[djiang-jq]

Add Vanta plugin

Vanta has its own MCP server that lets an AI agent read and fix compliance data (tests, controls, frameworks, risks, vulnerabilities), but it is not in our plugin list yet.

Changes

• Add a Vanta plugin with one MCP server per Vanta region, since Vanta hosts each region separately:
  • vanta-us: https://mcp.vanta.com/mcp
  • vanta-eu: https://mcp.eu.vanta.com/mcp
  • vanta-aus: https://mcp.aus.vanta.com/mcp
• The server names match Vanta's own Claude Code plugin (VantaInc/vanta-mcp-plugin), which ships the same three servers.
• People sign in with their Vanta account through MCP OAuth (Dynamic Client Registration + PKCE); there are no keys to paste. Users only connect the server for their region.
• Add a logo, a readme, a changelog, and a license.
• List Vanta in the plugin list and in the main readme table.

Notes

• The plugin check passes (node scripts/validate-plugins.mjs → "All plugins validated successfully.").
• All three regional servers point sign-in at https://api.vanta.com/mcp, while the EU and Australia OAuth servers have their own issuers. Vanta's docs say to use the URL for your region, so the plugin ships all three rather than relying on the region picker on Vanta's login page.
• This is the first plugin in the repo with more than one server in mcp.json. Not tested yet: how Cursor and Grok Bot show three connections, and whether the two servers a user never signs in to cause errors.
• Not tested: a full sign-in from Cursor or Grok Bot, and the list of tools (Vanta only shows tools after sign-in).
• Logo: Vanta only publishes a wordmark, so the icon is the "V" glyph from their official wordmark SVG in their brand purple. Swap it if we get an official square mark.

Made with Cursor

---

Note

Medium Risk
New third-party MCP integration can read and modify compliance data in Vanta under the authorizing user’s permissions; scope is additive marketplace config, not core app code.

^{Reviewed by Cursor Bugbot for commit e78ec96. Bugbot is set up for automated code reviews on this repo. Configure here.}