How to Use the Drata MCP in VS Code Copilot

Q: How do I share the Drata MCP Server config with my team in VS Code Copilot?

Create a .vscode/mcp.json file in your repository root and commit it to Git. Every developer on your team using VS Code Copilot will automatically gain access to tools like dratalistcontrols for continuous compliance tracking.

Q: Can VS Code Copilot help us prepare for a SOC 2 audit using Drata?

Yes, your team can use VS Code Copilot to query dratalistframeworks and check your readiness score. The agent then calls dratalistcontrols to list outstanding requirements, helping you assign engineering tasks directly from your codebase.

Q: Does the VS Code Copilot integration allow us to check third-party vendor risks?

Yes, your agent can call dratalistvendors to retrieve risk classifications and questionnaire statuses. This helps developers verify if a third-party service meets company security standards before integrating their API.

Bring live Drata audit readiness data directly into VS Code Copilot to ensure team-wide compliance during development.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Drata MCP to VS Code Copilot

Create your Vinkius account to connect Drata to VS Code Copilot and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Drata with VS Code Copilot

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Review Team Policy Compliance in VS Code Copilot

`drata_list_policies` brings your complete library of security documents, including Incident Response and Data Classification, directly into your team's VS Code Copilot chat. Developers can instantly check if their coding practices align with active corporate policies. Your VS Code Copilot agent uses `drata_get_policy` to verify employee acknowledgment rates and upcoming renewal dates. This ensures your engineering team remains fully aware of mandatory policy updates without leaving the IDE.

Verify Cloud Asset Security Status via MCP Server

This MCP Server exposes `drata_list_assets` to let you audit your cloud infrastructure compliance directly inside your development environment. You can quickly list S3 buckets, RDS databases, and EC2 instances to verify encryption-at-rest and network boundaries. If an asset is flagged as non-compliant, your VS Code Copilot agent references `drata_list_tests` to find the failing automated check. This lets your team fix security deviations directly in their local workspace before the next audit cycle.

Audit Personnel Training Status in VS Code Copilot

Running `drata_list_personnel` inside VS Code Copilot lets your team track which developers have overdue security awareness training or non-compliant devices. This keeps your department's compliance metrics high without requiring HR dashboard access. Your agent queries `drata_get_person` to inspect MDM enrollment, antivirus status, and background check clearance for specific team members. It allows you to address compliance gaps directly during sprint planning or team reviews.

Setup guide

Set up Drata MCP in VS Code Copilot

Prerequisites

VS Code 1.99 or later with GitHub Copilot extension
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and run "MCP: Add Server". Select HTTP (Streamable) as the server type. VS Code will create .vscode/mcp.json in your workspace.
2

Add the Drata MCP

Paste the JSON snippet shown on the right into your .vscode/mcp.json. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Switch to Agent mode

Open Copilot Chat (Cmd+Shift+I / Ctrl+Shift+I) and switch to Agent mode using the dropdown. MCP tools are only available in Agent mode — they do not appear in Edit or Ask modes.
4

Verify the connection

In the Copilot Chat input, type # to list available tools. You should see the Drata tools listed. Try asking: "List my recent Drata transactions" and Copilot will invoke them automatically.

.vscode/mcp.json

{
  "mcpServers": {
    "drata-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Drata. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Drata now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Drata MCP in VS Code Copilot

Create a `.vscode/mcp.json` file in your repository root and commit it to Git. Every developer on your team using VS Code Copilot will automatically gain access to tools like `drata_list_controls` for continuous compliance tracking.

Yes, your team can use VS Code Copilot to query `drata_list_frameworks` and check your readiness score. The agent then calls `drata_list_controls` to list outstanding requirements, helping you assign engineering tasks directly from your codebase.

Ask your agent to check your real-time monitors. Your agent uses the MCP Server to query `drata_list_tests` and pull the latest results from Okta, AWS, or GitHub, showing you the exact failing resource inside your VS Code Copilot chat.

Yes, your agent can call `drata_list_vendors` to retrieve risk classifications and questionnaire statuses. This helps developers verify if a third-party service meets company security standards before integrating their API.

Yes, your policies and infrastructure data are protected. The Vinkius MCP Server operates as a zero-trust, ephemeral sandbox that passes raw JSON from `drata_list_policies` and `drata_list_assets` directly to your local VS Code Copilot instance without storing any information.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript