@vantasdk/vanta-mcp-server

Injects Vanta security compliance data and audit findings into Claude/LLM context through the Model Context Protocol, enabling AI agents to access real-time compliance posture, control status, and remediation requirements without direct API calls. Uses MCP's resource and tool abstractions to expose Vanta's compliance framework as structured context that LLMs can reason over and reference in code review, architecture decisions, and security policy enforcement.

Exposes Vanta's REST API endpoints as MCP tools with schema-based function calling, allowing LLM agents to query compliance frameworks, retrieve audit findings, check control status, and access remediation recommendations through standardized MCP tool invocation. Implements request/response marshaling between MCP protocol and Vanta API, handling authentication, error translation, and response formatting to present compliance data as structured tool outputs.

Retrieves and structures Vanta compliance framework definitions (SOC 2, ISO 27001, HIPAA, etc.) as queryable context resources through MCP, allowing LLM agents to understand applicable compliance requirements, control mappings, and audit scope without manual documentation lookup. Caches framework metadata to reduce API calls and presents hierarchical control structures that LLMs can traverse to understand compliance dependencies.

Exposes Vanta audit findings, failed controls, and remediation recommendations as queryable MCP resources, allowing LLM agents to retrieve specific compliance gaps, understand remediation steps, and prioritize fixes based on severity and impact. Implements filtering and sorting logic to surface the most critical findings and maps remediation guidance to code changes or infrastructure updates that LLMs can reason over.

Implements the full MCP server lifecycle (initialization, resource discovery, tool registration, request handling, error recovery) as a Node.js process that can be spawned by MCP clients like Claude Desktop or custom MCP hosts. Handles MCP protocol handshake, capability negotiation, and graceful shutdown, allowing the server to integrate seamlessly into any MCP-compatible environment without custom client code.

Manages Vanta API authentication through environment variables or configuration files, handling credential loading, token refresh (if applicable), and secure credential passing to API requests. Implements error handling for authentication failures and provides clear error messages when credentials are missing or invalid, preventing silent failures in production environments.

Translates Vanta API errors and MCP protocol errors into user-friendly messages that help developers understand what went wrong and how to fix it. Maps HTTP status codes, API error responses, and protocol violations to actionable error messages that reference specific configuration issues, missing data, or API limits, reducing debugging time for integration issues.

Implements MCP resource discovery and tool capability advertisement, allowing MCP clients to discover what compliance data and operations are available through the server. Exposes resource types (frameworks, findings, controls), tool schemas (query operations, filters), and supported parameters, enabling clients to build dynamic UIs or auto-complete for compliance queries without hardcoding server capabilities.