# Vanta (npm · @mindstone/mcp-server-vanta)

Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs

- Trust score: 73/100 (medium)
- Change this week: +27
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@mindstone/mcp-server-vanta`: 73/100 (this document), [markdown](https://verifymcp.io/servers/mindstone-mcp-server-vanta/mindstone-mcp-server-vanta.md), [page](https://verifymcp.io/servers/mindstone-mcp-server-vanta/mindstone-mcp-server-vanta)

## Channel facts

- Registry: `npm`
- Package: `@mindstone/mcp-server-vanta`
- Version: `0.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 84/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to mindstone/mcp-servers).
  - License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license.
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1822 tokens (~107/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability check failed: the tool surface changed between 0.1.0 and 0.2.0: 3 tool removals, 3 breaking changes, 2 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add mindstone-mcp-server-vanta -- npx -y @mindstone/mcp-server-vanta
```

### Codex

```bash
codex mcp add mindstone-mcp-server-vanta -- npx -y @mindstone/mcp-server-vanta
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mindstone-mcp-server-vanta": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mindstone/mcp-server-vanta"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mindstone-mcp-server-vanta --command npx --arg -y --arg @mindstone/mcp-server-vanta
```

### Hermes

```yaml
mcp_servers:
  mindstone-mcp-server-vanta:
    command: "npx"
    args: ["-y", "@mindstone/mcp-server-vanta"]
```

### Other

```json
{
  "mcpServers": {
    "mindstone-mcp-server-vanta": {
      "command": "npx",
      "args": [
        "-y",
        "@mindstone/mcp-server-vanta"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 73, +37)

- [security regression] Stability: unverified → fail
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] The attested source repository moved: mindstone/mcp-servers
- [functional regression] License: unverified → fail
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: FSL-1.1-MIT

### 2026-08-01 (score 36, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 21, +15)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −40)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.0 → 0.2.0

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (17)

### `vanta_list_vulnerabilities` (~180 tokens)

List Vanta Vulnerabilities

List vulnerabilities from Vanta with optional severity, integration, and deactivation filters.

WORKFLOW:
\- Start here to review open vulnerability posture.
\- Use page_size and page_cursor for pagination.

RELATED TOOLS:
\- vanta_get_vulnerability for full details on one vulnerability.

RETURNS:
\- JSON with ok, vulnerabilities, count, and pageInfo.

Input parameters:

- `integration_id` (string): Filter by the Vanta integration ID that detected the vulnerability
- `is_deactivated` (boolean): Filter by whether Vanta monitoring is deactivated for the vulnerability
- `page_cursor` (string): Cursor from a previous response for the next page
- `page_size` (integer): Number of vulnerabilities to return, up to 100
- `severity` (string): Filter by documented severity: CRITICAL, HIGH, MEDIUM, or LOW

### `vanta_get_vulnerability` (~41 tokens)

Get Vanta Vulnerability

Get details for one Vanta vulnerability by ID.

Input parameters:

- `vulnerability_id` (string, required): Vanta vulnerability ID returned by vanta_list_vulnerabilities

### `vanta_list_tests` (~118 tokens)

List Vanta Tests

List compliance tests from Vanta with optional status and framework filters.

Input parameters:

- `framework` (string): Filter by framework, such as SOC2, ISO27001, or HIPAA
- `page_cursor` (string): Cursor from a previous response for the next page
- `page_size` (integer): Number of tests to return, up to 100
- `status` (string): Filter by documented test status, such as OK, NEEDS_ATTENTION, DEACTIVATED, IN_PROGRESS, INVALID, or NOT_APPLICABLE

### `vanta_get_test` (~39 tokens)

Get Vanta Test

Get details for one Vanta compliance test by ID.

Input parameters:

- `test_id` (string, required): Vanta test ID returned by vanta_list_tests

### `vanta_list_controls` (~78 tokens)

List Vanta Controls

List Vanta controls with an optional framework filter.

Input parameters:

- `framework` (string): Filter by framework, such as SOC2, ISO27001, or HIPAA
- `page_cursor` (string): Cursor from a previous response for the next page
- `page_size` (integer): Number of controls to return, up to 100

### `vanta_get_control` (~38 tokens)

Get Vanta Control

Get details for one Vanta control by ID.

Input parameters:

- `control_id` (string, required): Vanta control ID returned by vanta_list_controls

### `vanta_list_people` (~94 tokens)

List Vanta People

List people tracked in Vanta with optional name/email and employment-status filters.

Input parameters:

- `email_or_name` (string): Filter people by email address, first name, or last name
- `employment_status` (string): Filter by documented employment status
- `page_cursor` (string): Cursor from a previous response for the next page
- `page_size` (integer): Number of people to return, up to 100

### `vanta_query_test_results` (~102 tokens)

Query Vanta Test Results

List test entities/results for one Vanta test with an optional entity-status filter.

Input parameters:

- `entity_status` (string): Filter by documented entity status: FAILING or DEACTIVATED
- `page_cursor` (string): Cursor from a previous response for the next page
- `page_size` (integer): Number of test entities to return, up to 100
- `test_id` (string, required): Vanta test ID whose entities/results should be listed

### `vanta_get_compliance_summary` (~48 tokens)

Get Vanta Compliance Summary

Get an aggregate compliance summary from Vanta framework counters.

Input parameters:

- `framework` (string): Filter summary to one framework, such as SOC2, ISO27001, or HIPAA

### `vanta_list_vendors` (~99 tokens)

List Vanta Vendors

List vendors tracked in Vanta with optional name and status filters.

Input parameters:

- `name` (string): Filter vendors by name (case-insensitive partial match)
- `page_cursor` (string): Cursor from a previous response for the next page
- `page_size` (integer): Number of vendors to return, up to 100
- `status` (string): Filter by documented vendor status: MANAGED, ARCHIVED, or IN_PROCUREMENT

### `vanta_get_vendor` (~39 tokens)

Get Vanta Vendor

Get details for one Vanta vendor by ID.

Input parameters:

- `vendor_id` (string, required): Vanta vendor ID returned by vanta_list_vendors

### `vanta_create_vendor` (~134 tokens)

Create Vanta Vendor

Create a new vendor in Vanta.

Input parameters:

- `description` (string): Description of the vendor relationship
- `risk_level` (string): Vendor risk level (LOW, MEDIUM, HIGH, CRITICAL, or UNSCORED)
- `vendor_category` (string): Vendor category displayName (free-form string, e.g. cloudMonitoring)
- `vendor_contact_email` (string): Primary contact email at the vendor
- `vendor_contact_name` (string): Primary contact name at the vendor
- `vendor_name` (string, required): Name of the vendor
- `vendor_website` (string): Website URL of the vendor

### `vanta_update_vendor` (~138 tokens)

Update Vanta Vendor

Update an existing vendor in Vanta.

Input parameters:

- `description` (string): Updated description
- `risk_level` (string): Vendor risk level (LOW, MEDIUM, HIGH, CRITICAL, or UNSCORED)
- `vendor_category` (string): Updated vendor category displayName (free-form string, e.g. cloudMonitoring)
- `vendor_contact_email` (string): Updated contact email
- `vendor_contact_name` (string): Updated contact name
- `vendor_id` (string, required): Vanta vendor ID to update
- `vendor_name` (string): Updated vendor name
- `vendor_website` (string): Updated vendor website URL

### `vanta_attach_vendor_document` (~279 tokens)

Attach Document to Vanta Vendor

Attach a compliance document (SOC 2 report, DPA, pen test, questionnaire) to an existing vendor in Vanta.

HOW IT WORKS:
\- Pass a public https:// URL. The connector downloads the file and forwards the bytes to Vanta as a multipart upload.
\- document_type is required; Vanta rejects the upload without it.
\- Vanta accepts .pdf, .docx, .jpg, .png, and .xlsx files.

RELATED TOOLS:
\- vanta_list_vendors to find the vendor_id.

RETURNS:
\- JSON with ok, document, file_name, content_type, and size_bytes.

Input parameters:

- `description` (string): Description of the document
- `document_name` (string): The document's title in Vanta
- `document_type` (string, required): Vanta vendor document type, required. Documented values include SOC2_REPORT, ISO_27001_REPORT, PEN_TEST, DPA, PRIVACY_POLICY, OTHER
- `document_url` (string, required): Public https:// URL of the file to attach; the connector downloads it and forwards the bytes to Vanta
- `file_name` (string): File name to store in Vanta; defaults to the name from the URL or Content-Disposition header
- `vendor_id` (string, required): Vanta vendor ID to attach the document to

### `vanta_deactivate_vulnerability_monitoring` (~91 tokens)

Deactivate Vanta Vulnerability Monitoring

Deactivate monitoring for select vulnerabilities. Vanta will not monitor a deactivated vulnerability until it is reactivated.

Input parameters:

- `deactivate_reason` (string, required): Reason for deactivating the vulnerability
- `should_reactivate_when_fixable` (boolean, required): Whether or not vulnerability should reactivate when it becomes fixable
- `vulnerability_id` (string, required): Vanta vulnerability ID to deactivate monitoring for

### `vanta_reactivate_vulnerability_monitoring` (~40 tokens)

Reactivate Vanta Vulnerability Monitoring

Reactivate vulnerabilities and resume Vanta monitoring.

Input parameters:

- `vulnerability_id` (string, required): Vanta vulnerability ID to reactivate monitoring for

### `vanta_upload_document` (~264 tokens)

Upload Vanta Evidence Document

Attach an evidence file to an existing Vanta document.

HOW IT WORKS:
\- document_id must be an existing Vanta document (from the Vanta Documents page); this tool does not create documents.
\- Pass a public https:// URL. The connector downloads the file and forwards the bytes to Vanta as a multipart upload.
\- Vanta files the upload as a DRAFT: the document must be submitted for review in Vanta before auditors can see it. The response says so via submission_required.

RETURNS:
\- JSON with ok, upload, file_name, content_type, size_bytes, and submission_required.

Input parameters:

- `description` (string): Description stored alongside the uploaded file
- `document_id` (string, required): ID of the existing Vanta document to attach the file to, as returned by the Vanta Documents page (e.g. access-requests)
- `document_url` (string, required): Public https:// URL of the file to upload; the connector downloads it and forwards the bytes to Vanta
- `effective_at_date` (string): Date the evidence became effective, e.g. 2026-07-01
- `file_name` (string): File name to store in Vanta; defaults to the name from the URL or Content-Disposition header

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mindstone-mcp-server-vanta/mindstone-mcp-server-vanta#diagnostics

## Score history

- 2026-08-03: 73
- 2026-08-02: 73
- 2026-08-01: 36
- 2026-07-31: 21
- 2026-07-30: 6
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@mindstone/mcp-server-vanta
- Socket report: https://socket.dev/npm/package/@mindstone/mcp-server-vanta
- Repository: https://github.com/mindstone/mcp-servers
- Changelog RSS feed: https://verifymcp.io/servers/mindstone-mcp-server-vanta/mindstone-mcp-server-vanta/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mindstone-mcp-server-vanta/mindstone-mcp-server-vanta/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mindstone-mcp-server-vanta/mindstone-mcp-server-vanta