Skip to main content
The Vanta MCP server lets AI assistants like Claude, Cursor, and Perplexity call the Vanta API on your behalf. They can securely query controls, remediate failing tests, and act on your compliance data through the Model Context Protocol. This guide explains how to connect Vanta MCP to your AI tool of choice.
Vanta’s remote MCP server is currently in beta and released to all customers.

Find your MCP URL

Vanta hosts a separate MCP server in each region. Find the region for your Vanta instance and use that URL.
The setup steps below use the US URL (https://mcp.vanta.com/mcp) as an example. If your instance is in the EU or AUS, substitute the matching URL from the table above.

Prerequisites

Before connecting, confirm the following:
  • Vanta role. Any active Vanta user can connect, including non-Admin roles such as Editor, Collaborator, and View-only Admin. The MCP server acts with your Vanta permissions, so you can only read and change what your role allows in the Vanta app. Admins get the full set of MCP tools. Non-Admin users get the same tools minus a small set that Vanta currently restricts to Admins.
  • Supported AI tool. You need access to at least one of: Claude Code, Cursor, Perplexity, Codex, or an AI tool that supports remote MCPs.

Access and permissions

The MCP server authenticates through OAuth as the Vanta user who signs in. AI agents that call Vanta MCP tools act on that user’s behalf. They can only read or change data that user already has access to in Vanta, and they cannot bypass your existing role-based access controls. Most MCP clients also let you disable individual tools after the server is connected. Use your client’s MCP settings to hide tools you don’t want an assistant to call in a given workspace.

Claude Code

You can connect Claude Code to Vanta MCP by adding the server manually or by installing the official Vanta plugin.

Manual MCP setup

1

Add the MCP server

Run the following command in your terminal:
2

Authenticate

In Claude Code, run /mcp and select vanta. A webpage will open in your Vanta app to authorize MCP — click Allow.
3

Start using Vanta MCP

Once authorized, you’re ready to start using the Vanta MCP server.
Manual setup gives you access to all Vanta MCP tools but does not include the plugin’s built-in skills (/vanta:fix-test, /vanta:list-tests).

Claude Code plugin

The Vanta plugin bundles Vanta’s MCP server, purpose-built remediation skills, and slash commands into a single easy-to-install package for Claude Code. Use it to discover and prioritize failing tests, generate infrastructure-as-code fixes directly in your repository, and open pull requests without leaving your editor.
1

Install the plugin

In the Claude Code CLI (not claude.ai in a browser), run the three commands below in order. The marketplace must be registered before the plugin can install.
Type the commands rather than pasting them. Claude Code treats a leading / in pasted text as a file-path trigger and can open a file picker instead of running the slash command.
2

Authenticate

Run /mcp, select Vanta, choose your region, and complete the OAuth flow in your browser.
You skipped the first command. Run /plugin marketplace update anthropics/claude-plugins-official first to register the marketplace, then re-run the install command.
Confirm you’re running the commands inside the Claude Code CLI (the terminal application), not a web chat window. Slash commands like /plugin and /mcp only work inside Claude Code. If you added the server manually with claude mcp add, finish the OAuth step by running /mcp and selecting vanta. The entry appears there once the client has loaded the configuration.
Once connected, you’ll have access to:
  • A remediation skill that combines MCP data with your local repo context to generate targeted IaC fixes.
  • Slash commands that streamline common workflows into single actions:
    • /vanta:fix-test: generate code changes to fix a failing compliance test and open a PR.
    • /vanta:list-tests: show prioritized failing tests relevant to your codebase.

Troubleshooting the plugin install

Claude Code installs the plugin entirely through its plugin marketplace. You never need to git clone it directly. If /plugin install vanta-mcp-plugin@claude-plugins-official fails with remote: Repository not found or fatal: repository ... not found, check the following in order:
  • Update Claude Code. The plugin marketplace requires a recent version of Claude Code. Upgrade to the latest release and try again.
  • Refresh the marketplace first. Always run /plugin marketplace update anthropics/claude-plugins-official before /plugin install. Installing without a fresh marketplace listing is the most common cause of “not found” errors.
  • Check network access to GitHub. Claude Code fetches the plugin from github.com/anthropics/claude-plugins-official and github.com/VantaInc/vanta-mcp-plugin. If you’re on a VPN or behind a corporate proxy that blocks GitHub, the install will fail. Confirm you can reach both URLs from the same machine.
  • Fall back to manual setup. If the plugin install continues to fail, use Manual MCP setup instead. You lose the bundled slash commands but keep access to every Vanta MCP tool.

Add to Cursor

1

Open Cursor settings

Open Settings in Cursor.
2

Add a custom MCP server

Select Tools & MCP → Add custom MCP.
3

Add the Vanta configuration

Paste the following configuration:
Cursor connects directly to the Vanta MCP server and has access to all Vanta tools. The Claude Code plugin skills (/vanta:fix-test, /vanta:list-tests) are Claude Code-specific and are not available in Cursor.

Add to Claude Cowork

1

Install the Vanta plugin

In Claude Cowork, add the Vanta plugin from the plugin directory.
2

Add the Vanta MCP connector

Under Manage Plugins → Connectors, install the Vanta MCP server as a custom connector using the URL for your region.
3

Authorize Vanta

Complete the OAuth flow when prompted.
Adding custom connectors in Claude Cowork requires the appropriate permission. If you don’t have it, ask your Claude Cowork administrator. For the full walkthrough with screenshots, see Connecting to Vanta MCP — Claude Cowork in the Vanta Help Center.

Add to Perplexity

1

Set up a remote custom connector

In Perplexity, set up a new remote custom connector.
2

Configure the URL

For the URL, enter https://mcp.vanta.com/mcp (or your regional endpoint).
3

Configure authentication

For Authentication, select OAuth and complete the authorization flow.

Other MCP-compatible clients

Vanta MCP is a standard remote MCP server. Any tool that can connect to a remote MCP endpoint with OAuth can connect to Vanta. That includes VS Code (via an MCP-capable extension), Codex, and other emerging MCP clients. The setup steps above (Claude Code, Cursor, Perplexity) are the officially tested paths. Other clients aren’t formally validated, but typically work with the same two pieces of configuration:
  • Server URL. Use https://mcp.vanta.com/mcp for US tenants, or https://mcp.eu.vanta.com/mcp for EU tenants. See Find your MCP URL.
  • Authentication. OAuth. Sign in with your Vanta account when the browser flow opens.
Consult your client’s documentation for where to register a remote MCP server. If your client can’t reach the hosted server, you can also run the open-source @vantasdk/vanta-mcp-server locally and point your client at the local process instead.

What your AI agents can do with Vanta MCP

Once connected, your AI assistant can:
  • Remediate failing tests. List failing compliance tests, inspect which entities are out of scope, and get the context needed to fix them.
  • Manage controls. Browse controls and their framework mappings, list associated tests, and access linked evidence documents.
  • Assess vendor risk. Review vendors, run security assessments, manage risk attributes, and track compliance documentation.
  • Track vulnerabilities. Surface vulnerable assets and monitor remediation progress.
  • Govern policies. List, download, and upload policy documents across your compliance program.
  • Analyze compliance gaps. Enumerate framework requirements and identify coverage gaps across SOC 2, ISO 27001, and more.

Not supported today

A few Vanta workflows aren’t available through MCP and must be done in the Vanta Dashboard:
  • Authoring Custom Tests — Custom Tests can only be created in the Dashboard under Tests → + Create custom test. The MCP server (and the Manage Vanta API) can query existing Custom Tests and their results, but cannot create or edit them. See Tests and Custom Tests for the full authoring flow.
  • Read-only agent access — there’s no read-only mode and no way to hand an agent a chosen subset of tools. A connection carries the Vanta permissions of the user who authorized it, so scope it by choosing which account connects.

Troubleshooting

Some desktop AI applications restrict which URLs the agent can reach. If the application blocks the temporary Vanta storage URL that file uploads use, the agent returns an error that includes the URL.Add that URL to your AI application’s network allowlist. If you don’t have permission, ask your account owner or administrator to add it.

Resources

Vanta MCP plugin

Official Vanta plugin for Claude Code. Bundles the hosted MCP server with remediation skills and slash commands.

Vanta MCP server

Open-source, self-hosted MCP server (@vantasdk/vanta-mcp-server) that runs Vanta MCP locally with your own OAuth credentials.

Model Context Protocol

Learn more about the open protocol that powers Vanta MCP and other AI tool integrations.