Vanta MCP. Audit compliance posture without leaving chat.

Listen up. You're done switching tabs just to check compliance status or hunt through dashboards. This server connects your continuous security monitoring and audit data directly into your chat client, so you can run complex checks using simple commands.

Compliance Health & Auditing Status

vanta_compliance_status gives you the big picture: it calculates your overall compliance readiness score and shows pass rates across major frameworks like SOC 2, HIPAA, or GDPR. You'll see critical alerts right away. To dig deeper into specific standards, vanta_list_tests lets you view all compliance monitoring tests—like those for SOC 2 or HIPAA—showing whether they passed, failed, and when they last ran.

If a test fails, vanta_get_test pulls detailed info on that specific test, including evidence needed, which controls were linked, what resources are failing, and exactly how to fix it.

Personnel & Policy Management

Checking your people is straightforward with this server. You use vanta_list_people to list every employee, confirming who's trained up-to-date on security protocols, checking if their device meets compliance standards, or seeing their current access review standing. If you need to see what policies are in place, vanta_list_policies lists all your company rules—showing things like the approval status, when they were last reviewed, and how many employees actually acknowledged them.

You can also pull the full risk register using vanta_list_risks, which details identified security risks, showing their impact score, likelihood, assigned mitigation controls, and current mitigation status.

Endpoint & Infrastructure Audits

When you need to know about your tech stack, this server's got you covered. You run vanta_list_computers to list every monitored laptop and desktop. It shows their OS version, whether disk encryption is active, if antivirus is running, and the overall compliance state for each machine. For cloud infrastructure vulnerabilities, vanta_list_vulnerabilities pulls a list of detected security flaws across your whole system—you'll see the severity level, specific CVE IDs, which resources are affected, and the required SLA deadline for fixes.

To keep track of necessary paperwork, you can use vanta_list_evidence_requests to see outstanding audit evidence requests. This lists documents or screenshots that your team members still need to provide, along with their due dates. For internal systems, vanta_list_integrations checks all connected integrations—like cloud providers and IDPs—showing if they're syncing correctly, what coverage metrics they hit, and any configuration warnings you gotta fix.

Summary of Capabilities

You can run a query to immediately check your overall compliance status across multiple standards (SOC 2, HIPAA, GDPR) and pull critical alerts. You list all monitored endpoints and verify things like OS versions, encryption status, and antivirus presence across the whole fleet. You review pending audit evidence requests—documents or screenshots needed from team members along with their deadlines.

You pull the full risk register, seeing identified security risks alongside their impact score, likelihood, and assigned mitigation controls. Finally, you list all personnel records, checking who has overdue training or whose device hasn't met compliance standards.