testsLABSCO SUMMARY
The compliance backlog, read where the fix would be written.
Listing failing tests is the easy half; the useful half is that the agent has your repository open at the same time, so a failing check can become an infrastructure-as-code change rather than a ticket. The remote server is in beta and Admin-only, which makes it a lead's tool rather than one you hand to the whole team.
What it is
Vanta's remote server — https://mcp.vanta.com/mcp for US tenants, with separate Europe and Australia endpoints — letting Claude Code, Cursor, Perplexity, Codex and other MCP clients call the Vanta API on your behalf.
What you get
- Failing compliance tests listed, with which entities are out of scope and the context needed to fix them
- Controls browsed with their framework mappings, associated tests and linked evidence documents
- Vendor risk work: vendors reviewed, security assessments run, risk attributes and compliance documentation tracked
- Vulnerable assets surfaced and remediation progress monitored
- Policy documents listed, downloaded and uploaded across the program
- Framework requirements enumerated and coverage gaps identified across SOC 2, ISO 27001 and more
Requirements
Vanta Admin — the server is not accessible to non-Admin users — and one of the supported AI tools. Setup is a URL plus an OAuth sign-in, with no key to paste. The Claude Code plugin bundles the same server with the /vanta:fix-test and /vanta:list-tests commands and a remediation skill.
Setup effort
Add the hosted endpoint, then sign in — paste it into your client, then approve the OAuth sign-in
USE CASES
01
Clearing a failing SOC 2 test
List what is failing, inspect which resources are out of scope, and get a remediation plan for the one you picked.
02
Fixing it in the repository, not the ticket
In Claude Code, /vanta:fix-test generates the code change for a failing test and opens a draft pull request when your infrastructure is managed as code.
03
Answering an auditor's question about a control
Browse the control, its framework mappings, and the evidence documents already linked to it.
04
Reviewing a vendor before it goes live
Pull the vendor record, run the security assessment, and track its compliance documentation.
05
Finding where a framework is not covered
Enumerate the requirements and see which of them nothing maps to yet.
14 tools
Listed in project docs. Your client may show a different list.
list_test_entitiescontrolslist_control_testslist_control_documentsdocumentsdocument_resourcesintegrationsintegration_resourcesframeworkslist_framework_controlspeoplerisksvulnerabilitiesBEFORE YOU INSTALL
What to know first
Tools you get
14 tools named in the project's documentation.
Requires
A Vanta Admin account
INSTALLATION
Connect your client
Server setup
ENDPOINT URL
https://mcp.vanta.com/mcpAdd this hosted endpoint to your MCP client, then sign in.
MCP Clients
Claude Code — remote
CLAUDE CODE — REMOTE · TERMINAL
claude mcp add --transport http vanta https://mcp.vanta.com/mcpClaude Code — plugin
CLAUDE CODE — PLUGIN · IN CLIENT
/plugin marketplace update anthropics/claude-plugins-official
/plugin install vanta-mcp-plugin@claude-plugins-official
/reload-pluginsCursor — remote
CURSOR — REMOTE · JSON
{
"mcpServers": {
"vanta": {
"url": "https://mcp.vanta.com/mcp"
}
}
}Perplexity
In Perplexity, set up a new remote custom connector.
For the URL, enter https://mcp.vanta.com/mcp (or your regional endpoint: https://mcp.eu.vanta.com/mcp for Europe, https://mcp.aus.vanta.com/mcp for Australia).
For Authentication, select OAuth and complete the authorization flow.
Claude Cowork
In Claude Cowork, add the Vanta plugin from the plugin directory.
Under Manage Plugins → Connectors, install the Vanta MCP server as a custom connector using the URL for your region: https://mcp.vanta.com/mcp (US), https://mcp.eu.vanta.com/mcp (Europe) or https://mcp.aus.vanta.com/mcp (Australia).
Complete the OAuth flow when prompted.
