Vanta
NPM · @MINDSTONE/MCP-SERVER-VANTA · SCANNED SEP 21
Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency87
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to mindstone/mcp-servers). View diagnostics → Pass
- License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 42 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability82
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2410 tokens (~96/item across 25 items; 25 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 25 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Vanta MCP server?
Vanta runs locally as an npm package, launched with npx -y @mindstone/mcp-server-vanta. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mindstone/mcp-server-vanta
claude mcp add mindstone-mcp-server-vanta -- npx -y @mindstone/mcp-server-vanta
{
"mcpServers": {
"mindstone-mcp-server-vanta": {
"command": "npx",
"args": [
"-y",
"@mindstone/mcp-server-vanta"
]
}
}
} {
"servers": {
"mindstone-mcp-server-vanta": {
"command": "npx",
"args": [
"-y",
"@mindstone/mcp-server-vanta"
]
}
}
} codex mcp add mindstone-mcp-server-vanta -- npx -y @mindstone/mcp-server-vanta
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mindstone-mcp-server-vanta": {
"type": "local",
"command": [
"npx",
"-y",
"@mindstone/mcp-server-vanta"
],
"enabled": true
}
}
} openclaw mcp add mindstone-mcp-server-vanta --command npx --arg -y --arg @mindstone/mcp-server-vanta
mcp_servers:
mindstone-mcp-server-vanta:
command: "npx"
args: ["-y", "@mindstone/mcp-server-vanta"] {
"McpServers": {
"mindstone-mcp-server-vanta": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@mindstone/mcp-server-vanta"
]
}
}
} assistant mcp add mindstone-mcp-server-vanta -t stdio -c npx -a -y @mindstone/mcp-server-vanta
{
"mcpServers": {
"mindstone-mcp-server-vanta": {
"command": "npx",
"args": [
"-y",
"@mindstone/mcp-server-vanta"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.83 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 0
- Package version: 0.3.0 → 0.3.1 functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/@mindstone/mcp-server-vanta@0.3.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | mindstone/mcp-servers |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/mindstone/mcp-servers/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2400701829 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:83018ab4b8137408b3fcede126e2f5d1b3d474fa3f69a9a38444766eebbb5fa5e695b84ca04fa1a91f68ffab641579ba8a3cf9511db610c46d4d24c8a |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
vanta_attach_vendor_document Attach Document to Vanta Vendor ~279
Attach a compliance document (SOC 2 report, DPA, pen test, questionnaire) to an existing vendor in Vanta. HOW IT WORKS: - Pass a public https:// URL. The connector downloads the file and forwards the bytes to Vanta as a multipart upload. - document_type is required; Vanta rejects the upload without it. - Vanta accepts .pdf, .docx, .jpg, .png, and .xlsx files. RELATED TOOLS: - vanta_list_vendors to find the vendor_id. RETURNS: - JSON with ok, document, file_name, content_type, and size_bytes.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Description of the document |
| document_name | string | – | The document's title in Vanta |
| document_type | string | yes | Vanta vendor document type, required. Documented values include SOC2_REPORT, ISO_27001_REPORT, PEN_TEST, DPA, PRIVACY_POLICY, OTHER |
| document_url | string | yes | Public https:// URL of the file to attach; the connector downloads it and forwards the bytes to Vanta |
| file_name | string | – | File name to store in Vanta; defaults to the name from the URL or Content-Disposition header |
| vendor_id | string | yes | Vanta vendor ID to attach the document to |
No output schema declared.
No examples provided.
vanta_create_vendor Create Vanta Vendor ~134
Create a new vendor in Vanta.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Description of the vendor relationship |
| risk_level | string | – | Vendor risk level (LOW, MEDIUM, HIGH, CRITICAL, or UNSCORED) |
| vendor_category | string | – | Vendor category displayName (free-form string, e.g. cloudMonitoring) |
| vendor_contact_email | string | – | Primary contact email at the vendor |
| vendor_contact_name | string | – | Primary contact name at the vendor |
| vendor_name | string | yes | Name of the vendor |
| vendor_website | string | – | Website URL of the vendor |
No output schema declared.
No examples provided.
vanta_deactivate_vulnerability_monitoring Deactivate Vanta Vulnerability Monitoring ~91
Deactivate monitoring for select vulnerabilities. Vanta will not monitor a deactivated vulnerability until it is reactivated.
| Name | Type | Req | Description |
|---|---|---|---|
| deactivate_reason | string | yes | Reason for deactivating the vulnerability |
| should_reactivate_when_fixable | boolean | yes | Whether or not vulnerability should reactivate when it becomes fixable |
| vulnerability_id | string | yes | Vanta vulnerability ID to deactivate monitoring for |
No output schema declared.
No examples provided.
vanta_get_compliance_summary Get Vanta Compliance Summary ~48
Get an aggregate compliance summary from Vanta framework counters.
| Name | Type | Req | Description |
|---|---|---|---|
| framework | string | – | Filter summary to one framework, such as SOC2, ISO27001, or HIPAA |
No output schema declared.
No examples provided.
vanta_get_control Get Vanta Control ~38
Get details for one Vanta control by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| control_id | string | yes | Vanta control ID returned by vanta_list_controls |
No output schema declared.
No examples provided.
vanta_get_framework Get Vanta Framework ~55
Get details for one Vanta framework by ID, including requirement categories and mapped controls.
| Name | Type | Req | Description |
|---|---|---|---|
| framework_id | string | yes | Vanta framework ID returned by vanta_list_frameworks, such as soc2 or iso27001 |
No output schema declared.
No examples provided.
vanta_get_policy Get Vanta Policy ~49
Get details for one Vanta policy by ID, including its latest version status and approved document links.
| Name | Type | Req | Description |
|---|---|---|---|
| policy_id | string | yes | Vanta policy ID returned by vanta_list_policies |
No output schema declared.
No examples provided.
vanta_get_risk_scenario Get Vanta Risk Scenario ~68
Get details for one Vanta risk scenario by risk ID, including scores, treatment, and review status.
| Name | Type | Req | Description |
|---|---|---|---|
| risk_id | string | yes | Vanta risk scenario ID (the user-facing Risk ID or the object ID) returned by vanta_list_risk_scenarios |
No output schema declared.
No examples provided.
vanta_get_test Get Vanta Test ~39
Get details for one Vanta compliance test by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| test_id | string | yes | Vanta test ID returned by vanta_list_tests |
No output schema declared.
No examples provided.
vanta_get_vendor Get Vanta Vendor ~39
Get details for one Vanta vendor by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| vendor_id | string | yes | Vanta vendor ID returned by vanta_list_vendors |
No output schema declared.
No examples provided.
vanta_get_vulnerability Get Vanta Vulnerability ~41
Get details for one Vanta vulnerability by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| vulnerability_id | string | yes | Vanta vulnerability ID returned by vanta_list_vulnerabilities |
No output schema declared.
No examples provided.
vanta_list_controls List Vanta Controls ~78
List Vanta controls with an optional framework filter.
| Name | Type | Req | Description |
|---|---|---|---|
| framework | string | – | Filter by framework, such as SOC2, ISO27001, or HIPAA |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of controls to return, up to 100 |
No output schema declared.
No examples provided.
vanta_list_event_logs List Vanta Event Logs ~111
List audit event logs from the Vanta account (actor, action, targets, date) with an optional start-date filter.
| Name | Type | Req | Description |
|---|---|---|---|
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of event logs to return, up to 100 |
| start_date | string | – | Only event logs created at or after this ISO 8601 timestamp (e.g. "2026-05-03T21:08:22Z") |
No output schema declared.
No examples provided.
vanta_list_frameworks List Vanta Frameworks ~64
List available compliance frameworks in Vanta with per-framework control, document, and test counters.
| Name | Type | Req | Description |
|---|---|---|---|
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of frameworks to return, up to 100 |
No output schema declared.
No examples provided.
vanta_list_integrations List Vanta Integrations ~65
List integrations connected to Vanta with per-connection health (disabled flag and connection error message).
| Name | Type | Req | Description |
|---|---|---|---|
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of integrations to return, up to 100 |
No output schema declared.
No examples provided.
vanta_list_people List Vanta People ~94
List people tracked in Vanta with optional name/email and employment-status filters.
| Name | Type | Req | Description |
|---|---|---|---|
| email_or_name | string | – | Filter people by email address, first name, or last name |
| employment_status | string | – | Filter by documented employment status |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of people to return, up to 100 |
No output schema declared.
No examples provided.
vanta_list_policies List Vanta Policies ~68
List policies in Vanta with their approval/review status — e.g. which policies are out of review.
| Name | Type | Req | Description |
|---|---|---|---|
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of policies to return, up to 100 |
No output schema declared.
No examples provided.
vanta_list_risk_scenarios List Vanta Risk Scenarios ~108
List risk scenarios from the Vanta risk register with optional search and include-ignored filters.
| Name | Type | Req | Description |
|---|---|---|---|
| include_ignored | boolean | – | Include risk scenarios that have been ignored (default false) |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of risk scenarios to return, up to 100 |
| search_string | string | – | Filter risk scenarios by a search string (matches the scenario description/title) |
No output schema declared.
No examples provided.
vanta_list_tests List Vanta Tests ~118
List compliance tests from Vanta with optional status and framework filters.
| Name | Type | Req | Description |
|---|---|---|---|
| framework | string | – | Filter by framework, such as SOC2, ISO27001, or HIPAA |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of tests to return, up to 100 |
| status | string | – | Filter by documented test status, such as OK, NEEDS_ATTENTION, DEACTIVATED, IN_PROGRESS, INVALID, or NOT_APPLICABLE |
No output schema declared.
No examples provided.
vanta_list_vendors List Vanta Vendors ~99
List vendors tracked in Vanta with optional name and status filters.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filter vendors by name (case-insensitive partial match) |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of vendors to return, up to 100 |
| status | string | – | Filter by documented vendor status: MANAGED, ARCHIVED, or IN_PROCUREMENT |
No output schema declared.
No examples provided.
vanta_list_vulnerabilities List Vanta Vulnerabilities ~180
List vulnerabilities from Vanta with optional severity, integration, and deactivation filters. WORKFLOW: - Start here to review open vulnerability posture. - Use page_size and page_cursor for pagination. RELATED TOOLS: - vanta_get_vulnerability for full details on one vulnerability. RETURNS: - JSON with ok, vulnerabilities, count, and pageInfo.
| Name | Type | Req | Description |
|---|---|---|---|
| integration_id | string | – | Filter by the Vanta integration ID that detected the vulnerability |
| is_deactivated | boolean | – | Filter by whether Vanta monitoring is deactivated for the vulnerability |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of vulnerabilities to return, up to 100 |
| severity | string | – | Filter by documented severity: CRITICAL, HIGH, MEDIUM, or LOW |
No output schema declared.
No examples provided.
vanta_query_test_results Query Vanta Test Results ~102
List test entities/results for one Vanta test with an optional entity-status filter.
| Name | Type | Req | Description |
|---|---|---|---|
| entity_status | string | – | Filter by documented entity status: FAILING or DEACTIVATED |
| page_cursor | string | – | Cursor from a previous response for the next page |
| page_size | integer | – | Number of test entities to return, up to 100 |
| test_id | string | yes | Vanta test ID whose entities/results should be listed |
No output schema declared.
No examples provided.
vanta_reactivate_vulnerability_monitoring Reactivate Vanta Vulnerability Monitoring ~40
Reactivate vulnerabilities and resume Vanta monitoring.
| Name | Type | Req | Description |
|---|---|---|---|
| vulnerability_id | string | yes | Vanta vulnerability ID to reactivate monitoring for |
No output schema declared.
No examples provided.
vanta_update_vendor Update Vanta Vendor ~138
Update an existing vendor in Vanta.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Updated description |
| risk_level | string | – | Vendor risk level (LOW, MEDIUM, HIGH, CRITICAL, or UNSCORED) |
| vendor_category | string | – | Updated vendor category displayName (free-form string, e.g. cloudMonitoring) |
| vendor_contact_email | string | – | Updated contact email |
| vendor_contact_name | string | – | Updated contact name |
| vendor_id | string | yes | Vanta vendor ID to update |
| vendor_name | string | – | Updated vendor name |
| vendor_website | string | – | Updated vendor website URL |
No output schema declared.
No examples provided.
vanta_upload_document Upload Vanta Evidence Document ~264
Attach an evidence file to an existing Vanta document. HOW IT WORKS: - document_id must be an existing Vanta document (from the Vanta Documents page); this tool does not create documents. - Pass a public https:// URL. The connector downloads the file and forwards the bytes to Vanta as a multipart upload. - Vanta files the upload as a DRAFT: the document must be submitted for review in Vanta before auditors can see it. The response says so via submission_required. RETURNS: - JSON with ok, upload, file_name, content_type, size_bytes, and submission_required.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Description stored alongside the uploaded file |
| document_id | string | yes | ID of the existing Vanta document to attach the file to, as returned by the Vanta Documents page (e.g. access-requests) |
| document_url | string | yes | Public https:// URL of the file to upload; the connector downloads it and forwards the bytes to Vanta |
| effective_at_date | string | – | Date the evidence became effective, e.g. 2026-07-01 |
| file_name | string | – | File name to store in Vanta; defaults to the name from the URL or Content-Disposition header |
No output schema declared.
No examples provided.
What is the Vanta MCP server?
Vanta is an MCP server listed in the public MCP registry as io.github.mindstone/mcp-server-vanta. Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs. This page covers its npm package (@mindstone/mcp-server-vanta).
Is the Vanta MCP server safe to use?
Vanta scores 93 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Vanta MCP server expose?
Vanta exposes 25 tools: vanta_list_vulnerabilities, vanta_get_vulnerability, vanta_list_tests, vanta_get_test, vanta_list_controls, and 20 more. Their descriptions and schemas cost roughly 2,410 tokens of context every time the server is loaded.
Is the Vanta MCP server still maintained?
Vanta is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Vanta MCP server under?
Vanta declares the FSL-1.1-MIT licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.