcp-servers). View diagnostics → Pass
License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license. See how to fix → Fail
Actively maintained (last published 3 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 1822 tokens (~107/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability check failed: the tool surface changed between 0.1.0 and 0.2.0: 3 tool removals, 3 breaking changes, 2 additions. See how to fix → Fail

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @mindstone/mcp-server-vanta

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add mindstone-mcp-server-vanta -- npx -y @mindstone/mcp-server-vanta

# add to Codex CLI

codex mcp add mindstone-mcp-server-vanta -- npx -y @mindstone/mcp-server-vanta

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mindstone-mcp-server-vanta": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mindstone/mcp-server-vanta"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add mindstone-mcp-server-vanta --command npx --arg -y --arg @mindstone/mcp-server-vanta

# ~/.hermes/config.yaml

mcp_servers:
  mindstone-mcp-server-vanta:
    command: "npx"
    args: ["-y", "@mindstone/mcp-server-vanta"]

// mcp.json

{
  "mcpServers": {
    "mindstone-mcp-server-vanta": {
      "command": "npx",
      "args": [
        "-y",
        "@mindstone/mcp-server-vanta"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +37
- Stability: unverified → fail ▼ security
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- The attested source repository moved: mindstone/mcp-servers security
- License: unverified → fail ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Dependency health: unverified → partial ▲ functional
- Licence: FSL-1.1-MIT functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 +15
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −40
- Malware scan: pass → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.1.0 → 0.2.0 functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@mindstone/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: mindstone/mcp-servers
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/mindstone/mcp-servers/.github/workflows/release.yml@refs/heads/main
Rekor log index:: 2289307681
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:6b8ef874dd45bdad486753f00d780eb4a18348a5eaa944cfacebb15d5ed21cd69e076dc70da1902726b9ae871ab94ee9f49954cc06eaae46a450d20e6
Discovery method:: attestation_endpoint

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 17 exposed · ~1,822 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

vanta_attach_vendor_document Attach Document to Vanta Vendor ~279

Attach a compliance document (SOC 2 report, DPA, pen test, questionnaire) to an existing vendor in Vanta. HOW IT WORKS: - Pass a public https:// URL. The connector downloads the file and forwards the bytes to Vanta as a multipart upload. - document_type is required; Vanta rejects the upload without it. - Vanta accepts .pdf, .docx, .jpg, .png, and .xlsx files. RELATED TOOLS: - vanta_list_vendors to find the vendor_id. RETURNS: - JSON with ok, document, file_name, content_type, and size_bytes.

Input Output Examples

Name	Type	Req	Description
description	string	—	Description of the document
document_name	string	—	The document's title in Vanta
document_type	string	yes	Vanta vendor document type, required. Documented values include SOC2_REPORT, ISO_27001_REPORT, PEN_TEST, DPA, PRIVACY_POLICY, OTHER
document_url	string	yes	Public https:// URL of the file to attach; the connector downloads it and forwards the bytes to Vanta
file_name	string	—	File name to store in Vanta; defaults to the name from the URL or Content-Disposition header
vendor_id	string	yes	Vanta vendor ID to attach the document to

No output schema declared.

No examples provided.

vanta_create_vendor Create Vanta Vendor ~134

Create a new vendor in Vanta.

Input Output Examples

Name	Type	Req	Description
description	string	—	Description of the vendor relationship
risk_level	string	—	Vendor risk level (LOW, MEDIUM, HIGH, CRITICAL, or UNSCORED)
vendor_category	string	—	Vendor category displayName (free-form string, e.g. cloudMonitoring)
vendor_contact_email	string	—	Primary contact email at the vendor
vendor_contact_name	string	—	Primary contact name at the vendor
vendor_name	string	yes	Name of the vendor
vendor_website	string	—	Website URL of the vendor

No output schema declared.

No examples provided.

vanta_deactivate_vulnerability_monitoring Deactivate Vanta Vulnerability Monitoring ~91

Deactivate monitoring for select vulnerabilities. Vanta will not monitor a deactivated vulnerability until it is reactivated.

Input Output Examples

Name	Type	Req	Description
deactivate_reason	string	yes	Reason for deactivating the vulnerability
should_reactivate_when_fixable	boolean	yes	Whether or not vulnerability should reactivate when it becomes fixable
vulnerability_id	string	yes	Vanta vulnerability ID to deactivate monitoring for

No output schema declared.

No examples provided.

vanta_get_compliance_summary Get Vanta Compliance Summary ~48

Get an aggregate compliance summary from Vanta framework counters.

Input Output Examples

Name	Type	Req	Description
framework	string	—	Filter summary to one framework, such as SOC2, ISO27001, or HIPAA

No output schema declared.

No examples provided.

vanta_get_control Get Vanta Control ~38

Get details for one Vanta control by ID.

Input Output Examples

Name	Type	Req	Description
control_id	string	yes	Vanta control ID returned by vanta_list_controls

No output schema declared.

No examples provided.

vanta_get_test Get Vanta Test ~39

Get details for one Vanta compliance test by ID.

Input Output Examples

Name	Type	Req	Description
test_id	string	yes	Vanta test ID returned by vanta_list_tests

No output schema declared.

No examples provided.

vanta_get_vendor Get Vanta Vendor ~39

Get details for one Vanta vendor by ID.

Input Output Examples

Name	Type	Req	Description
vendor_id	string	yes	Vanta vendor ID returned by vanta_list_vendors

No output schema declared.

No examples provided.

vanta_get_vulnerability Get Vanta Vulnerability ~41

Get details for one Vanta vulnerability by ID.

Input Output Examples

Name	Type	Req	Description
vulnerability_id	string	yes	Vanta vulnerability ID returned by vanta_list_vulnerabilities

No output schema declared.

No examples provided.

vanta_list_controls List Vanta Controls ~78

List Vanta controls with an optional framework filter.

Input Output Examples

Name	Type	Req	Description
framework	string	—	Filter by framework, such as SOC2, ISO27001, or HIPAA
page_cursor	string	—	Cursor from a previous response for the next page
page_size	integer	—	Number of controls to return, up to 100

No output schema declared.

No examples provided.

vanta_list_people List Vanta People ~94

List people tracked in Vanta with optional name/email and employment-status filters.

Input Output Examples

Name	Type	Req	Description
email_or_name	string	—	Filter people by email address, first name, or last name
employment_status	string	—	Filter by documented employment status
page_cursor	string	—	Cursor from a previous response for the next page
page_size	integer	—	Number of people to return, up to 100

No output schema declared.

No examples provided.

vanta_list_tests List Vanta Tests ~118

List compliance tests from Vanta with optional status and framework filters.

Input Output Examples

Name	Type	Req	Description
framework	string	—	Filter by framework, such as SOC2, ISO27001, or HIPAA
page_cursor	string	—	Cursor from a previous response for the next page
page_size	integer	—	Number of tests to return, up to 100
status	string	—	Filter by documented test status, such as OK, NEEDS_ATTENTION, DEACTIVATED, IN_PROGRESS, INVALID, or NOT_APPLICABLE

No output schema declared.

No examples provided.

vanta_list_vendors List Vanta Vendors ~99

List vendors tracked in Vanta with optional name and status filters.

Input Output Examples

Name	Type	Req	Description
name	string	—	Filter vendors by name (case-insensitive partial match)
page_cursor	string	—	Cursor from a previous response for the next page
page_size	integer	—	Number of vendors to return, up to 100
status	string	—	Filter by documented vendor status: MANAGED, ARCHIVED, or IN_PROCUREMENT

No output schema declared.

No examples provided.

vanta_list_vulnerabilities List Vanta Vulnerabilities ~180

List vulnerabilities from Vanta with optional severity, integration, and deactivation filters. WORKFLOW: - Start here to review open vulnerability posture. - Use page_size and page_cursor for pagination. RELATED TOOLS: - vanta_get_vulnerability for full details on one vulnerability. RETURNS: - JSON with ok, vulnerabilities, count, and pageInfo.

Input Output Examples

Name	Type	Req	Description
integration_id	string	—	Filter by the Vanta integration ID that detected the vulnerability
is_deactivated	boolean	—	Filter by whether Vanta monitoring is deactivated for the vulnerability
page_cursor	string	—	Cursor from a previous response for the next page
page_size	integer	—	Number of vulnerabilities to return, up to 100
severity	string	—	Filter by documented severity: CRITICAL, HIGH, MEDIUM, or LOW

No output schema declared.

No examples provided.

vanta_query_test_results Query Vanta Test Results ~102

List test entities/results for one Vanta test with an optional entity-status filter.

Input Output Examples

Name	Type	Req	Description
entity_status	string	—	Filter by documented entity status: FAILING or DEACTIVATED
page_cursor	string	—	Cursor from a previous response for the next page
page_size	integer	—	Number of test entities to return, up to 100
test_id	string	yes	Vanta test ID whose entities/results should be listed

No output schema declared.

No examples provided.

vanta_reactivate_vulnerability_monitoring Reactivate Vanta Vulnerability Monitoring ~40

Reactivate vulnerabilities and resume Vanta monitoring.

Input Output Examples

Name	Type	Req	Description
vulnerability_id	string	yes	Vanta vulnerability ID to reactivate monitoring for

No output schema declared.

No examples provided.

vanta_update_vendor Update Vanta Vendor ~138

Update an existing vendor in Vanta.

Input Output Examples

Name	Type	Req	Description
description	string	—	Updated description
risk_level	string	—	Vendor risk level (LOW, MEDIUM, HIGH, CRITICAL, or UNSCORED)
vendor_category	string	—	Updated vendor category displayName (free-form string, e.g. cloudMonitoring)
vendor_contact_email	string	—	Updated contact email
vendor_contact_name	string	—	Updated contact name
vendor_id	string	yes	Vanta vendor ID to update
vendor_name	string	—	Updated vendor name
vendor_website	string	—	Updated vendor website URL

No output schema declared.

No examples provided.

vanta_upload_document Upload Vanta Evidence Document ~264

Attach an evidence file to an existing Vanta document. HOW IT WORKS: - document_id must be an existing Vanta document (from the Vanta Documents page); this tool does not create documents. - Pass a public https:// URL. The connector downloads the file and forwards the bytes to Vanta as a multipart upload. - Vanta files the upload as a DRAFT: the document must be submitted for review in Vanta before auditors can see it. The response says so via submission_required. RETURNS: - JSON with ok, upload, file_name, content_type, size_bytes, and submission_required.

Input Output Examples

Name	Type	Req	Description
description	string	—	Description stored alongside the uploaded file
document_id	string	yes	ID of the existing Vanta document to attach the file to, as returned by the Vanta Documents page (e.g. access-requests)
document_url	string	yes	Public https:// URL of the file to upload; the connector downloads it and forwards the bytes to Vanta
effective_at_date	string	—	Date the evidence became effective, e.g. 2026-07-01
file_name	string	—	File name to store in Vanta; defaults to the name from the URL or Content-Disposition header

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug