Skip to content
actionlake
Start free

Connectors · Identity & security

Drata MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Drata and the rest of your systems. It gives your agent 237 Drata actions (124 reads, 86 writes and 27 that wait for a confirmation) and holds the Drata credential itself, so the agent never does. It paces Drata's limits and records every call.

Connect Drata freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "drata.policies.list",  intent: "check which Drata account is connected"}# List Policies · read · 1 upstream call
  • 237actionsin one signed file
  • 124readlook, never change
  • 86writecreate and update
  • 27wait for a yesdestructive, confirmed first

Set up

Connect Drata in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Drata.

    Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_keyDrata API key: in Drata an admin opens Settings > API Keys > Create API Key, chooses the scopes (read and/or write…
    • regionYour Drata region
    account { op: "connections.requirements", service: "drata" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "drata.policies.list" }# list policies · read · 1 upstream callcheck { action: "drata.policies.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Drata at a glance

Sign-in
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_key
Setup fields
region
Limits we pace to
500 calls a minute, per connection
API covered
Drata Public API V2 (OpenAPI 3.0.0), at your region's drata.com address, set when you connect
Built from
Drata's documentation, read 23 October 2026developers.drata.comhelp.drata.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
123 of 124 reads, for up to 5 minutes; a write clears what it affects
Shared entities
8, so ask can line Drata up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Drata.

237 actions in 58 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 124readlook, never change
  • 86writecreate and update
  • 27destructivewait for a confirmation

  1. Monitoring tests

    10

    6 read · 4 write · 0 destructive

    Create Custom Monitoring Test · List Monitoring Tests · List Monitoring Test Exclusions · List Monitoring Test Failures

  2. Vendor security reviews

    9

    5 read · 4 write · 0 destructive

    Create Vendor Security Review · Create Vendor Security Review with File · List Vendor Security Reviews · List Security Review Actions 🧪

  3. Controls

    8

    4 read · 4 write · 0 destructive

    List Controls · Create Control · Modify Control · Get Control

  4. Devices

    7

    5 read · 1 write · 1 destructive

    List Devices · Get Device · Create or update Device for Custom Connection 🧪 · List Apps for Device

  5. Policies

    7

    3 read · 4 write · 0 destructive

    List Policies · Create Policy · Get Policy · Modify Policy

  6. Risks

    7

    4 read · 2 write · 1 destructive

    List Risks · Create Risk · Get Risk · Update Risk

  7. Vendors

    7

    4 read · 2 write · 1 destructive

    List Vendors · Create Vendor · Get Vendor · Update Vendor

  8. Evidence library

    6

    3 read · 2 write · 1 destructive

    Create Evidence Library Item · List Evidence Library Items · Get Evidence Library Item · Get Evidence Library Version

50 more areas · 176 actions
  • Framework requirements 6
  • Personnel 6
  • Risk registers 6
  • Tasks 6
  • Assets 5
  • Aws connections 5
  • Azure connections 5
  • Control notes 5
  • Custom connections 5
  • Evidence 5
  • GCP connections 5
  • Gitlab connections 5
  • Risk notes 5
  • Scoped personnel groups 5
  • Control owners 4
  • Custom data records 4
  • Custom hris user identities 4
  • Device documents 4
  • Evidence artifacts 4
  • Infrastructure user identities 4
  • Monitoring test tickets 4
  • Policy approval configuration 4
  • Policy languages 4
  • Policy versions 4
  • User documents 4
  • Vendor questionnaires 4
  • Vendor types 4
  • Version control user identities 4
  • Compliance check exclusions 3
  • Control tickets 3
  • Custom data sessions 3
  • Custom field definitions 3
  • Frameworks 3
  • Risk documents 3
  • Risk library 3
  • Roles 3
  • Audit requests 2
  • Audits 2
  • Event download jobs 2
  • Events 2
  • Procurement vendor mappings 2
  • User assigned policies 2
  • Users 2
  • Vendor documents 2
  • Background checks 1
  • Company 1
  • Custom connection resources 1
  • Groups 1
  • Uploads 1
  • Workspaces 1

Top actions

The Drata API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 47 of Drata's 48 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
drata.policies.listList PoliciesList Policies.readsecurity.policy.list36 connectors
drata.users.listList UsersList Users.readidentity.user.list474 connectors
drata.groups.listList GroupsList Groups.readidentity.group.list262 connectors
drata.assets.listList AssetsList Assets.readasset.asset.list42 connectors
drata.vendors.listList VendorsList Vendors.readasset.supplier.list41 connectors
drata.tasks.listList TasksList Tasks.readwork.task.list122 connectors
drata.policies.createCreate PolicyCreate Policy.writesecurity.policy.create25 connectors
drata.personnel.listList PersonnelList Personnel.readhr.employee.list61 connectors
drata.workspaces.listList WorkspacesList Workspaces.readwork.workspace.list50 connectors
drata.tasks.createCreate TaskCreate Task.writework.task.create127 connectors
drata.vendors.createCreate VendorCreate Vendor.writeasset.supplier.create31 connectors
drata.assets.deleteRemove AssetRemove Asset.destructiveasset.asset.delete26 connectors

Try it

Prompts to paste into Claude.

Each one names the Drata actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which Drata tasks are overdue, and who owns each one?

    callsdrata.tasks.list

  2. Writewrite

    Create Policy in Drata. Show me exactly what you will send before you save it.

    callsdrata.policies.create

Governance for Drata

Destructive actions wait for a yes.

27 Drata actions are destructive. These are all of them:

  • Remove Assetdrata.assets.delete
  • Remove Vendordrata.vendors.delete
  • Delete Evidencedrata.evidence.delete
  • Delete Riskdrata.risks.delete
  • Delete Risk Notedrata.risk_notes.delete
  • Delete Vendor Typedrata.vendor_types.delete
  • Delete Control Notedrata.control_notes.delete
  • Delete Control Ownerdrata.control_owners.delete
  • Delete Risk Documentdrata.risk_documents.delete
  • Delete Risk Registerdrata.risk_registers.delete
  • Delete User Documentdrata.user_documents.delete
  • Delete AWS Connectiondrata.aws_connections.delete
  • Unlink Control Ticketdrata.control_tickets.unlink
  • Delete GCP Connectiondrata.gcp_connections.delete
  • Delete Device Documentdrata.device_documents.delete
  • Delete Evidence Library Itemdrata.evidence_library.delete
  • Delete Azure Connectiondrata.azure_connections.delete
  • Delete Custom Connectiondrata.custom_connections.delete
  • Delete Evidence Artifactdrata.evidence_artifacts.delete
  • Delete GitLab Connectiondrata.gitlab_connections.delete
  • Delete Custom Connection Data Recorddrata.custom_data_records.delete
  • Unlink Monitoring Test Ticketdrata.monitoring_test_tickets.unlink
  • Remove Personnel Group From Workspace Scope 🧪drata.scoped_personnel_groups.delete
  • Delete HRIS User Identity 🧪drata.custom_hris_user_identities.delete
  • Remove Review Group Configurationdrata.policy_approval_configuration.delete
  • Delete Devicedrata.devices.delete_from_custom_connection
  • Delete Personnel Compliance Check Exclusionsdrata.compliance_check_exclusions.delete_bulk

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dodrata.assets.deleteconfirm_policy: human

Remove Asset?

intent: the user asked me to remove Asset

run suspended · waiting for a named person · key drata-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "drata-agent",  allowed_actions: ["drata.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "drata.assets.delete", approver: "[email protected]" },    { match: "drata.vendors.delete", approver: "[email protected]" },    { match: "drata.evidence.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to Drata only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Drata costs on actionlake.

Every Drata action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Drata refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 237 Drata actions
  • 237actions pageeach page of a long list is one call
  • 123reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Drata action.

237 actions by area: the id your agent calls, what it does, and its effect.

Monitoring tests10
  • drata.monitoring_tests.create_customCreate Custom Monitoring Testwrite
  • drata.monitoring_tests.getGet Monitoring Testread
  • drata.monitoring_tests.listList Monitoring Testsread
  • drata.monitoring_tests.list_exclusionsList Monitoring Test Exclusionsread
  • drata.monitoring_tests.list_failuresList Monitoring Test Failuresread
  • drata.monitoring_tests.list_passesList Monitoring Test Passesread
  • drata.monitoring_tests.retestRun Monitoring Testwrite
  • drata.monitoring_tests.updateUpdate Monitoring Testwrite
  • drata.monitoring_tests.update_recipeUpdate Custom Monitoring Test Recipewrite
  • drata.monitoring_tests.validate_recipeValidate Custom Monitoring Test Reciperead
Vendor security reviews9
  • drata.vendor_security_reviews.createCreate Vendor Security Reviewwrite
  • drata.vendor_security_reviews.create_with_fileCreate Vendor Security Review with Filewrite
  • drata.vendor_security_reviews.getGet Vendor Security Review 🧪read
  • drata.vendor_security_reviews.listList Vendor Security Reviewsread
  • drata.vendor_security_reviews.list_actionsList Security Review Actions 🧪read
  • drata.vendor_security_reviews.list_all_vendorsList Vendor Security Reviews Across Vendorsread
  • drata.vendor_security_reviews.list_questionnairesList Security Review Questionnaires 🧪read
  • drata.vendor_security_reviews.perform_actionPerform Security Review Action 🧪write
  • drata.vendor_security_reviews.updateUpdate Vendor Security Review 🧪write
Controls8
  • drata.controls.compare_requirementsCompare Control Requirementsread
  • drata.controls.createCreate Controlwrite
  • drata.controls.getGet Controlread
  • drata.controls.listList Controlsread
  • drata.controls.list_requirementsList Requirements for Controlread
  • drata.controls.perform_actionPerform Control Actionwrite
  • drata.controls.reset_requirement_mappingsReset Control Requirement Mappingswrite
  • drata.controls.updateModify Controlwrite
Devices7
  • drata.devices.create_for_custom_connectionCreate or update Device for Custom Connection 🧪write
  • drata.devices.delete_from_custom_connectionDelete Devicedestructive
  • drata.devices.getGet Deviceread
  • drata.devices.listList Devicesread
  • drata.devices.list_appsList Apps for Deviceread
  • drata.devices.list_for_connectionList Devices for Connection 🧪read
  • drata.devices.list_for_personnelList Devices for Personnelread
Policies7
  • drata.policies.assign_ownerAssign Policy Ownerwrite
  • drata.policies.createCreate Policywrite
  • drata.policies.getGet Policyread
  • drata.policies.listList Policiesread
  • drata.policies.list_actionsList Policy Actionsread
  • drata.policies.perform_actionPerform Policy Actionwrite
  • drata.policies.updateModify Policywrite
Risks7
  • drata.risks.createCreate Riskwrite
  • drata.risks.deleteDelete Riskdestructive
  • drata.risks.getGet Riskread
  • drata.risks.listList Risksread
  • drata.risks.searchSearch Risks by Risk Registerread
  • drata.risks.search_all_registersSearch Risksread
  • drata.risks.updateUpdate Riskwrite
Vendors7
  • drata.vendors.createCreate Vendorwrite
  • drata.vendors.deleteRemove Vendordestructive
  • drata.vendors.getGet Vendorread
  • drata.vendors.get_statsGet Vendor Statisticsread
  • drata.vendors.listList Vendorsread
  • drata.vendors.searchSearch Vendorsread
  • drata.vendors.updateUpdate Vendorwrite
Evidence library6
  • drata.evidence_library.createCreate Evidence Library Itemwrite
  • drata.evidence_library.deleteDelete Evidence Library Itemdestructive
  • drata.evidence_library.getGet Evidence Library Itemread
  • drata.evidence_library.get_versionGet Evidence Library Versionread
  • drata.evidence_library.listList Evidence Library Itemsread
  • drata.evidence_library.updateUpdate Evidence Library Itemwrite
Framework requirements6
  • drata.framework_requirements.create_batchCreate Framework Requirementswrite
  • drata.framework_requirements.listList Framework Requirementsread
  • drata.framework_requirements.list_controlsList Controls for a Framework Requirementread
  • drata.framework_requirements.list_legacyList Framework Requirementsread
  • drata.framework_requirements.updateUpdate Framework Requirementwrite
  • drata.framework_requirements.update_legacyUpdate Framework Requirementwrite
Personnel6
  • drata.personnel.getGet Personnelread
  • drata.personnel.listList Personnelread
  • drata.personnel.perform_actionReset Personnel Syncwrite
  • drata.personnel.searchSearch Personnel within a workspaceread
  • drata.personnel.search_all_workspacesSearch Personnel across all workspacesread
  • drata.personnel.updateUpdate Personnelwrite
Risk registers6
  • drata.risk_registers.createCreate Risk Registerwrite
  • drata.risk_registers.deleteDelete Risk Registerdestructive
  • drata.risk_registers.getGet Risk Registerread
  • drata.risk_registers.get_insightsGet Risk Insightsread
  • drata.risk_registers.listList Risk Registersread
  • drata.risk_registers.updateUpdate Risk Registerwrite
Tasks6
  • drata.tasks.createCreate Taskwrite
  • drata.tasks.getGet Taskread
  • drata.tasks.listList Tasksread
  • drata.tasks.list_upcomingList Upcoming Tasksread
  • drata.tasks.perform_actionPerform Task Actionwrite
  • drata.tasks.updateUpdate Taskwrite
Assets5
  • drata.assets.createCreate Assetwrite
  • drata.assets.deleteRemove Assetdestructive
  • drata.assets.getGet Assetread
  • drata.assets.listList Assetsread
  • drata.assets.updateUpdate Assetwrite
Aws connections5
  • drata.aws_connections.createCreate AWS Connectionwrite
  • drata.aws_connections.deleteDelete AWS Connectiondestructive
  • drata.aws_connections.getGet AWS Connectionread
  • drata.aws_connections.listList AWS Connectionsread
  • drata.aws_connections.updateUpdate AWS Connectionwrite
Azure connections5
  • drata.azure_connections.createCreate Azure Connectionwrite
  • drata.azure_connections.deleteDelete Azure Connectiondestructive
  • drata.azure_connections.getGet Azure Connectionread
  • drata.azure_connections.listList Azure Connectionsread
  • drata.azure_connections.updateUpdate Azure Connectionwrite
Control notes5
  • drata.control_notes.createCreate Control Notewrite
  • drata.control_notes.deleteDelete Control Notedestructive
  • drata.control_notes.getGet Control Noteread
  • drata.control_notes.listList Control Notesread
  • drata.control_notes.updateUpdate Control Notewrite
Custom connections5
  • drata.custom_connections.createCreate Custom Connectionwrite
  • drata.custom_connections.deleteDelete Custom Connectiondestructive
  • drata.custom_connections.getGet Custom Connectionread
  • drata.custom_connections.listList Custom Connectionsread
  • drata.custom_connections.updateUpdate Custom Connectionwrite
Evidence5
  • drata.evidence.createCreate Evidencewrite
  • drata.evidence.deleteDelete Evidencedestructive
  • drata.evidence.getGet Evidence Itemread
  • drata.evidence.listList Evidence Itemsread
  • drata.evidence.updateUpdate Evidencewrite
GCP connections5
  • drata.gcp_connections.createCreate GCP Connectionwrite
  • drata.gcp_connections.deleteDelete GCP Connectiondestructive
  • drata.gcp_connections.getGet GCP Connectionread
  • drata.gcp_connections.listList GCP Connectionsread
  • drata.gcp_connections.updateUpdate GCP Connectionwrite
Gitlab connections5
  • drata.gitlab_connections.createCreate GitLab Connectionwrite
  • drata.gitlab_connections.deleteDelete GitLab Connectiondestructive
  • drata.gitlab_connections.getGet GitLab Connectionread
  • drata.gitlab_connections.listList GitLab Connectionsread
  • drata.gitlab_connections.updateUpdate GitLab Connectionwrite
Risk notes5
  • drata.risk_notes.createCreate Risk Notewrite
  • drata.risk_notes.deleteDelete Risk Notedestructive
  • drata.risk_notes.getGet Risk Noteread
  • drata.risk_notes.listList Risk Notesread
  • drata.risk_notes.updateUpdate Risk Notewrite
Scoped personnel groups5
  • drata.scoped_personnel_groups.createAdd Personnel Group To Workspace Scope 🧪write
  • drata.scoped_personnel_groups.deleteRemove Personnel Group From Workspace Scope 🧪destructive
  • drata.scoped_personnel_groups.get_countsGet Workspace Scoped Personnel Counts 🧪read
  • drata.scoped_personnel_groups.listList Workspace Scoped Personnel Groups 🧪read
  • drata.scoped_personnel_groups.replaceReplace Workspace Scoped Personnel Groups 🧪write
Control owners4
  • drata.control_owners.createAdd Control Ownerwrite
  • drata.control_owners.deleteDelete Control Ownerdestructive
  • drata.control_owners.listList Control Ownersread
  • drata.control_owners.replaceModify Control Ownerswrite
Custom data records4
  • drata.custom_data_records.createUpsert Custom Data Recordswrite
  • drata.custom_data_records.deleteDelete Custom Connection Data Recorddestructive
  • drata.custom_data_records.listList Custom Data Recordsread
  • drata.custom_data_records.updateUpdate Custom Data Recordwrite
Custom hris user identities4
  • drata.custom_hris_user_identities.deleteDelete HRIS User Identity 🧪destructive
  • drata.custom_hris_user_identities.getGet HRIS User Identity 🧪read
  • drata.custom_hris_user_identities.listList HRIS User Identities 🧪read
  • drata.custom_hris_user_identities.upsert_batchCreate or Update HRIS User Identities 🧪write
Device documents4
  • drata.device_documents.createUpload Device Documentwrite
  • drata.device_documents.deleteDelete Device Documentdestructive
  • drata.device_documents.getGet Device Documentread
  • drata.device_documents.listList Device Documentsread
Evidence artifacts4
  • drata.evidence_artifacts.deleteDelete Evidence Artifactdestructive
  • drata.evidence_artifacts.listList Evidence Artifactsread
  • drata.evidence_artifacts.perform_actionPerform Evidence Artifact Actionwrite
  • drata.evidence_artifacts.updateUpdate Evidence Artifactwrite
Infrastructure user identities4
  • drata.infrastructure_user_identities.getGet Infrastructure User Identityread
  • drata.infrastructure_user_identities.listList Infrastructure User Identitiesread
  • drata.infrastructure_user_identities.list_actionsList Infrastructure User Identity Actionsread
  • drata.infrastructure_user_identities.perform_actionPerform Infrastructure User Identity Actionwrite
Monitoring test tickets4
  • drata.monitoring_test_tickets.createCreate Monitoring Test Ticketwrite
  • drata.monitoring_test_tickets.linkLink Monitoring Test Ticketwrite
  • drata.monitoring_test_tickets.listList Monitoring Test Ticketsread
  • drata.monitoring_test_tickets.unlinkUnlink Monitoring Test Ticketdestructive
Policy approval configuration4
  • drata.policy_approval_configuration.createAdd Review Group Configurationwrite
  • drata.policy_approval_configuration.deleteRemove Review Group Configurationdestructive
  • drata.policy_approval_configuration.getGet Policy Approval Configurationread
  • drata.policy_approval_configuration.updateUpdate Review Group Configurationwrite
Policy languages4
  • drata.policy_languages.get_versionGet Policy Language Versionread
  • drata.policy_languages.list_for_versionList Policy Version Languagesread
  • drata.policy_languages.list_settingsList Policy Language Settingsread
  • drata.policy_languages.list_versionsList Policy Language Versionsread
Policy versions4
  • drata.policy_versions.createCreate Policy Versionwrite
  • drata.policy_versions.getGet Policy Versionread
  • drata.policy_versions.listList Policy Versionsread
  • drata.policy_versions.replace_fileReplace Policy Version Filewrite
User documents4
  • drata.user_documents.createUpload User Documentwrite
  • drata.user_documents.deleteDelete User Documentdestructive
  • drata.user_documents.getGet User Documentread
  • drata.user_documents.listList User Documentsread
Vendor questionnaires4
  • drata.vendor_questionnaires.getGet Vendor Questionnaireread
  • drata.vendor_questionnaires.listList Vendor Questionnairesread
  • drata.vendor_questionnaires.list_questionsList Vendor Questionnaire Questionsread
  • drata.vendor_questionnaires.sendSend Questionnaire to Vendorwrite
Vendor types4
  • drata.vendor_types.createCreate Vendor Typewrite
  • drata.vendor_types.deleteDelete Vendor Typedestructive
  • drata.vendor_types.listList Vendor Typesread
  • drata.vendor_types.updateUpdate Vendor Typewrite
Version control user identities4
  • drata.version_control_user_identities.getGet Version Control User Identityread
  • drata.version_control_user_identities.listList Version Control User Identitiesread
  • drata.version_control_user_identities.list_actionsList Version Control User Identity Actionsread
  • drata.version_control_user_identities.perform_actionPerform Version Control User Identity Actionwrite
Compliance check exclusions3
  • drata.compliance_check_exclusions.create_bulkExclude Personnel Compliance Checkswrite
  • drata.compliance_check_exclusions.delete_bulkDelete Personnel Compliance Check Exclusionsdestructive
  • drata.compliance_check_exclusions.listList Compliance Check Exclusionsread
Control tickets3
  • drata.control_tickets.linkLink Control Ticketwrite
  • drata.control_tickets.listList Control Ticketsread
  • drata.control_tickets.unlinkUnlink Control Ticketdestructive
Custom data sessions3
  • drata.custom_data_sessions.listList Custom Data Sessionsread
  • drata.custom_data_sessions.perform_actionPerform Session Actionwrite
  • drata.custom_data_sessions.upload_recordsUpsert Custom Data Records with Session Managementwrite
Custom field definitions3
  • drata.custom_field_definitions.createCreate Custom Field Definitionwrite
  • drata.custom_field_definitions.getGet Custom Field Definitionread
  • drata.custom_field_definitions.listList Custom Field Definitionsread
Frameworks3
  • drata.frameworks.createCreate Custom Frameworkwrite
  • drata.frameworks.listList Frameworksread
  • drata.frameworks.updateUpdate Custom Frameworkwrite
Risk documents3
  • drata.risk_documents.deleteDelete Risk Documentdestructive
  • drata.risk_documents.getGet Risk Documentread
  • drata.risk_documents.listList Risk Documentsread
Risk library3
  • drata.risk_library.copy_to_registerCopies Risk Library Items to a Risk Register.write
  • drata.risk_library.getGet Risk Library Item by ID.read
  • drata.risk_library.listList Risk Librariesread
Roles3
  • drata.roles.getGet Roleread
  • drata.roles.listList Rolesread
  • drata.roles.list_usersList Users with Roleread
Audit requests2
  • drata.audit_requests.getGet Audit Requestread
  • drata.audit_requests.listList Audit Requestsread
Audits2
  • drata.audits.getGet Auditread
  • drata.audits.listList Auditsread
Event download jobs2
  • drata.event_download_jobs.createCreate Event PDF Download Jobwrite
  • drata.event_download_jobs.getGet Event PDF Exportread
Events2
  • drata.events.getGet Eventread
  • drata.events.listList Eventsread
Procurement vendor mappings2
  • drata.procurement_vendor_mappings.getGet Vendor Mappingread
  • drata.procurement_vendor_mappings.updateUpdate Vendor Mappingwrite
User assigned policies2
  • drata.user_assigned_policies.acknowledgeAcknowledge User's Assigned Policywrite
  • drata.user_assigned_policies.listGet User's Assigned Policy detailsread
Users2
  • drata.users.getGet Userread
  • drata.users.listList Usersread
Vendor documents2
  • drata.vendor_documents.getGet Vendor Documentread
  • drata.vendor_documents.listList Vendor Documentsread
Background checks1
  • drata.background_checks.createCreate Manual Background Checkwrite
Company1
  • drata.company.getGet Companyread
Custom connection resources1
  • drata.custom_connection_resources.get_attributesGet Custom Connection Resource Attributesread
Groups1
  • drata.groups.listList Groupsread
Uploads1
  • drata.uploads.request_upload_urlRequest Upload URLwrite
Workspaces1
  • drata.workspaces.listList Workspacesread

Questions

The Drata MCP server, answered.

Is there a Drata MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 237 Drata actions across monitoring tests, vendor security reviews, controls and devices, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Drata.

What do I need to connect Drata?

Drata API key: in Drata an admin opens Settings > API Keys > Create API Key, chooses the scopes (read and/or write…. Plus your region. The free call account { op: "connections.requirements", service: "drata" } lists exactly what to paste.

Can an AI agent delete or change things in Drata?

Only if its key allows it, and only with an explicit confirmation. 27 Drata actions are destructive, including remove Asset, remove Vendor and delete Evidence. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Drata API limit?

actionlake paces every call to the limits in the Drata service file: 500 calls a minute per connection. Repeated reads are answered from cache (123 Drata actions can be), which never reaches Drata.

What does a Drata action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (237 Drata actions page). Cache hits, searches, dry runs and calls Drata refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Drata API does it cover?

The Drata Public API V2 (OpenAPI 3.0.0) at your region's drata.com address, set when you connect. It is built from Drata's documentation as read on 23 October 2026. 237 actions in 58 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Drata data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Drata credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Drata

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Drata; the name is the vendor's own. Counts are from the Drata service file, version 1.0.0.

Give your agent Drata today.

Connect Drata freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.