The server itself exposes 42 tools, and some of them can write to your Vanta account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Vanta.

How is this different from connecting Vanta MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Vanta MCP API changes?

We track the Vanta MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Vanta tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Vanta?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Vanta MCP server myself?

No. TrustGate connects to the Vanta MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Vanta directly.

Connect Vanta MCP to your AI agents, securely.

One secured endpoint for every Vanta call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Vanta MCP now

What your agents can ask once Vanta MCP is connected.

Select the tools your AI agents can call

42 tools from the Vanta MCP schema.

Showing 42 tools

testsreadRetrieves Vanta's automated security and compliance tests. Filter by status, integration or framework to understand pass/fail posture quickly.
list_test_entitiesreadGets resources monitored by a particular test, including failing entities that need remediation.
controlsreadLists security controls in your Vanta account or retrieves a specific control by ID with framework mapping details.
list_control_testsreadEnumerates automated tests that validate a specific control, complete with status and failing entity information.
list_control_documentsreadLists documents mapped to a control to locate supporting evidence quickly.
list_library_controlsreadList Vanta controls from the library. These are pre-built security controls available in Vanta's control library that can be added to your account.
documentsreadLists compliance documents or fetches details for a specific document, including metadata.
document_resourcesreadRetrieves resources linked to a document (controls, links, uploads) by choosing the desired resource type.
download_document_filereadDownload document file by upload ID. Get the actual uploaded document file. Intelligently handles different MIME types: returns text content for readable files (text/*, JSON, XML, CSV, JavaScript) and metadata information for binary files (images, videos, PDFs, etc.).
frameworksreadLists compliance frameworks with completion status and progress metrics for each.
list_framework_controlsreadRetrieves the controls associated with a compliance framework, including descriptions and implementation guidance.
integrationsreadLists integrations connected to your Vanta account or fetches details for a specific integration, including resource kinds and connection status.
integration_resourcesreadInspects integration resource kinds, schema information, full resource lists, or a specific resource by selecting from the supported operations.
peoplereadLists people across your organization or looks up a specific person by ID with role, email and group membership metadata.
list_group_peoplereadList group's people. Get all people who are members of a specific group. Use this to see group membership and organizational structure.
monitored_computersreadAccess monitored computers in your Vanta account.
risksreadLists risk scenarios under management or fetches a specific scenario to review status, scoring and treatment plans.
vendor_compliancereadAccess vendor compliance data including documents, findings, and security reviews.
get_vendor_security_reviewreadGet vendor security review by ID. Retrieve detailed information about a specific security review for a vendor.
list_vendor_security_review_documentsreadList vendor security review's documents. Get all documents associated with a specific vendor security review.
list_vendor_risk_attributesreadList all vendor risk attributes in your Vanta account.
list_discovered_vendorsreadList discovered vendors identified by Vanta's automated discovery. Returns vendor names, domains, discovery sources, and linkage status to managed vendor records.
list_discovered_vendor_accountsreadList accounts associated with a discovered vendor. Provide discoveredVendorId to retrieve account identifiers, connection details, and discovery metadata.
vulnerabilitiesreadLists detected vulnerabilities or retrieves a specific item with CVE metadata, severity and impacted assets.
vulnerable_assetsreadAccess vulnerable assets in your Vanta account.
list_vulnerability_remediationsreadList all vulnerability remediations in your Vanta account.
get_trust_centerreadGet Trust Center information. Retrieve detailed information about a specific Trust Center including configuration, branding, and public visibility settings. Use this to access Trust Center details for compliance transparency and customer communication.
trust_center_access_requestsreadAccess Trust Center access requests. Provide accessRequestId to get a specific access request, or omit to list all access requests. Use this to manage and review Trust Center access requests including requester details, status, and approval workflow.
list_trust_center_viewer_activity_eventsreadList Trust Center viewer activity events.
trust_center_control_categoriesreadAccess Trust Center control categories. Provide controlCategoryId to get a specific control category, or omit to list all categories. Use this to understand how compliance controls are organized and categorized for public display.
trust_center_controlsreadAccess Trust Center controls. Provide trustCenterControlId to get a specific control, or omit to list all controls. Use this to see compliance controls displayed publicly to demonstrate your compliance posture.
trust_center_faqsreadAccess Trust Center FAQs. Provide faqId to get a specific FAQ, or omit to list all FAQs. Use this to see frequently asked questions and answers published for customers regarding compliance and security practices.
list_trust_center_resourcesreadList Trust Center resources. Get all downloadable resources and documents available in a specific Trust Center. Use this to see what compliance materials are provided to customers and prospects.
get_trust_center_documentreadGet Trust Center document by ID. Retrieve detailed information about a specific document available in a Trust Center. Use this to access compliance certifications, policies, and other public-facing documentation.
get_trust_center_resource_mediareadDownload Trust Center document media. Get the actual uploaded document/media file for a Trust Center resource. Intelligently handles different MIME types: returns text content for readable files (text/*, JSON, XML, CSV, JavaScript) and metadata information for binary files (images, videos, PDFs, etc.). Use this to download compliance documents, certifications, and other materials for review or audit purposes.
trust_center_subprocessorsreadAccess Trust Center subprocessors. Provide subprocessorId to get a specific subprocessor, or omit to list all subprocessors. Use this to see third-party service providers and their compliance information for transparency.
trust_center_updatesreadAccess Trust Center updates. Provide updateId to get a specific update, or omit to list all updates. Use this to see compliance status changes, security updates, and important notifications published in the Trust Center.
trust_center_viewersreadAccess Trust Center viewers. Provide viewerId to get a specific viewer, or omit to list all viewers. Use this for access management and audit purposes to see who can view the Trust Center.
get_trust_center_subscriberreadGet Trust Center subscriber by ID. Retrieve detailed information about a specific subscriber including subscription preferences and notification settings.
trust_center_subscriber_groupsreadAccess Trust Center subscriber groups. Provide subscriberGroupId to get a specific subscriber group, or omit to list all subscriber groups. Use this for managing access permissions and organizing subscribers.
list_trust_center_historical_access_requestsreadList Trust Center historical access requests. Get all historical access requests for a specific Trust Center for auditing and compliance tracking. Use this to review past access patterns and requests.
list_trust_center_subscribersreadList Trust Center subscribers. Get all subscribers for a specific Trust Center. Use this to manage notifications and communication with stakeholders.

What Vanta MCP exposes

Vanta MCP groups its 42 tools into 9 categories, each with a suggested starting policy.

All 42 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Tests	Automated security and compliance tests, filtered by status, integration or framework, and the entities they monitor	Read	Read-only; failing entities point at real infrastructure, so treat the output as sensitive
Controls	Security controls, the tests that validate them and the documents mapped to them	Read	Allow control discovery across the frameworks in scope
Documents	Compliance documents and the controls, links and uploads attached to them	Read	Evidence documents can hold internal detail; restrict access
Frameworks	Compliance frameworks with completion status, and the controls each one requires	Read	Allow read-only progress reporting
Integrations	Connected integrations, their resource kinds and the resources themselves	Read	Resource listings reach connected cloud accounts; scope them
People	People in the account with role, email and group membership	Read	Personal data; limit to access-review workflows
Risks	Risk scenarios in the register with status, scoring and treatment plans	Read	Allow read-only risk reporting
Vulnerabilities	Detected vulnerabilities with CVE metadata, severity and impacted assets	Read	Unremediated vulnerabilities are sensitive; restrict to the security team
Trust Center	Trust Center profile, documents, resources, controls, FAQs, subprocessors, updates, viewers, subscribers and access requests	Read	Limit to the Trust Center you publish; review viewer and subscriber data access

Connect Vanta MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Vanta
Find Vanta in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Vanta MCP or block it. You allow the exact tools each agent can call, one by one.

Vanta MCP	42 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 42 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Vanta MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Vanta MCP42 documented tools.
Coding assistants	Connection & credentialsper user	Trust Center16 tools
Internal copilots	Tool access policiesdeny by default	Risks7 tools
Workflow automations	Request & response inspectioninline	Controls4 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools15 tools