Vanta is a compliance-management platform for security frameworks, evidence, and risk workflows. Its hosted MCP server authenticates through OAuth as the Vanta user who signs in; do not invent a separate API-credential path for that server.
This guide prepares Vanta for an MCP client. The Vanta agent template is separate from Vanta-side authorization.
Choose a connection method
Vanta's hosted MCP server uses OAuth as the Vanta user who signs in; it does not use a bearer-token alternative. See Vanta's MCP server documentation for the current endpoint, authorization, and tool behavior.
Recommended: OAuth with workspace approval
Use Vanta's OAuth flow when the server supports it. Start with a dedicated compliance test identity and confirm with a Vanta administrator which framework, people, and evidence data it may access.
- Start the MCP client's Vanta authorization flow and sign in to the intended Vanta workspace.
- Ask a Vanta workspace administrator to approve the app if the consent screen or policy requires it.
- Review requested scopes and decline write scopes for a read-only evidence or controls use case.
- Approve the connection as the dedicated identity.
- Retrieve a known test control or evidence item and verify the identity cannot administer integrations or access an unrelated workspace.
Verify Vanta MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Vanta MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Vanta boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If OAuth returns to the client but access is denied, verify the selected Vanta workspace and the administrator's app-approval policy. Do not retry with an owner account simply to bypass a role restriction.
Next steps
Deploy the Vanta agent template to create a governed agent in Dome that can work with the authorized compliance data, with the template's included model, tools, and rules.
