---
title: "Vanta MCP server for AI agents - actionlake"
description: "Give Claude 338 Vanta actions through one MCP server: controls, groups, people. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/vanta
updated: 2026-10-22
---

Connectors · Identity & security

# Vanta MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Vanta and the rest of your systems. It gives your agent 338 Vanta actions (169 reads, 124 writes and 45 that wait for a confirmation) and holds the Vanta credential itself, so the agent never does. It paces Vanta's limits and records every call.

[Connect Vanta free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "vanta.policies.list",
  intent: "check which Vanta account is connected"
}
# List policies · read · 1 upstream call
```

- 338 actions in one signed file
- 169 read look, never change
- 124 write create and update
- 45 wait for a yes destructive, confirmed first

Set up

## Connect Vanta in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Vanta.
   Session login. actionlake opens the session and renews it when it expires. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `client_id` Vanta application client ID (vci_…)
   - `client_secret` Vanta application client secret (vcs_…), shown in the Developer Console
   - `host` Where your Vanta lives: your host
   - `scopes` Your Vanta scopes
   ```
   account { op: "connections.requirements", service: "vanta" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "vanta.policies.list" }
   # list policies · read · 1 upstream call
   check { action: "vanta.documents.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Vanta at a glance

**Sign-in**

Session login. actionlake opens the session and renews it when it expires.

**You provide**

`client_id` `client_secret`

**Setup fields**

`host` `scopes`

**Limits we pace to**

50 calls a minute, per connection

**API covered**

Vanta API v1 (Manage Vanta, Auditor and Build Integrations OpenAPI 3.0)`api.vanta.com/v1`

**Built from**

Vanta's documentation, read 22 October 2026[developer.vanta.com](https://developer.vanta.com/reference/manage-vanta.json) [developer.vanta.com](https://developer.vanta.com/reference/auditor-api.json) [developer.vanta.com](https://developer.vanta.com/reference/build-integrations.json)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

168 of 169 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

5, so ask can line Vanta up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Vanta.

338 actions in 125 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **169** read look, never change
- **124** write create and update
- **45** destructive wait for a confirmation

1. ### Controls
   9
   2 read · 6 write · 1 destructive
   List controls · Create custom control · Update a control's metadata · Get control by an ID
2. ### Groups
   8
   2 read · 4 write · 2 destructive
   List groups · Get group by ID · Create group · Import IdP groups
3. ### People
   8
   2 read · 5 write · 1 destructive
   List people · Remove leave information · Get person by ID · Mark as not people
4. ### Trust center control categories
   8
   2 read · 5 write · 1 destructive
   Add Trust Center control category · List Trust Center control categories · Get Trust Center control category · Reorder Trust Center control categories
5. ### Audit information requests
   7
   2 read · 4 write · 1 destructive
   Create a new information request · List information requests for an audit · Accept evidence for an information request · Flag evidence for an information request
6. ### Knowledge base resources
   7
   2 read · 4 write · 1 destructive
   Create webpage resource · List Knowledge Base resources · Get Knowledge Base resource · Update document resource
7. ### Questionnaires
   7
   2 read · 4 write · 1 destructive
   Create website questionnaire · List questionnaires · Approve questionnaire · Complete questionnaire
8. ### Trust center updates
   7
   2 read · 4 write · 1 destructive
   Create Trust Center update · List Trust Center updates · Send Trust Center update notifications to all subscribers · Send Trust Center update notifications to specific subscribers

**117 more areas · 277 actions**

- Documents **6**
- Knowledge base answers **6**
- Risk scenarios **6**
- Trust center controls **6**
- Trust center viewers **6**
- Audit information request comments **5**
- Audits **5**
- Customer trust accounts **5**
- Trust center faqs **5**
- Trust center resource categories **5**
- Trust center subprocessors **5**
- Trust center subscriber groups **5**
- Trust center subscribers **5**
- Vendors **5**
- Audit control comments **4**
- Audit evidence **4**
- Frameworks **4**
- Integration resources **4**
- Questionnaire responses **4**
- Risk scenario controls **4**
- Trust center access requests **4**
- Trust center compliance frameworks **4**
- Trust center faq categories **4**
- Trust center resources **4**
- Vendor findings **4**
- Vulnerabilities **4**
- Audit controls **3**
- Audit information request evidence **3**
- Contracts **3**
- Document links **3**
- Group people **3**
- Risk scenario mappings accounts **3**
- Risk scenario mappings custom assets **3**
- Risk scenario mappings integrations **3**
- Risk scenario mappings issues **3**
- Risk scenario mappings vendor findings **3**
- Test entities **3**
- Audit evidence comments **2**
- Audit organization **2**
- Business units **2**
- Control documents **2**
- Control tests **2**
- Discovered vendors **2**
- Document uploads **2**
- Framework exports **2**
- Integration push API endpoint vulnerability connectors **2**
- Integration push background check connector **2**
- Integration push custom resource **2**
- Integration push macos user computer **2**
- Integration push package vulnerability connectors **2**
- Integration push secret **2**
- Integration push security task **2**
- Integration push static analysis code vulnerability connectors **2**
- Integration push user account **2**
- Integration push user security training status **2**
- Integration push vulnerable component **2**
- Integration push windows user computer **2**
- Integration resource kinds **2**
- Integrations **2**
- Issues **2**
- Monitored computers **2**
- Personnel notification settings **2**
- Policies **2**
- Program scopes **2**
- Questionnaire exports **2**
- Tag categories **2**
- Tag category product contexts **2**
- Tests **2**
- Trust center chatbot conversations **2**
- Trust center data collected **2**
- Trust centers **2**
- Users **2**
- Vendor assessment types **2**
- Vendor assessments **2**
- Vendor security review documents **2**
- Vendor security reviews **2**
- Vulnerability remediations **2**
- Vulnerable assets **2**
- Audit assets code changes **1**
- Audit comments **1**
- Audit control information requests **1**
- Audit evidence urls **1**
- Audit information request activity **1**
- Audit integrations **1**
- Audit issues items **1**
- Audit issues snapshots **1**
- Audit managed vendors **1**
- Audit monitored computers **1**
- Audit people **1**
- Audit personnel account access **1**
- Audit personnel account access services **1**
- Audit personnel groups **1**
- Audit personnel people **1**
- Audit risks **1**
- Audit risks snapshots **1**
- Audit vendors **1**
- Audit vulnerabilities **1**
- Audit vulnerability remediations **1**
- Audit vulnerable assets **1**
- Auditors **1**
- Control library **1**
- Custom assets **1**
- Customer trust deletion requests **1**
- Deactivated controls **1**
- Discovered vendor accounts **1**
- Document controls **1**
- Event logs **1**
- Framework controls **1**
- Importable idp groups **1**
- Organization **1**
- Questionnaire assignable users **1**
- Risk scenario mappings enterprise risk **1**
- Trust center activity **1**
- Trust center historical access requests **1**
- Trust center videos **1**
- Vendor documents **1**
- Vendor risk attributes **1**

Top actions

## The Vanta API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 24 of Vanta's 24 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `vanta.policies.list` List policies | List policies. | read | `security.policy.list` 36 connectors |
| `vanta.users.list` List active users | List active users. | read | `identity.user.list` 474 connectors |
| `vanta.groups.list` List groups | List groups. | read | `identity.group.list` 262 connectors |
| `vanta.documents.list` List documents | List documents. | read | `content.document.list` 28 connectors |
| `vanta.policies.get` Get policy by ID | Get policy by ID. | read | `security.policy.get` 30 connectors |
| `vanta.users.get` Get user by ID | Get user by ID. | read | `identity.user.get` 399 connectors |
| `vanta.documents.create` Create a custom document | Create a custom document. | write | `content.document.create` 29 connectors |
| `vanta.event_logs.list` List event logs | List event logs. | read | `security.audit_log.list` 69 connectors |
| `vanta.groups.get` Get group by ID | Get group by ID. | read | `identity.group.get` 212 connectors |
| `vanta.documents.delete` Delete document by ID | Delete document by ID. | destructive | `content.document.delete` 28 connectors |
| `vanta.controls.create` Create custom control | Create custom control. | write | `security.control.create` 3 connectors |
| `vanta.risk_scenarios.create` Create risk scenario | Create risk scenario. | write | `security.risk.create` 3 connectors |

Try it

## Prompts to paste into Claude.

Each one names the Vanta actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Who has access in Vanta? List every user and their role.
   calls `vanta.users.list`
2. Write write
   Create a custom document in Vanta. Show me exactly what you will send before you save it.
   calls `vanta.documents.create`

Governance for Vanta

## Destructive actions wait for a yes.

45 Vanta actions are destructive. The first 10:

- Delete document by ID `vanta.documents.delete`
- Deactivates a control `vanta.controls.delete`
- Delete group `vanta.groups.delete`
- Delete vendor by ID `vanta.vendors.delete`
- Offboard people `vanta.people.offboard`
- Delete contract `vanta.contracts.delete`
- Delete a custom framework `vanta.frameworks.delete`
- Remove person from a group `vanta.group_people.delete`
- Remove control from test mapping `vanta.control_tests.delete`
- Remove people from group `vanta.groups.remove_people`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do vanta.documents.delete confirm_policy: **human**

Delete document by ID?

**intent:** the user asked me to delete document by ID

run suspended · waiting for a named person · key _vanta-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "vanta-agent",
  allowed_actions: ["vanta.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "vanta.documents.delete", approver: "lead@example.com" },
    { match: "vanta.controls.delete", approver: "lead@example.com" },
    { match: "vanta.groups.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Vanta only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Vanta costs on actionlake.

Every Vanta action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Vanta refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 338 Vanta actions
- 338 actions page each page of a long list is one call
- 168 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Vanta action.

338 actions by area: the id your agent calls, what it does, and its effect.

**Controls 9**

- `vanta.controls.create` Create custom control write
- `vanta.controls.get` Get control by an ID read
- `vanta.controls.list` List controls read
- `vanta.controls.update` Update a control's metadata write
- `vanta.controls.add_document` Add control to document mapping write
- `vanta.controls.add_from_library` Add control from Vanta library write
- and 3 more in this area

**Groups 8**

- `vanta.groups.create` Create group write
- `vanta.groups.get` Get group by ID read
- `vanta.groups.import_from_idp` Import IdP groups write
- `vanta.groups.list` List groups read
- `vanta.groups.add_people` Add people to group write
- `vanta.groups.delete` Delete group destructive
- and 2 more in this area

**People 8**

- `vanta.people.clear_leave` Remove leave information write
- `vanta.people.get` Get person by ID read
- `vanta.people.list` List people read
- `vanta.people.mark_as_not_people` Mark as not people write
- `vanta.people.mark_as_people` Mark as people write
- `vanta.people.offboard` Offboard people destructive
- and 2 more in this area

**Trust center control categories 8**

- `vanta.trust_center_control_categories.create` Add Trust Center control category write
- `vanta.trust_center_control_categories.get` Get Trust Center control category read
- `vanta.trust_center_control_categories.list` List Trust Center control categories read
- `vanta.trust_center_control_categories.reorder` Reorder Trust Center control categories write
- `vanta.trust_center_control_categories.delete` Delete Trust Center control category destructive
- `vanta.trust_center_control_categories.reorder_controls` Reorder controls in a Trust Center control category write
- and 2 more in this area

**Audit information requests 7**

- `vanta.audit_information_requests.accept_evidence` Accept evidence for an information request write
- `vanta.audit_information_requests.create` Create a new information request write
- `vanta.audit_information_requests.flag_evidence` Flag evidence for an information request write
- `vanta.audit_information_requests.list` List information requests for an audit read
- `vanta.audit_information_requests.delete` Delete an information request for an audit destructive
- `vanta.audit_information_requests.get` Get an information request by ID read
- and 1 more in this area

**Knowledge base resources 7**

- `vanta.knowledge_base_resources.create_webpage` Create webpage resource write
- `vanta.knowledge_base_resources.get` Get Knowledge Base resource read
- `vanta.knowledge_base_resources.list` List Knowledge Base resources read
- `vanta.knowledge_base_resources.update_document` Update document resource write
- `vanta.knowledge_base_resources.delete` Delete Knowledge Base resource destructive
- `vanta.knowledge_base_resources.update_webpage` Update webpage resource write
- and 1 more in this area

**Questionnaires 7**

- `vanta.questionnaires.approve` Approve questionnaire write
- `vanta.questionnaires.complete` Complete questionnaire write
- `vanta.questionnaires.create_from_website` Create website questionnaire write
- `vanta.questionnaires.list` List questionnaires read
- `vanta.questionnaires.delete` Delete questionnaire destructive
- `vanta.questionnaires.get` Get questionnaire by ID read
- and 1 more in this area

**Trust center updates 7**

- `vanta.trust_center_updates.create` Create Trust Center update write
- `vanta.trust_center_updates.list` List Trust Center updates read
- `vanta.trust_center_updates.notify_all_subscribers` Send Trust Center update notifications to all subscribers write
- `vanta.trust_center_updates.notify_specific_subscribers` Send Trust Center update notifications to specific subscribers write
- `vanta.trust_center_updates.delete` Delete Trust Center update destructive
- `vanta.trust_center_updates.get` Get Trust Center update read
- and 1 more in this area

**Documents 6**

- `vanta.documents.create` Create a custom document write
- `vanta.documents.delete` Delete document by ID destructive
- `vanta.documents.get` Get document by ID read
- `vanta.documents.list` List documents read
- `vanta.documents.set_owner` Set document owner write
- `vanta.documents.submit` Submit document collection write

**Knowledge base answers 6**

- `vanta.knowledge_base_answers.create` Create Answer Library entry write
- `vanta.knowledge_base_answers.get` Get Answer Library entry read
- `vanta.knowledge_base_answers.list` List Answer Library entries read
- `vanta.knowledge_base_answers.update` Update Answer Library entry write
- `vanta.knowledge_base_answers.delete` Delete Answer Library entry destructive
- `vanta.knowledge_base_answers.verify` Verify Answer Library entry write

**Risk scenarios 6**

- `vanta.risk_scenarios.create` Create risk scenario write
- `vanta.risk_scenarios.get` Get risk scenario by ID read
- `vanta.risk_scenarios.list` List risk scenarios read
- `vanta.risk_scenarios.update` Update risk scenario write
- `vanta.risk_scenarios.cancel_approval_request` Cancel risk scenario approval request write
- `vanta.risk_scenarios.submit_for_approval` Submit risk scenario for approval write

**Trust center controls 6**

- `vanta.trust_center_controls.add_tags` Bulk add tags to Trust Center controls write
- `vanta.trust_center_controls.create` Add Trust Center control write
- `vanta.trust_center_controls.get` Get Trust Center control read
- `vanta.trust_center_controls.list` List Trust Center controls read
- `vanta.trust_center_controls.delete` Delete Trust Center control destructive
- `vanta.trust_center_controls.remove_tags` Bulk remove tags from Trust Center controls destructive

**Trust center viewers 6**

- `vanta.trust_center_viewers.create` Add Trust Center viewer write
- `vanta.trust_center_viewers.get` Get Trust Center viewer read
- `vanta.trust_center_viewers.list` List Trust Center viewers read
- `vanta.trust_center_viewers.send_invite_reminder` Send Trust Center viewer invite reminder write
- `vanta.trust_center_viewers.delete` Remove Trust Center viewer destructive
- `vanta.trust_center_viewers.update` Update Trust Center viewer write

**Audit information request comments 5**

- `vanta.audit_information_request_comments.create` Create a comment for an information request write
- `vanta.audit_information_request_comments.get` Get an information request comment by ID read
- `vanta.audit_information_request_comments.list` List comments for an information request read
- `vanta.audit_information_request_comments.update` Update a comment for an information request write
- `vanta.audit_information_request_comments.delete` Delete a comment for an information request destructive

**Audits 5**

- `vanta.audits.duplicate` Duplicate an IRL audit write
- `vanta.audits.get` Get audit by ID read
- `vanta.audits.get_framework_codes` Get framework codes for an audit read
- `vanta.audits.list` List audits read
- `vanta.audits.share_information_request_list` Share information request list with customer write

**Customer trust accounts 5**

- `vanta.customer_trust_accounts.create` Create customer trust account write
- `vanta.customer_trust_accounts.get` Get customer trust account read
- `vanta.customer_trust_accounts.list` List customer trust accounts read
- `vanta.customer_trust_accounts.update` Update customer trust account write
- `vanta.customer_trust_accounts.delete` Delete customer trust account destructive

**Trust center faqs 5**

- `vanta.trust_center_faqs.create` Create Trust Center FAQ write
- `vanta.trust_center_faqs.get` Get Trust Center FAQ read
- `vanta.trust_center_faqs.list` List Trust Center FAQs read
- `vanta.trust_center_faqs.update` Update Trust Center FAQ write
- `vanta.trust_center_faqs.delete` Delete Trust Center FAQ destructive

**Trust center resource categories 5**

- `vanta.trust_center_resource_categories.create` Add Trust Center resource category write
- `vanta.trust_center_resource_categories.list` List Trust Center resource categories read
- `vanta.trust_center_resource_categories.reorder` Reorder Trust Center resource categories write
- `vanta.trust_center_resource_categories.update` Update Trust Center resource category write
- `vanta.trust_center_resource_categories.delete` Delete Trust Center resource category destructive

**Trust center subprocessors 5**

- `vanta.trust_center_subprocessors.create` Create Trust Center subprocessor write
- `vanta.trust_center_subprocessors.get` Get Trust Center subprocessor read
- `vanta.trust_center_subprocessors.list` List Trust Center subprocessors read
- `vanta.trust_center_subprocessors.update` Update Trust Center subprocessor write
- `vanta.trust_center_subprocessors.delete` Delete Trust Center subprocessor destructive

**Trust center subscriber groups 5**

- `vanta.trust_center_subscriber_groups.create` Create Trust Center subscriber group write
- `vanta.trust_center_subscriber_groups.get` Get Trust Center subscriber group read
- `vanta.trust_center_subscriber_groups.list` List Trust Center subscriber groups read
- `vanta.trust_center_subscriber_groups.update` Edit Trust Center subscriber group write
- `vanta.trust_center_subscriber_groups.delete` Delete Trust Center subscriber group destructive

**Trust center subscribers 5**

- `vanta.trust_center_subscribers.create` Create Trust Center subscriber write
- `vanta.trust_center_subscribers.get` Get Trust Center subscriber read
- `vanta.trust_center_subscribers.list` List Trust Center subscribers read
- `vanta.trust_center_subscribers.set_groups` Set groups for a Trust Center subscriber write
- `vanta.trust_center_subscribers.delete` Delete Trust Center subscriber destructive

**Vendors 5**

- `vanta.vendors.create` Create a vendor write
- `vanta.vendors.get` Get vendor by ID read
- `vanta.vendors.list` List vendors read
- `vanta.vendors.update` Update vendor by ID write
- `vanta.vendors.delete` Delete vendor by ID destructive

**Audit control comments 4**

- `vanta.audit_control_comments.create` Create a comment for a control within an audit write
- `vanta.audit_control_comments.delete` Delete a comment for a control within an audit destructive
- `vanta.audit_control_comments.list` List comments for a control within an audit read
- `vanta.audit_control_comments.update` Update a comment for a control within an audit write

**Audit evidence 4**

- `vanta.audit_evidence.create_custom_request` Create a custom evidence request for an audit write
- `vanta.audit_evidence.get` Get an audit evidence item by ID read
- `vanta.audit_evidence.list` List audit evidence read
- `vanta.audit_evidence.update` Update audit evidence write

**Frameworks 4**

- `vanta.frameworks.delete` Delete a custom framework destructive
- `vanta.frameworks.get` Get framework by ID read
- `vanta.frameworks.list` List available frameworks read
- `vanta.frameworks.set_variants` Set framework control sets write

**Integration resources 4**

- `vanta.integration_resources.get` Get resource by ID read
- `vanta.integration_resources.list` List resources read
- `vanta.integration_resources.update` Update resource metadata write
- `vanta.integration_resources.update_many` Update resource metadata write

**Questionnaire responses 4**

- `vanta.questionnaire_responses.get` Get questionnaire response read
- `vanta.questionnaire_responses.list` List questionnaire responses read
- `vanta.questionnaire_responses.set_owner` Update questionnaire response owner write
- `vanta.questionnaire_responses.update` Update questionnaire response content write

**Risk scenario controls 4**

- `vanta.risk_scenario_controls.create` Add a control to a risk scenario write
- `vanta.risk_scenario_controls.delete` Remove a control from a risk scenario destructive
- `vanta.risk_scenario_controls.list` List risk scenario controls read
- `vanta.risk_scenario_controls.update` Change a risk scenario control's controlType write

**Trust center access requests 4**

- `vanta.trust_center_access_requests.approve` Approve Trust Center access request write
- `vanta.trust_center_access_requests.deny` Deny Trust Center access request write
- `vanta.trust_center_access_requests.get` Get Trust Center access request read
- `vanta.trust_center_access_requests.list` List Trust Center access requests read

**Trust center compliance frameworks 4**

- `vanta.trust_center_compliance_frameworks.create` Create Trust Center compliance framework write
- `vanta.trust_center_compliance_frameworks.delete` Delete Trust Center compliance framework destructive
- `vanta.trust_center_compliance_frameworks.list` List Trust Center compliance frameworks read
- `vanta.trust_center_compliance_frameworks.update` Update Trust Center compliance framework write

Trust center faq categories **4** Trust center resources **4** Vendor findings **4** Vulnerabilities **4** Audit controls **3** Audit information request evidence **3** Contracts **3** Document links **3** Group people **3** Risk scenario mappings accounts **3** Risk scenario mappings custom assets **3** Risk scenario mappings integrations **3** Risk scenario mappings issues **3** Risk scenario mappings vendor findings **3** Test entities **3** Audit evidence comments **2** Audit organization **2** Business units **2** Control documents **2** Control tests **2** Discovered vendors **2** Document uploads **2** Framework exports **2** Integration push API endpoint vulnerability connectors **2** Integration push background check connector **2** Integration push custom resource **2** Integration push macos user computer **2** Integration push package vulnerability connectors **2** Integration push secret **2** Integration push security task **2** Integration push static analysis code vulnerability connectors **2** Integration push user account **2** Integration push user security training status **2** Integration push vulnerable component **2** Integration push windows user computer **2** Integration resource kinds **2** Integrations **2** Issues **2** Monitored computers **2** Personnel notification settings **2** Policies **2** Program scopes **2** Questionnaire exports **2** Tag categories **2** Tag category product contexts **2** Tests **2** Trust center chatbot conversations **2** Trust center data collected **2** Trust centers **2** Users **2** Vendor assessment types **2** Vendor assessments **2** Vendor security review documents **2** Vendor security reviews **2** Vulnerability remediations **2** Vulnerable assets **2** Audit assets code changes **1** Audit comments **1** Audit control information requests **1** Audit evidence urls **1** Audit information request activity **1** Audit integrations **1** Audit issues items **1** Audit issues snapshots **1** Audit managed vendors **1** Audit monitored computers **1** Audit people **1** Audit personnel account access **1** Audit personnel account access services **1** Audit personnel groups **1** Audit personnel people **1** Audit risks **1** Audit risks snapshots **1** Audit vendors **1** Audit vulnerabilities **1** Audit vulnerability remediations **1** Audit vulnerable assets **1** Auditors **1** Control library **1** Custom assets **1** Customer trust deletion requests **1** Deactivated controls **1** Discovered vendor accounts **1** Document controls **1** Event logs **1** Framework controls **1** Importable idp groups **1** Organization **1** Questionnaire assignable users **1** Risk scenario mappings enterprise risk **1** Trust center activity **1** Trust center historical access requests **1** Trust center videos **1** Vendor documents **1** Vendor risk attributes **1**

This index shows a sample of each area. All 338 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The Vanta MCP server, answered.

**Is there a Vanta MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 338 Vanta actions across controls, groups, people and trust center control categories, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Vanta.

**What do I need to connect Vanta?**

Vanta application client ID (vci_…) and Vanta application client secret (vcs_…), shown in the Developer Console. Plus your host and your scopes. The free call account { op: "connections.requirements", service: "vanta" } lists exactly what to paste.

**Can an AI agent delete or change things in Vanta?**

Only if its key allows it, and only with an explicit confirmation. 45 Vanta actions are destructive, including delete document by ID, deactivates a control and delete group. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Vanta API limit?**

actionlake paces every call to the limits in the Vanta service file: 50 calls a minute per connection. Repeated reads are answered from cache (168 Vanta actions can be), which never reaches Vanta.

**What does a Vanta action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (338 Vanta actions page). Cache hits, searches, dry runs and calls Vanta refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Vanta API does it cover?**

The Vanta API v1 (Manage Vanta, Auditor and Build Integrations OpenAPI 3.0) at api.vanta.com/v1 by default, or the base URL set when you connect. It is built from Vanta's documentation as read on 22 October 2026. 338 actions in 125 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my Vanta data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Vanta credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Vanta

Shares the most action names with

- [Drata 15](https://actionlake.com/connectors/drata)
- [HackerOne 7](https://actionlake.com/connectors/hackerone)
- [Aikido Security 6](https://actionlake.com/connectors/aikido-security)
- [Microsoft Graph Security (Defender XDR) 6](https://actionlake.com/connectors/microsoft-graph-security-defender-xdr)
- [Cloudflare 6](https://actionlake.com/connectors/cloudflare)
- [Zscaler Internet Access (ZIA) 4](https://actionlake.com/connectors/zscaler-internet-access-zia)

Joins with, on shared entities

- [Fortinet FortiGate 3](https://actionlake.com/connectors/fortinet-fortigate)
- [TOPdesk 3](https://actionlake.com/connectors/topdesk)
- [Sophos Central 3](https://actionlake.com/connectors/sophos-central)
- [Filevine 3](https://actionlake.com/connectors/filevine)
- [DocuWare 3](https://actionlake.com/connectors/docuware)
- [Lucid 3](https://actionlake.com/connectors/lucid)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Vanta; the name is the vendor's own. Counts are from the Vanta service file, version 1.0.0.

## Give your agent Vanta today.

[Connect Vanta free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/vanta
More: https://actionlake.com/llms.txt