Vanta MCP: Troubleshooting and FAQ

The Vanta MCP works with any AI tool that supports remote MCP servers, including Claude, Cursor, Perplexity, and Codex. If your tool supports MCP, it should work. Check the Connecting to Vanta MCP article for setup instructions specific to your tool.

Confirm you authorized the correct permissions when you connected. The MCP requires at least read access to your Vanta account. If you need write actions (like creating risks or uploading policies), you'll need to re-authorize with write permissions enabled.

Make sure you're querying something that exists in your account. If your Vanta account has no vendors, for example, a vendor query will return empty. That's expected, not an error.

Try a simple test prompt first: "List the compliance frameworks in my Vanta account." If that returns data, your connection is working and the issue is likely with the specific query.

The fix for most connection and authentication issues is the same: remove the existing MCP connection in your AI tool and re-add it. This starts a fresh OAuth flow and issues a new token. If that doesn’t resolve it, check the following:

Common causes of a connection that worked and then stopped: expired session, a change to your Vanta account role or permissions, or an AI tool update that affected MCP handling.

The MCP reflects your Vanta account's current state, which depends on how recently your integrations have synced. If a test result or control status looks stale, check whether the relevant integration is connected and syncing in Vanta > Integrations. Data is only as fresh as your last successful sync.

The MCP only returns data for frameworks that are active in your Vanta account. If you're asking about SOC 2 but haven't set it up in Vanta, there's nothing to return. Confirm the framework is active under Vanta > Frameworks.

Only vendors that have been added to Vanta will appear in a standard vendor query. If you're missing vendors, they may not have been formally added to your program yet, but they may still appear as discovered vendors. Try asking specifically for "discovered vendors" or "discovered vendor accounts" to see what Vanta has detected in your environment that hasn't been formally onboarded.

Vulnerability data in Vanta is populated by connected integrations (such as vulnerability scanners or cloud provider security tools). If no relevant integrations are connected, the vulnerability list will be empty. Check your integrations in Vanta > Integrations to confirm the right sources are connected and syncing.

Questionnaires and impact assessments only appear if they've been created in your Vanta account. If your program hasn't used these features, results will be empty. Check Vanta > Questionnaires and Vanta > Assessments to confirm whether any exist.

Control status depends on automated test results and manually uploaded evidence. If a control was remediated but the underlying test hasn't re-run yet, or evidence hasn't been uploaded, it may still show as failing. Check the control in the Vanta UI to confirm its evidence and test status.

By default, queries may return a subset of results. Try being more specific: ask for issues by status (open, in progress, resolved), by framework, or by severity. If you believe data is genuinely missing, check whether your Vanta role has the correct permissions to access all issue types.

Write actions include: creating or updating a risk, updating an issue's status, and uploading a policy document.

Wait several minutes for the change to propagate, then refresh your Vanta browser session. If the change still isn't showing after a few minutes, the write action may have returned an error silently. Ask your AI tool to confirm whether the action completed successfully.

Yes. The Vanta MCP is now limited to Organization Admins. This means agent-driven workflows through MCP are only available to users with admin permissions in your Vanta account.

Yes, but each person should connect individually using their own Vanta account. This ensures that MCP actions are tied to the correct user, and revoking one person's access doesn't affect anyone else. Each user will go through their own OAuth authorization flow when they first connect.

Not necessarily. These modules may simply not be in use in your Vanta account yet, or they may not be included in your current plan. Check whether the relevant features are active in your Vanta account before assuming it's a permissions issue. If you're unsure, contact Vanta support.

The Vanta MCP is available to all customers.

Reach out to Vanta support, or visit the Vanta Community to see if others have run into the same issue.