How to Use the Drata MCP in Cursor

Q: How do I add the Drata MCP Server to my Cursor editor?

Create a .cursor/mcp.json file in your project root or global directory and define the server under the mcpServers key. Once saved, enable Agent mode in the Cursor chat panel to start querying dratalistcontrols directly.

Q: How does the Drata MCP Server help developers fix failing compliance checks in Cursor?

When a check fails, your agent calls dratalisttests to find the failing resource. It then references dratalistassets to pinpoint the exact cloud asset, allowing you to patch the infrastructure code directly inside Cursor.

Q: Does Cursor support multi-framework compliance mapping?

Yes, your Cursor agent uses dratalistframeworks to pull active frameworks like ISO 27001 or HIPAA. It then maps specific requirements to your files by querying dratalistcontrols to ensure complete coverage.

Q: Where is my Drata vendor and personnel data processed when using Cursor?

All data retrieved via dratalistvendors and dratalistpersonnel is transmitted directly to your local Cursor instance. The Vinkius MCP Server runs in an isolated, ephemeral sandbox that never caches or logs your sensitive security configurations.

Pull live Drata compliance controls and cloud asset states directly into Cursor to fix security gaps as you write code.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Drata MCP to Cursor

Create your Vinkius account to connect Drata to Cursor and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Drata with Cursor

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Fix Failing Infrastructure Tests in Cursor Agent Mode

`drata_list_tests` pulls your real-time cloud security failures directly into the Cursor editor, showing you exactly which GitHub repository or AWS resource failed its check. You do not have to leave your code to check why a branch protection rule is failing. Once the agent identifies the failure, it uses `drata_list_assets` to pull the exact resource ID and VPC region. This lets you write the Terraform fix in Cursor while the AI references the actual compliance parameters returned by the API.

Map Code Changes to Drata Compliance Controls

Running `drata_list_controls` inside Cursor lets you see which technical requirements, like password complexity or MFA, are mapped to your active SOC 2 framework. The editor reads the control details to ensure your new backend code matches your official policies. When you ask the Cursor agent to review your authentication code, it calls `drata_get_control` to verify the exact auditor-facing risk language. This keeps your development aligned with Drata's requirements without manual policy lookups.

Audit Vendor Risks from your Cursor Workspace

This MCP Server exposes `drata_list_vendors` so you can inspect third-party risk classifications and questionnaire statuses directly from your coding workspace. You can check if a new API vendor has a reviewed SOC 2 report before writing the integration code. The Cursor agent reads the raw vendor data to flag unapproved subprocessors. This prevents your team from introducing high-risk third-party dependencies into your codebase.

Setup guide

Set up Drata MCP in Cursor

Prerequisites

Cursor installed (macOS, Windows, or Linux)
Active Vinkius subscription with a valid endpoint token

1

Open MCP Settings

Go to Cursor Settings → MCP or open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and search for "MCP: Add Server".
2

Add the Drata MCP

Cursor will create or open .cursor/mcp.json in your project root. Paste the JSON snippet on the right. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Enable Agent mode

Open Composer (Cmd+I / Ctrl+I) and switch to Agent mode using the dropdown at the top. MCP tools are only available in Agent mode.
4

Verify the connection

Ask Cursor something like "List my recent Drata transactions." If the MCP tools are loaded correctly, Cursor will call the Drata tools automatically. You can also check Settings → MCP for a green status indicator.

.cursor/mcp.json

{
  "mcpServers": {
    "drata-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Drata. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Drata now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Drata MCP in Cursor

Create a `.cursor/mcp.json` file in your project root or global directory and define the server under the `mcpServers` key. Once saved, enable Agent mode in the Cursor chat panel to start querying `drata_list_controls` directly.

No, this server only reads compliance data to help you write secure code. Your agent uses `drata_get_policy` and `drata_list_policies` to check version history and renewal dates, but it cannot alter or delete your official documentation.

When a check fails, your agent calls `drata_list_tests` to find the failing resource. It then references `drata_list_assets` to pinpoint the exact cloud asset, allowing you to patch the infrastructure code directly inside Cursor.

Yes, your Cursor agent uses `drata_list_frameworks` to pull active frameworks like ISO 27001 or HIPAA. It then maps specific requirements to your files by querying `drata_list_controls` to ensure complete coverage.

All data retrieved via `drata_list_vendors` and `drata_list_personnel` is transmitted directly to your local Cursor instance. The Vinkius MCP Server runs in an isolated, ephemeral sandbox that never caches or logs your sensitive security configurations.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript