# Vanta MCP for AI Agents AI Agent Connect > Vanta MCP lets you manage security and compliance tasks directly through your AI agent. It allows you to audit users, check endpoint health, track vulnerabilities, and monitor risk registers without switching tabs. It's for teams who need to keep their SOC 2 or HIPAA status current without the manual headache of clicking through a complex dashboard. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_gWovqSbpnvnA91XvRiypPCbxCsK8CA6zP04743N4/ai-agent-connect - **Tags:** compliance-automation, security-auditing, vulnerability-management, soc2, risk-assessment, endpoint-security ## Description Managing security posture usually means jumping between five different dashboards to see if your laptops are encrypted, if your team finished their security training, or if a new vulnerability just hit your cloud. This Connector changes that by bringing your Vanta data directly into your conversation. You can ask your agent to find everyone who hasn't finished their mandatory training or check if your latest hardware batch actually has antivirus running. It handles the heavy lifting of evidence gathering, so you can focus on actual security instead of data entry. If you're looking for a way to keep your compliance audit-ready without the manual grind, Vinkius makes it easy to connect this to your existing workflow. You can pull risk scores, check out pending trust center requests from customers, and verify that your third-party vendors are actually vetted. It turns your AI into a real-time compliance officer that knows your infrastructure inside and out. ## Tools ### vanta_compliance_status Get your overall pass rate and audit-readiness score across all frameworks. ### vanta_get_test See specific evidence and remediation guidance for a failing compliance test. ### vanta_list_computers List your monitored laptops and desktops with their encryption and antivirus status. ### vanta_list_evidence_requests See which documents and screenshots your team still needs to submit for an audit. ### vanta_list_integrations Check the connection status and sync coverage for your cloud and identity providers. ### vanta_list_policies View your security policies along with their approval status and employee acknowledgment rates. ### vanta_list_risks Pull your risk register including impact levels and mitigation treatment plans. ### vanta_list_tests List all compliance monitoring tests for SOC 2, ISO 27001, HIPAA, and GDPR. ### vanta_list_people See security training status and device compliance for every employee. ### vanta_list_vulnerabilities See detected security vulnerabilities with severity levels and SLA deadlines. ## Prompt Examples **Prompt:** ``` Who in the engineering team hasn't finished their security training yet? ``` **Response:** ``` I've checked the personnel records. Here are the engineers who are currently overdue: | Name | Email | Status | | :--- | :--- | :--- | | Jordan Smith | j.smith@company.com | Overdue (14 days) | | Alex Chen | a.chen@company.com | Overdue (3 days) | Would you like me to send them a reminder? ``` **Prompt:** ``` Give me a summary of our current compliance health across all frameworks. ``` **Response:** ``` Here is your current compliance posture: - **Overall Pass Rate**: 94% - **Audit Readiness**: High - **Framework Status**: - SOC 2: Pass - HIPAA: Pass - GDPR: Warning (3 failing tests) - **Critical Alerts**: 2 (Related to disk encryption on 3 devices). ``` **Prompt:** ``` What are our highest priority security risks right now? ``` **Response:** ``` Based on your risk register, these are the top 3 risks: 1. **Unencrypted Backup Storage** (Impact: 5, Likelihood: 4, Score: 20) 2. **Outdated VPN Gateway** (Impact: 4, Likelihood: 3, Score: 12) 3. **Third-Party Access Over-provisioning** (Impact: 3, Likelihood: 3, Score: 9) All three have assigned owners and active mitigation plans. ``` ## Capabilities ### Check compliance health Get a snapshot of your pass rates and audit-readiness scores across all frameworks. ### Identify non-compliant devices See exactly which laptops are missing encryption or antivirus in your fleet. ### Track security vulnerabilities Pull a list of active CVEs and their remediation deadlines across your infrastructure. ### Manage personnel security See who has finished their training and who is still overdue for completion. ### Audit evidence requests See what documents and screenshots your team still needs to provide for an audit. ### Monitor risk registers View your organization's identified risks and their current mitigation status. ## Use Cases ### Audit proof for MFA An auditor asks for proof of MFA. Ask your agent to run vanta_list_tests to find the MFA control and check the pass status for your organization. ### Verifying new hardware A new laptop is shipped. Check vanta_list_computers to see if the new device is reporting correctly and has antivirus enabled. ### Checking audit readiness A customer wants a SOC 2 report. Use vanta_list_evidence_requests to see if you have the necessary documents ready to share with the prospect. ### Risk mitigation review A security risk is identified. Use vanta_list_risks to see if there's an existing treatment plan or if you need to assign a new owner. ## Benefits - Stop hunting through dashboards to find out if your laptops are encrypted. Use vanta_list_computers to see your entire fleet's status in one list. - Cut down the time spent on audit prep. Use vanta_list_evidence_requests to see exactly what your team is missing. - Get instant answers on your security health. Use vanta_compliance_status to see your audit-readiness score across every framework. - Prioritize your security work better. Use vanta_list_vulnerabilities to see which CVEs need immediate attention based on your SLAs. - Keep your risk register updated. Use vanta_list_risks to see your high-impact security risks and who owns the mitigation. - Verify team readiness. Use vanta_list_people to check who has completed their mandatory security awareness training. ## How It Works The bottom line is you get a real-time window into your security posture without leaving your chat interface. 1. Subscribe to the Vanta MCP on Vinkius. 2. Provide your Vanta Developer API Token in the connection settings. 3. Ask your agent to pull compliance reports or list your hardware fleet. ## Frequently Asked Questions **How does the Vanta MCP help with my SOC 2 audit?** It makes audit prep much faster by letting your agent pull evidence requests and compliance status directly. You can see exactly what's missing and who needs to provide it without manual searching. **Can I use the Vanta MCP to see if my company laptops are encrypted?** Yes, you can list all monitored computers and see their encryption status instantly. This helps you identify non-compliant hardware before an auditor looks at it. **How does the Vanta MCP track security vulnerabilities?** It pulls your detected CVEs, including severity levels and remediation deadlines. You can ask your agent to prioritize the most critical ones for your team. **Can the Vanta MCP help me manage employee security training?** It can list all personnel and show their training completion status. This makes it easy to identify who is overdue and keep your team compliant. **Is the Vanta MCP good for tracking third-party vendor risks?** Yes, it allows you to pull your risk register, which includes your third-party vendors and their mitigation status. It gives you a clear view of your subprocessor security. **Can I use the Vanta MCP to check my policy acknowledgment rates?** It can list your security policies and show the percentage of employees who have acknowledged them. This helps you identify gaps in your internal security communications. **How can I easily check if an employee completed their security training?** Provide the specific email or ID and ask the agent: `get the Vanta compliance details for John Doe`. The `getUserTool` will retrieve all local profile assertions, confirming immediately whether John completed the security training modules and signed the internal policies. **Can I automatically view which vulnerabilities span past our SLA threshold?** Yes. Ask the agent to `list our security vulnerabilities and highlight any that are missing their SLA timelines`. It will fetch the complete collection from Vanta, compute the statuses, and list out the critical unresolved issues requiring immediate developer engineering attention natively. **What happens when an employee terminates contract? Can I use the agent?** Absolutely. You can implement instantaneous offboarding by prompting the AI: `deactivate Vanta compliance monitoring for user ID 123456`. The agent utilizes the `updateUserTool` switching their active flags internally to false. Offboarding checklists just got significantly faster.