Connect Claude to Vanta

Read compliance tests, controls, policies, evidence documents, frameworks, vendors, people, and monitored devices. Toolspoke puts 10 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connect View pricing

Connection: Provider REST API
Authentication: OAuth client credentials
Actions exposed: 10
Cost per call (typical): 1 credit
Adapter: Maintained by Toolspoke

Connected in three steps

1
Install Vanta
Open the marketplace in your workspace, add Vanta to the project your agents work in, and it appears on the gateway immediately.
2
Connect the credential
Authenticate with oauth client credentials. Where to get one, and what it has to be able to reach, is the next section.
3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json

{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Vanta shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code: Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop: Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp
Cursor: ~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex: ~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"
VS Code: .vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Vanta asks for

OAuth client credentials. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

Client IDRequired: Vanta → Settings → Developer Console → create a "Manage Vanta" application. The client id starts with vci_. Pick Manage Vanta, not Build Integrations: a Build Integrations app is for pushing data into another company's tenant and its scopes do not reach tests, controls or people.; vci_…
Client secretRequired: Shown once when the Manage Vanta application is created, and starts with vcs_. Note that Vanta allows only one active access token per application - issuing a new one immediately revokes the previous one - so this application should not be shared with any other integration.; vcs_…
ScopesOptional: Space-separated scopes to request, and they must be scopes the application was granted or Vanta rejects the whole exchange. vanta-api.all:read is the default and the only scope that reaches tests, controls, people and policies - Vanta publishes no narrower read scope for those. vanta-api.documents:read and vanta-api.vendors:read exist if an install only wants those two surfaces.; vanta-api.all:read

What Claude can do in Vanta

10 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads: 10Reads
Writes: 0Writes
Destructive: 0Destructive

Reads

Fetches data and changes nothing.

list_frameworks
List the compliance frameworks this Vanta account is working towards - SOC 2, ISO 27001, HIPAA and the rest - with each one's name and id. Call it first to find out which programmes exist, and to confirm the connection reaches the account at all.
list_tests
List Vanta's automated compliance tests with each one's name, category, status and the controls it maps to. This is the operation that answers "what is currently failing" - pass status "NEEDS_ATTENTION" for the tests that need work. Statuses are a single value, not a list.
get_test
Fetch one automated test by id - its name, description, category, current status, remediation guidance, and the controls and frameworks it supports. Use it after list_tests to understand why something is failing.
list_controls
List the controls in the account's compliance programme with each one's name, description, owner and the frameworks it belongs to. A control is the requirement; a test is the automated check that it holds.
get_control
Fetch one control by id - its name, description, owner, and the frameworks and requirements it satisfies. Use it to see exactly what a framework is asking for before judging whether the evidence meets it.
list_policies
List the account's written policies with each one's name, status and approval state. This is the narrower, policy-specific surface; list_documents covers evidence more broadly.
list_documents
List the evidence documents held against the compliance programme, with each one's name, status and the frameworks it supports. Vanta has no endpoint called "evidence" - evidence is modelled as documents, and this is it. Filter by framework to see what a single audit rests on.
list_vendors
List the third-party vendors tracked in the account, with each one's name, review status and risk assessment state. Use it to answer which suppliers have been reviewed and which are overdue.
list_people
List the people Vanta tracks for compliance - each with their full name, email address, employment status and job title, plus a per-person summary of onboarding, training, policy-acceptance and offboarding tasks and whether any are overdue. This is personnel data about named employees. The response is never written to the audit log, and the search argument is masked before the call is recorded, so an audit row shows that people were searched without showing who was searched for.
list_monitored_computers
List the computers Vanta monitors, each with its serial number, UDID, operating system and version, the pass or fail outcome of its screenlock, disk-encryption, password-manager and antivirus checks, and the named person who owns it. Covers devices reached through an MDM Vanta integrates with or through Vanta Device Monitor. This is employee device data tied to named owners, so the response is never written to the audit log.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else: The 10 actions above are the whole of it. A call to any other name is refused before it reaches Vanta rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It only reads: Every action here reads. Nothing this connector can do changes anything in Vanta.
It reaches no further than your credential: Toolspoke holds no access to Vanta of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Vanta: Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Vanta. An agent has to ask.
It does not smooth over provider limits: Toolspoke does not retry, queue or back off around Vanta's own rate limits. A call that Vanta refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Vanta?

10 named actions: 10 that only read. They include list_frameworks, list_tests and get_test. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Vanta connector need?

OAuth client credentials. The connector asks for client id and client secret, and optionally scopes. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the Vanta connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 10 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Vanta connector not do?

The 10 actions above are the whole of it. A call to any other name is refused before it reaches Vanta rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Every action here reads. Nothing this connector can do changes anything in Vanta. Toolspoke holds no access to Vanta of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Vanta. An agent has to ask. Toolspoke does not retry, queue or back off around Vanta's own rate limits. A call that Vanta refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Vanta's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Vanta?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.

More security connectors

Browse all of them