June 9, 2025

Built for the agentic era: Meet the Vanta MCP Server

Written by

Arsh Vishen

Reviewed by

Accelerating security solutions for small businesses
‍

Tagore offers strategic services to small businesses.

A partnership that can scale
‍

Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate.

Standing out from competitors
‍

Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

The way developers interact with tools is changing fast. Language models like Claude and ChatGPT, and IDEs like Cursor and Windsurf are much more than assistants and environments—they’re powerful interfaces for interacting with enterprise data.

‍

At Vanta, we envision a world where compliance workflows can shift left to meet GRC teams and developers where they already are. By launching the Vanta MCP Server, we’re making that vision real.

‍

We’re excited to announce that the Vanta MCP Server in now available via public preview—the first step towards bringing trust management into the emerging Model Context Protocol (MCP) ecosystem. In this blog, we’ll share why we built it, what it enables, and how it powers agentic compliance workflows.

‍

Bringing MCP and Trust Management together

MCP (Model Context Protocol) offers a standardized approach to connecting LLMs with critical enterprise data by defining an open protocol for LLMs to interact with data sources. At a high-level, MCP follows a client-server architecture that allows MCP hosts to connect to local and remote data sources. MCP hosts, like Claude or Cursor, can leverage an MCP client to connect to an MCP server, like the Vanta MCP Server.

‍

image from: https://modelcontextprotocol.io/introduction

‍

What does this mean for trust management? GRC teams want to quickly understand their framework status and resolve failing tests. Developers want to move fast, stay in flow, and fix compliance issues without leaving their tools. By adopting MCP, Vanta is making this possible.

‍

Our iterative approach: Identify and remediate your failing tests

We built a lightweight local MCP server that connects Claude and Cursor to a set of essential Vanta APIs designed specifically for framework exploration and test remediation. Here's what that might look like in practice:

‍

A GRC admin working on a SOC 2 renewal opens Claude Desktop and asks: “What’s the current completion status of my SOC 2?”
Claude fetches framework progress via the MCP server.
Next, they drill into failed controls, create a Jira ticket, and assign it to a developer—all without touching Jira.
The developer sees the ticket in Cursor, understands the issue, and applies a fix in their IDE.

‍

The entire compliance loop that GRC teams and developers have to tackle—understanding, assigning, remediating, verifying—is handled across Claude, Cursor, and Vanta, all connected by MCP.

‍

Vanta: Your AI-powered Trust Management Platform

The Vanta MCP Server is the bridge between your AI tools and your compliance stack, helping your GRC and developer teams move fast without compromising trust. The Vanta MCP Server is available to all Vanta customers on the core package or above. To get started, check out the repo here. And if you’re not a Vanta customer and want to learn more, request a demo.

‍

We also encourage you to learn more about Vanta AI and our new Vanta AI Agent—built to supercharge GRC teams.

‍

Access Review Stage	Content / Functionality
Across all stages	Easily create and save a new access review at a point in time View detailed audit evidence of historical access reviews
Setup access review procedures	Define a global access review procedure that stakeholders can follow, ensuring consistency and mitigation of human error in reviews Set your access review frequency (monthly, quarterly, etc.) and working period/deadlines
Consolidate account access data from systems	Integrate systems using dozens of pre-built integrations, or “connectors”. System account and HRIS data is pulled into Vanta. Upcoming integrations include Zoom and Intercom (account access), and Personio (HRIS) Upload access files from non-integrated systems View and select systems in-scope for the review
Review, approve, and deny user access	Select the appropriate systems reviewer and due date Get automatic notifications and reminders to systems reviewer of deadlines Automatic flagging of “risky” employee accounts that have been terminated or switched departments Intuitive interface to see all accounts with access, account accept/deny buttons, and notes section Track progress of individual systems access reviews and see accounts that need to be removed or have access modified Bulk sort, filter, and alter accounts based on account roles and employee title
Assign remediation tasks to system owners	Built-in remediation workflow for reviewers to request access changes and for admin to view and manage requests Optional task tracker integration to create tickets for any access changes and provide visibility to the status of tickets and remediation
Verify changes to access	Focused view of accounts flagged for access changes for easy tracking and management Automated evidence of remediation completion displayed for integrated systems Manual evidence of remediation can be uploaded for non-integrated systems
Report and re-evaluate results	Auditor can log into Vanta to see history of all completed access reviews Internals can see status of reviews in progress and also historical review detail