--- title: "Drata MCP server for AI agents - actionlake" description: "Give Claude 237 Drata actions through one MCP server: monitoring tests, vendor security reviews, controls, devices. 100,000 calls a month free, no card." canonical: https://actionlake.com/connectors/drata updated: 2026-10-23 --- Connectors · Identity & security # Drata MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Drata and the rest of your systems. It gives your agent 237 Drata actions (124 reads, 86 writes and 27 that wait for a confirmation) and holds the Drata credential itself, so the agent never does. It paces Drata's limits and records every call. [Connect Drata free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "drata.policies.list", intent: "check which Drata account is connected" } # List Policies · read · 1 upstream call ``` - 237 actions in one signed file - 124 read look, never change - 86 write create and update - 27 wait for a yes destructive, confirmed first Set up ## Connect Drata in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Drata. Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` Drata API key: in Drata an admin opens Settings > API Keys > Create API Key, chooses the scopes (read and/or write… - `region` Your Drata region ``` account { op: "connections.requirements", service: "drata" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "drata.policies.list" } # list policies · read · 1 upstream call check { action: "drata.policies.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Drata at a glance **Sign-in** Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` **Setup fields** `region` **Limits we pace to** 500 calls a minute, per connection **API covered** Drata Public API V2 (OpenAPI 3.0.0), at your region's drata.com address, set when you connect **Built from** Drata's documentation, read 23 October 2026[developers.drata.com](https://developers.drata.com/openapi/reference/v2/overview) [help.drata.com](https://help.drata.com/en/articles/6695964) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 123 of 124 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 8, so ask can line Drata up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Drata. 237 actions in 58 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **124** read look, never change - **86** write create and update - **27** destructive wait for a confirmation 1. ### Monitoring tests 10 6 read · 4 write · 0 destructive Create Custom Monitoring Test · List Monitoring Tests · List Monitoring Test Exclusions · List Monitoring Test Failures 2. ### Vendor security reviews 9 5 read · 4 write · 0 destructive Create Vendor Security Review · Create Vendor Security Review with File · List Vendor Security Reviews · List Security Review Actions 🧪 3. ### Controls 8 4 read · 4 write · 0 destructive List Controls · Create Control · Modify Control · Get Control 4. ### Devices 7 5 read · 1 write · 1 destructive List Devices · Get Device · Create or update Device for Custom Connection 🧪 · List Apps for Device 5. ### Policies 7 3 read · 4 write · 0 destructive List Policies · Create Policy · Get Policy · Modify Policy 6. ### Risks 7 4 read · 2 write · 1 destructive List Risks · Create Risk · Get Risk · Update Risk 7. ### Vendors 7 4 read · 2 write · 1 destructive List Vendors · Create Vendor · Get Vendor · Update Vendor 8. ### Evidence library 6 3 read · 2 write · 1 destructive Create Evidence Library Item · List Evidence Library Items · Get Evidence Library Item · Get Evidence Library Version **50 more areas · 176 actions** - Framework requirements **6** - Personnel **6** - Risk registers **6** - Tasks **6** - Assets **5** - Aws connections **5** - Azure connections **5** - Control notes **5** - Custom connections **5** - Evidence **5** - GCP connections **5** - Gitlab connections **5** - Risk notes **5** - Scoped personnel groups **5** - Control owners **4** - Custom data records **4** - Custom hris user identities **4** - Device documents **4** - Evidence artifacts **4** - Infrastructure user identities **4** - Monitoring test tickets **4** - Policy approval configuration **4** - Policy languages **4** - Policy versions **4** - User documents **4** - Vendor questionnaires **4** - Vendor types **4** - Version control user identities **4** - Compliance check exclusions **3** - Control tickets **3** - Custom data sessions **3** - Custom field definitions **3** - Frameworks **3** - Risk documents **3** - Risk library **3** - Roles **3** - Audit requests **2** - Audits **2** - Event download jobs **2** - Events **2** - Procurement vendor mappings **2** - User assigned policies **2** - Users **2** - Vendor documents **2** - Background checks **1** - Company **1** - Custom connection resources **1** - Groups **1** - Uploads **1** - Workspaces **1** Top actions ## The Drata API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 47 of Drata's 48 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `drata.policies.list` List Policies | List Policies. | read | `security.policy.list` 36 connectors | | `drata.users.list` List Users | List Users. | read | `identity.user.list` 474 connectors | | `drata.groups.list` List Groups | List Groups. | read | `identity.group.list` 262 connectors | | `drata.assets.list` List Assets | List Assets. | read | `asset.asset.list` 42 connectors | | `drata.vendors.list` List Vendors | List Vendors. | read | `asset.supplier.list` 41 connectors | | `drata.tasks.list` List Tasks | List Tasks. | read | `work.task.list` 122 connectors | | `drata.policies.create` Create Policy | Create Policy. | write | `security.policy.create` 25 connectors | | `drata.personnel.list` List Personnel | List Personnel. | read | `hr.employee.list` 61 connectors | | `drata.workspaces.list` List Workspaces | List Workspaces. | read | `work.workspace.list` 50 connectors | | `drata.tasks.create` Create Task | Create Task. | write | `work.task.create` 127 connectors | | `drata.vendors.create` Create Vendor | Create Vendor. | write | `asset.supplier.create` 31 connectors | | `drata.assets.delete` Remove Asset | Remove Asset. | destructive | `asset.asset.delete` 26 connectors | Try it ## Prompts to paste into Claude. Each one names the Drata actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Drata tasks are overdue, and who owns each one? calls `drata.tasks.list` 2. Write write Create Policy in Drata. Show me exactly what you will send before you save it. calls `drata.policies.create` Governance for Drata ## Destructive actions wait for a yes. 27 Drata actions are destructive. These are all of them: - Remove Asset `drata.assets.delete` - Remove Vendor `drata.vendors.delete` - Delete Evidence `drata.evidence.delete` - Delete Risk `drata.risks.delete` - Delete Risk Note `drata.risk_notes.delete` - Delete Vendor Type `drata.vendor_types.delete` - Delete Control Note `drata.control_notes.delete` - Delete Control Owner `drata.control_owners.delete` - Delete Risk Document `drata.risk_documents.delete` - Delete Risk Register `drata.risk_registers.delete` - Delete User Document `drata.user_documents.delete` - Delete AWS Connection `drata.aws_connections.delete` - Unlink Control Ticket `drata.control_tickets.unlink` - Delete GCP Connection `drata.gcp_connections.delete` - Delete Device Document `drata.device_documents.delete` - Delete Evidence Library Item `drata.evidence_library.delete` - Delete Azure Connection `drata.azure_connections.delete` - Delete Custom Connection `drata.custom_connections.delete` - Delete Evidence Artifact `drata.evidence_artifacts.delete` - Delete GitLab Connection `drata.gitlab_connections.delete` - Delete Custom Connection Data Record `drata.custom_data_records.delete` - Unlink Monitoring Test Ticket `drata.monitoring_test_tickets.unlink` - Remove Personnel Group From Workspace Scope 🧪 `drata.scoped_personnel_groups.delete` - Delete HRIS User Identity 🧪 `drata.custom_hris_user_identities.delete` - Remove Review Group Configuration `drata.policy_approval_configuration.delete` - Delete Device `drata.devices.delete_from_custom_connection` - Delete Personnel Compliance Check Exclusions `drata.compliance_check_exclusions.delete_bulk` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do drata.assets.delete confirm_policy: **human** Remove Asset? **intent:** the user asked me to remove Asset run suspended · waiting for a named person · key _drata-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "drata-agent", allowed_actions: ["drata.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "drata.assets.delete", approver: "lead@example.com" }, { match: "drata.vendors.delete", approver: "lead@example.com" }, { match: "drata.evidence.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Drata only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Drata costs on actionlake. Every Drata action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Drata refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 237 Drata actions - 237 actions page each page of a long list is one call - 123 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Drata action. 237 actions by area: the id your agent calls, what it does, and its effect. **Monitoring tests 10** - `drata.monitoring_tests.create_custom` Create Custom Monitoring Test write - `drata.monitoring_tests.get` Get Monitoring Test read - `drata.monitoring_tests.list` List Monitoring Tests read - `drata.monitoring_tests.list_exclusions` List Monitoring Test Exclusions read - `drata.monitoring_tests.list_failures` List Monitoring Test Failures read - `drata.monitoring_tests.list_passes` List Monitoring Test Passes read - `drata.monitoring_tests.retest` Run Monitoring Test write - `drata.monitoring_tests.update` Update Monitoring Test write - `drata.monitoring_tests.update_recipe` Update Custom Monitoring Test Recipe write - `drata.monitoring_tests.validate_recipe` Validate Custom Monitoring Test Recipe read **Vendor security reviews 9** - `drata.vendor_security_reviews.create` Create Vendor Security Review write - `drata.vendor_security_reviews.create_with_file` Create Vendor Security Review with File write - `drata.vendor_security_reviews.get` Get Vendor Security Review 🧪 read - `drata.vendor_security_reviews.list` List Vendor Security Reviews read - `drata.vendor_security_reviews.list_actions` List Security Review Actions 🧪 read - `drata.vendor_security_reviews.list_all_vendors` List Vendor Security Reviews Across Vendors read - `drata.vendor_security_reviews.list_questionnaires` List Security Review Questionnaires 🧪 read - `drata.vendor_security_reviews.perform_action` Perform Security Review Action 🧪 write - `drata.vendor_security_reviews.update` Update Vendor Security Review 🧪 write **Controls 8** - `drata.controls.compare_requirements` Compare Control Requirements read - `drata.controls.create` Create Control write - `drata.controls.get` Get Control read - `drata.controls.list` List Controls read - `drata.controls.list_requirements` List Requirements for Control read - `drata.controls.perform_action` Perform Control Action write - `drata.controls.reset_requirement_mappings` Reset Control Requirement Mappings write - `drata.controls.update` Modify Control write **Devices 7** - `drata.devices.create_for_custom_connection` Create or update Device for Custom Connection 🧪 write - `drata.devices.delete_from_custom_connection` Delete Device destructive - `drata.devices.get` Get Device read - `drata.devices.list` List Devices read - `drata.devices.list_apps` List Apps for Device read - `drata.devices.list_for_connection` List Devices for Connection 🧪 read - `drata.devices.list_for_personnel` List Devices for Personnel read **Policies 7** - `drata.policies.assign_owner` Assign Policy Owner write - `drata.policies.create` Create Policy write - `drata.policies.get` Get Policy read - `drata.policies.list` List Policies read - `drata.policies.list_actions` List Policy Actions read - `drata.policies.perform_action` Perform Policy Action write - `drata.policies.update` Modify Policy write **Risks 7** - `drata.risks.create` Create Risk write - `drata.risks.delete` Delete Risk destructive - `drata.risks.get` Get Risk read - `drata.risks.list` List Risks read - `drata.risks.search` Search Risks by Risk Register read - `drata.risks.search_all_registers` Search Risks read - `drata.risks.update` Update Risk write **Vendors 7** - `drata.vendors.create` Create Vendor write - `drata.vendors.delete` Remove Vendor destructive - `drata.vendors.get` Get Vendor read - `drata.vendors.get_stats` Get Vendor Statistics read - `drata.vendors.list` List Vendors read - `drata.vendors.search` Search Vendors read - `drata.vendors.update` Update Vendor write **Evidence library 6** - `drata.evidence_library.create` Create Evidence Library Item write - `drata.evidence_library.delete` Delete Evidence Library Item destructive - `drata.evidence_library.get` Get Evidence Library Item read - `drata.evidence_library.get_version` Get Evidence Library Version read - `drata.evidence_library.list` List Evidence Library Items read - `drata.evidence_library.update` Update Evidence Library Item write **Framework requirements 6** - `drata.framework_requirements.create_batch` Create Framework Requirements write - `drata.framework_requirements.list` List Framework Requirements read - `drata.framework_requirements.list_controls` List Controls for a Framework Requirement read - `drata.framework_requirements.list_legacy` List Framework Requirements read - `drata.framework_requirements.update` Update Framework Requirement write - `drata.framework_requirements.update_legacy` Update Framework Requirement write **Personnel 6** - `drata.personnel.get` Get Personnel read - `drata.personnel.list` List Personnel read - `drata.personnel.perform_action` Reset Personnel Sync write - `drata.personnel.search` Search Personnel within a workspace read - `drata.personnel.search_all_workspaces` Search Personnel across all workspaces read - `drata.personnel.update` Update Personnel write **Risk registers 6** - `drata.risk_registers.create` Create Risk Register write - `drata.risk_registers.delete` Delete Risk Register destructive - `drata.risk_registers.get` Get Risk Register read - `drata.risk_registers.get_insights` Get Risk Insights read - `drata.risk_registers.list` List Risk Registers read - `drata.risk_registers.update` Update Risk Register write **Tasks 6** - `drata.tasks.create` Create Task write - `drata.tasks.get` Get Task read - `drata.tasks.list` List Tasks read - `drata.tasks.list_upcoming` List Upcoming Tasks read - `drata.tasks.perform_action` Perform Task Action write - `drata.tasks.update` Update Task write **Assets 5** - `drata.assets.create` Create Asset write - `drata.assets.delete` Remove Asset destructive - `drata.assets.get` Get Asset read - `drata.assets.list` List Assets read - `drata.assets.update` Update Asset write **Aws connections 5** - `drata.aws_connections.create` Create AWS Connection write - `drata.aws_connections.delete` Delete AWS Connection destructive - `drata.aws_connections.get` Get AWS Connection read - `drata.aws_connections.list` List AWS Connections read - `drata.aws_connections.update` Update AWS Connection write **Azure connections 5** - `drata.azure_connections.create` Create Azure Connection write - `drata.azure_connections.delete` Delete Azure Connection destructive - `drata.azure_connections.get` Get Azure Connection read - `drata.azure_connections.list` List Azure Connections read - `drata.azure_connections.update` Update Azure Connection write **Control notes 5** - `drata.control_notes.create` Create Control Note write - `drata.control_notes.delete` Delete Control Note destructive - `drata.control_notes.get` Get Control Note read - `drata.control_notes.list` List Control Notes read - `drata.control_notes.update` Update Control Note write **Custom connections 5** - `drata.custom_connections.create` Create Custom Connection write - `drata.custom_connections.delete` Delete Custom Connection destructive - `drata.custom_connections.get` Get Custom Connection read - `drata.custom_connections.list` List Custom Connections read - `drata.custom_connections.update` Update Custom Connection write **Evidence 5** - `drata.evidence.create` Create Evidence write - `drata.evidence.delete` Delete Evidence destructive - `drata.evidence.get` Get Evidence Item read - `drata.evidence.list` List Evidence Items read - `drata.evidence.update` Update Evidence write **GCP connections 5** - `drata.gcp_connections.create` Create GCP Connection write - `drata.gcp_connections.delete` Delete GCP Connection destructive - `drata.gcp_connections.get` Get GCP Connection read - `drata.gcp_connections.list` List GCP Connections read - `drata.gcp_connections.update` Update GCP Connection write **Gitlab connections 5** - `drata.gitlab_connections.create` Create GitLab Connection write - `drata.gitlab_connections.delete` Delete GitLab Connection destructive - `drata.gitlab_connections.get` Get GitLab Connection read - `drata.gitlab_connections.list` List GitLab Connections read - `drata.gitlab_connections.update` Update GitLab Connection write **Risk notes 5** - `drata.risk_notes.create` Create Risk Note write - `drata.risk_notes.delete` Delete Risk Note destructive - `drata.risk_notes.get` Get Risk Note read - `drata.risk_notes.list` List Risk Notes read - `drata.risk_notes.update` Update Risk Note write **Scoped personnel groups 5** - `drata.scoped_personnel_groups.create` Add Personnel Group To Workspace Scope 🧪 write - `drata.scoped_personnel_groups.delete` Remove Personnel Group From Workspace Scope 🧪 destructive - `drata.scoped_personnel_groups.get_counts` Get Workspace Scoped Personnel Counts 🧪 read - `drata.scoped_personnel_groups.list` List Workspace Scoped Personnel Groups 🧪 read - `drata.scoped_personnel_groups.replace` Replace Workspace Scoped Personnel Groups 🧪 write **Control owners 4** - `drata.control_owners.create` Add Control Owner write - `drata.control_owners.delete` Delete Control Owner destructive - `drata.control_owners.list` List Control Owners read - `drata.control_owners.replace` Modify Control Owners write **Custom data records 4** - `drata.custom_data_records.create` Upsert Custom Data Records write - `drata.custom_data_records.delete` Delete Custom Connection Data Record destructive - `drata.custom_data_records.list` List Custom Data Records read - `drata.custom_data_records.update` Update Custom Data Record write **Custom hris user identities 4** - `drata.custom_hris_user_identities.delete` Delete HRIS User Identity 🧪 destructive - `drata.custom_hris_user_identities.get` Get HRIS User Identity 🧪 read - `drata.custom_hris_user_identities.list` List HRIS User Identities 🧪 read - `drata.custom_hris_user_identities.upsert_batch` Create or Update HRIS User Identities 🧪 write **Device documents 4** - `drata.device_documents.create` Upload Device Document write - `drata.device_documents.delete` Delete Device Document destructive - `drata.device_documents.get` Get Device Document read - `drata.device_documents.list` List Device Documents read **Evidence artifacts 4** - `drata.evidence_artifacts.delete` Delete Evidence Artifact destructive - `drata.evidence_artifacts.list` List Evidence Artifacts read - `drata.evidence_artifacts.perform_action` Perform Evidence Artifact Action write - `drata.evidence_artifacts.update` Update Evidence Artifact write **Infrastructure user identities 4** - `drata.infrastructure_user_identities.get` Get Infrastructure User Identity read - `drata.infrastructure_user_identities.list` List Infrastructure User Identities read - `drata.infrastructure_user_identities.list_actions` List Infrastructure User Identity Actions read - `drata.infrastructure_user_identities.perform_action` Perform Infrastructure User Identity Action write **Monitoring test tickets 4** - `drata.monitoring_test_tickets.create` Create Monitoring Test Ticket write - `drata.monitoring_test_tickets.link` Link Monitoring Test Ticket write - `drata.monitoring_test_tickets.list` List Monitoring Test Tickets read - `drata.monitoring_test_tickets.unlink` Unlink Monitoring Test Ticket destructive **Policy approval configuration 4** - `drata.policy_approval_configuration.create` Add Review Group Configuration write - `drata.policy_approval_configuration.delete` Remove Review Group Configuration destructive - `drata.policy_approval_configuration.get` Get Policy Approval Configuration read - `drata.policy_approval_configuration.update` Update Review Group Configuration write **Policy languages 4** - `drata.policy_languages.get_version` Get Policy Language Version read - `drata.policy_languages.list_for_version` List Policy Version Languages read - `drata.policy_languages.list_settings` List Policy Language Settings read - `drata.policy_languages.list_versions` List Policy Language Versions read **Policy versions 4** - `drata.policy_versions.create` Create Policy Version write - `drata.policy_versions.get` Get Policy Version read - `drata.policy_versions.list` List Policy Versions read - `drata.policy_versions.replace_file` Replace Policy Version File write **User documents 4** - `drata.user_documents.create` Upload User Document write - `drata.user_documents.delete` Delete User Document destructive - `drata.user_documents.get` Get User Document read - `drata.user_documents.list` List User Documents read **Vendor questionnaires 4** - `drata.vendor_questionnaires.get` Get Vendor Questionnaire read - `drata.vendor_questionnaires.list` List Vendor Questionnaires read - `drata.vendor_questionnaires.list_questions` List Vendor Questionnaire Questions read - `drata.vendor_questionnaires.send` Send Questionnaire to Vendor write **Vendor types 4** - `drata.vendor_types.create` Create Vendor Type write - `drata.vendor_types.delete` Delete Vendor Type destructive - `drata.vendor_types.list` List Vendor Types read - `drata.vendor_types.update` Update Vendor Type write **Version control user identities 4** - `drata.version_control_user_identities.get` Get Version Control User Identity read - `drata.version_control_user_identities.list` List Version Control User Identities read - `drata.version_control_user_identities.list_actions` List Version Control User Identity Actions read - `drata.version_control_user_identities.perform_action` Perform Version Control User Identity Action write **Compliance check exclusions 3** - `drata.compliance_check_exclusions.create_bulk` Exclude Personnel Compliance Checks write - `drata.compliance_check_exclusions.delete_bulk` Delete Personnel Compliance Check Exclusions destructive - `drata.compliance_check_exclusions.list` List Compliance Check Exclusions read **Control tickets 3** - `drata.control_tickets.link` Link Control Ticket write - `drata.control_tickets.list` List Control Tickets read - `drata.control_tickets.unlink` Unlink Control Ticket destructive **Custom data sessions 3** - `drata.custom_data_sessions.list` List Custom Data Sessions read - `drata.custom_data_sessions.perform_action` Perform Session Action write - `drata.custom_data_sessions.upload_records` Upsert Custom Data Records with Session Management write **Custom field definitions 3** - `drata.custom_field_definitions.create` Create Custom Field Definition write - `drata.custom_field_definitions.get` Get Custom Field Definition read - `drata.custom_field_definitions.list` List Custom Field Definitions read **Frameworks 3** - `drata.frameworks.create` Create Custom Framework write - `drata.frameworks.list` List Frameworks read - `drata.frameworks.update` Update Custom Framework write **Risk documents 3** - `drata.risk_documents.delete` Delete Risk Document destructive - `drata.risk_documents.get` Get Risk Document read - `drata.risk_documents.list` List Risk Documents read **Risk library 3** - `drata.risk_library.copy_to_register` Copies Risk Library Items to a Risk Register. write - `drata.risk_library.get` Get Risk Library Item by ID. read - `drata.risk_library.list` List Risk Libraries read **Roles 3** - `drata.roles.get` Get Role read - `drata.roles.list` List Roles read - `drata.roles.list_users` List Users with Role read **Audit requests 2** - `drata.audit_requests.get` Get Audit Request read - `drata.audit_requests.list` List Audit Requests read **Audits 2** - `drata.audits.get` Get Audit read - `drata.audits.list` List Audits read **Event download jobs 2** - `drata.event_download_jobs.create` Create Event PDF Download Job write - `drata.event_download_jobs.get` Get Event PDF Export read **Events 2** - `drata.events.get` Get Event read - `drata.events.list` List Events read **Procurement vendor mappings 2** - `drata.procurement_vendor_mappings.get` Get Vendor Mapping read - `drata.procurement_vendor_mappings.update` Update Vendor Mapping write **User assigned policies 2** - `drata.user_assigned_policies.acknowledge` Acknowledge User's Assigned Policy write - `drata.user_assigned_policies.list` Get User's Assigned Policy details read **Users 2** - `drata.users.get` Get User read - `drata.users.list` List Users read **Vendor documents 2** - `drata.vendor_documents.get` Get Vendor Document read - `drata.vendor_documents.list` List Vendor Documents read **Background checks 1** - `drata.background_checks.create` Create Manual Background Check write **Company 1** - `drata.company.get` Get Company read **Custom connection resources 1** - `drata.custom_connection_resources.get_attributes` Get Custom Connection Resource Attributes read **Groups 1** - `drata.groups.list` List Groups read **Uploads 1** - `drata.uploads.request_upload_url` Request Upload URL write **Workspaces 1** - `drata.workspaces.list` List Workspaces read Questions ## The Drata MCP server, answered. **Is there a Drata MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 237 Drata actions across monitoring tests, vendor security reviews, controls and devices, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Drata. **What do I need to connect Drata?** Drata API key: in Drata an admin opens Settings > API Keys > Create API Key, chooses the scopes (read and/or write…. Plus your region. The free call account { op: "connections.requirements", service: "drata" } lists exactly what to paste. **Can an AI agent delete or change things in Drata?** Only if its key allows it, and only with an explicit confirmation. 27 Drata actions are destructive, including remove Asset, remove Vendor and delete Evidence. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Drata API limit?** actionlake paces every call to the limits in the Drata service file: 500 calls a minute per connection. Repeated reads are answered from cache (123 Drata actions can be), which never reaches Drata. **What does a Drata action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (237 Drata actions page). Cache hits, searches, dry runs and calls Drata refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Drata API does it cover?** The Drata Public API V2 (OpenAPI 3.0.0) at your region's drata.com address, set when you connect. It is built from Drata's documentation as read on 23 October 2026. 237 actions in 58 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Drata data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Drata credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Drata Shares the most action names with - [Vanta 15](https://actionlake.com/connectors/vanta) - [HackerOne 8](https://actionlake.com/connectors/hackerone) - [Palo Alto Networks Cortex XDR 8](https://actionlake.com/connectors/palo-alto-networks-cortex-xdr) - [BeyondTrust Password Safe 7](https://actionlake.com/connectors/beyondtrust-password-safe) - [Cloudflare 7](https://actionlake.com/connectors/cloudflare) - [Palo Alto Networks Strata Cloud Manager / Prisma Access 6](https://actionlake.com/connectors/palo-alto-networks-strata-cloud-manager-prisma-access) Joins with, on shared entities - [ERPNext (Frappe) 5](https://actionlake.com/connectors/erpnext-frappe) - [ServiceTitan 5](https://actionlake.com/connectors/servicetitan) - [ServiceNow 4](https://actionlake.com/connectors/servicenow) - [Odoo 4](https://actionlake.com/connectors/odoo) - [Gitea 4](https://actionlake.com/connectors/gitea) - [Forgejo 4](https://actionlake.com/connectors/forgejo) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Drata; the name is the vendor's own. Counts are from the Drata service file, version 1.0.0. ## Give your agent Drata today. [Connect Drata free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/drata More: https://actionlake.com/llms.txt