Vanta compliance platform operations — posture analysis, audit readiness,
vulnerability management, personnel compliance, and flexible reporting.
Complements the official vanta-mcp-plugin with analysis workflows,
direct API access for write operations, and reporting capabilities
not available in the Vanta UI.
50% compliance analysis/reporting, 30% API operations, 20% workflow orchestration.
Use this skill when users need to:
(1) Assess compliance posture across frameworks (gap analysis, control coverage,
cross-framework overlap)
(2) Prepare for audits (readiness checklist, missing evidence, policy expiry,
personnel compliance)
(3) Track and triage vulnerabilities with SLA awareness (approaching deadlines,
missed SLAs, severity breakdown)
(4) Monitor personnel compliance (overdue training, policy acceptance,
deactivated personnel in scope)
(5) Generate compliance reports and executive summaries (posture, readiness,
vulnerability SLA, personnel, custom)
(6) Perform bulk low-risk operations
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Vanta compliance platform operations — posture analysis, audit readiness,
vulnerability management, personnel compliance, and flexible reporting.
Complements the official vanta-mcp-plugin with analysis workflows,
direct API access for write operations, and reporting capabilities
not available in the Vanta UI.
50% compliance analysis/reporting, 30% API operations, 20% workflow orchestration.
Use this skill when users need to:
(1) Assess compliance posture across frameworks (gap analysis, control coverage,
cross-framework overlap)
(2) Prepare for audits (readiness checklist, missing evidence, policy expiry,
personnel compliance)
(3) Track and triage vulnerabilities with SLA awareness (approaching deadlines,
missed SLAs, severity breakdown)
(4) Monitor personnel compliance (overdue training, policy acceptance,
deactivated personnel in scope)
(5) Generate compliance reports and executive summaries (posture, readiness,
vulnerability SLA, personnel, custom)
(6) Perform bulk low-risk operations (set control owners, acknowledge SLA
misses, reactivate test entities, update person metadata)
(7) Understand risk and vendor impact on audit readiness (unmitigated risks,
stale vendor reviews, risk-control linkage)
(8) Query Vanta data that is hard to surface in the Vanta UI (cross-framework
control overlap, integration resource inventory, historical test status)
Use vanta-eu with mcp.eu.vanta.com/mcp for EU, or vanta-aus with
mcp.aus.vanta.com/mcp for AUS. Then run /mcp to authenticate via OAuth.
This gives MCP tools but not the plugin's slash commands.
Verify: Check if the tests MCP tool is available. If it responds, MCP is
configured.
MCP tools are read-only. For write operations, also configure Path B.
Path B: Client credentials (for writes or standalone use)
In Vanta, go to Settings → API → Create Application.
Select application type: Manage Vanta.
Grant scopes: vanta-api.all:read and vanta-api.all:write.
For document uploads, also grant vanta-api.documents:upload.
Save client_id and client_secret to a JSON file:
{"client_id":"...","client_secret":"..."}
Set the environment variable: VANTA_CREDENTIALS_FILE=/path/to/credentials.json
Token exchange: POST https://api.vanta.com/oauth/token with JSON body
(Content-Type: application/json).
Read references/api-patterns.md for the full OAuth flow and all available scopes.
IMPORTANT — token isolation: Vanta enforces a single active token per API
application. If the MCP plugin holds a token from the same application, requesting
a new token for writes will revoke it. Use a separate Vanta API application
for client-credentials writes.
Detection logic
IF MCP tool `tests` is available → use MCP for reads
IF VANTA_CREDENTIALS_FILE is set → use REST API for writes + fallback reads
IF neither → guide user through setup (Path A or B above)
Workflows
1. Compliance Posture Analysis
Assess overall compliance health across all frameworks.
List all frameworks. For each, retrieve controls and tests.
Aggregate pass/fail/deactivated test counts per framework.
Identify controls with failing tests — prioritize by cross-framework coverage
(a failing control that appears in 3 frameworks is higher priority than one in 1).
Compute cross-framework overlap: which controls satisfy multiple frameworks.
Output posture summary with framework-by-framework breakdown.
Read references/compliance-analysis.md before running this workflow. This is
mandatory — it contains the scoring methodology and gap identification patterns.
2. Audit Readiness Assessment
Determine readiness for a specific framework audit within a target window.
Select target framework and audit window (date range).
Retrieve all controls, tests, documents, and policies for the framework.
Check readiness criteria:
% controls with at least one passing test
% required documents uploaded and current (not expired)
% policies approved and accepted by employees
No CRITICAL/HIGH vulnerabilities past SLA deadline
All personnel have completed required security training
Risk register reviewed within last 90 days
Vendor security reviews current for in-scope vendors
Flag deactivated personnel still appearing in compliance scope.
For metadata corrections: update person records with user confirmation.
Output personnel compliance report.
Read references/report-templates.md for the personnel compliance report template.
5. Flexible Reporting
Generate custom reports from any combination of Vanta data.
User describes what they want to know.
Select appropriate endpoints or MCP tools based on the question.
Apply filters, cursor pagination, and aggregation as needed.
Format results into a structured report.
Read references/report-templates.md for report templates and custom report
guidance. Read references/api-manage-vanta.md for available endpoints and
filter parameters.
6. Risk & Vendor Impact on Audit Readiness
Assess how risk scenarios and vendor relationships affect audit posture.
List risk scenarios. Identify unmitigated high-severity risks.
Check risk-control linkage: are high-severity risks covered by passing controls?
List vendors in framework scope. Flag stale security reviews (last review > 1 year).
Assess vendor risk attributes and their impact on controls.
Output risk/vendor impact summary scoped to the target framework.
Note: Full risk management (create, score, approve, treat) and full vendor
management (create, assess, findings) are future enhancements. This workflow
covers read-only analysis of existing risk and vendor data.
Write Operations Reference
All write operations require explicit user confirmation before execution.
Present the operation details, ask for confirmation, then execute.
Operation
Method & Endpoint
Key Parameters
Set control owner
POST /v1/controls/{id}/set-owner
userId (person ID)
Acknowledge vulnerability SLA miss
POST /v1/vulnerability-remediations/acknowledge-sla-miss
updates[] with id + slaViolationComment (batch 1-50)
Reactivate test entity
POST /v1/tests/{testId}/entities/{entityId}/reactivate
Full risk management — create, score, approve, cancel risk scenarios with treatment plans
Linear integration — create Linear issues from failing tests or overdue vulnerabilities
Document upload workflows — evidence management with approval workflows
Auditor API workflows — separate application type with audit-specific scopes and queries
Questionnaire assistance — leverage QAuto patterns for vendor questionnaires
Webhook delta sync — use changedSinceDate parameter for incremental data polling
Trust Center management — settings, access requests, content, subprocessor lists
Runtime Reinforcement
These rules are critical — follow them throughout every workflow:
MCP first, API fallback. Always use MCP tools for reads when available.
Fall back to REST API only when MCP tools are unavailable or for write operations.
All writes require confirmation. Never execute a write operation without
presenting the details and receiving explicit user confirmation.
Single active token. Never request a new token while one is in-flight.
Use a separate API application for client-credentials writes if MCP plugin is active.
Distinguish "no data" from "API error." An empty result set means no
matching records. A non-200 response means the query failed — report the error,
do not report "none found."
