From 25ae4470522d95ae19705827e87ce8551e699c21 Mon Sep 17 00:00:00 2001 From: djiang-jq Date: Wed, 21 Oct 2026 20:01:18 -0700 Subject: [PATCH 1/2] feat(third_party): add Vanta remote MCP plugin Co-authored-by: Cursor --- .cursor-plugin/marketplace.json | 5 ++ README.md | 1 + third_party/vanta/.cursor-plugin/plugin.json | 34 +++++++++++ third_party/vanta/CHANGELOG.md | 9 +++ third_party/vanta/LICENSE | 21 +++++++ third_party/vanta/README.md | 56 +++++++++++++++++++ third_party/vanta/assets/logo.png | Bin 0 -> 5582 bytes third_party/vanta/mcp.json | 9 +++ 8 files changed, 135 insertions(+) create mode 100644 third_party/vanta/.cursor-plugin/plugin.json create mode 100644 third_party/vanta/CHANGELOG.md create mode 100644 third_party/vanta/LICENSE create mode 100644 third_party/vanta/README.md create mode 100644 third_party/vanta/assets/logo.png create mode 100644 third_party/vanta/mcp.json diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json index 61c11c098..803a1e446 100644 --- a/.cursor-plugin/marketplace.json +++ b/.cursor-plugin/marketplace.json @@ -617,6 +617,11 @@ "name": "framer", "source": "third_party/framer", "description": "Design, build, and edit your Framer sites, pages, and CMS content." + }, + { + "name": "vanta", + "source": "third_party/vanta", + "description": "Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta." } ] } diff --git a/README.md b/README.md index ba44ad6f8..a057a0fc6 100644 --- a/README.md +++ b/README.md @@ -113,6 +113,7 @@ Official Cursor plugins for popular developer tools, frameworks, and SaaS produc | `lark` | [Lark](third_party/lark/) | Cursor | Integrations | Search, create, and update Lark Suite docs, and read Lark messages and groups. | | `feishu` | [Feishu](third_party/feishu/) | Cursor | Integrations | Search, create, and update Feishu docs, and read Feishu messages and groups. | | `framer` | [Framer](third_party/framer/) | Cursor | Integrations | Design, build, and edit your Framer sites, pages, and CMS content. | +| `vanta` | [Vanta](third_party/vanta/) | Cursor | Integrations | Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta. | Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `plugins@cursor.com` in the manifest). ## Repository structure diff --git a/third_party/vanta/.cursor-plugin/plugin.json b/third_party/vanta/.cursor-plugin/plugin.json new file mode 100644 index 000000000..93d66d1ec --- /dev/null +++ b/third_party/vanta/.cursor-plugin/plugin.json @@ -0,0 +1,34 @@ +{ + "name": "vanta", + "displayName": "Vanta", + "version": "1.0.0", + "minClientVersions": { + "cursor": "3.13.0" + }, + "description": "Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta.", + "author": { + "name": "Cursor", + "email": "plugins@cursor.com" + }, + "homepage": "https://www.vanta.com", + "repository": "https://github.com/cursor/plugins", + "license": "MIT", + "logo": "assets/logo.png", + "keywords": [ + "vanta", + "compliance", + "security", + "soc2", + "iso27001", + "grc", + "mcp" + ], + "category": "integrations", + "tags": [ + "vanta", + "compliance", + "security", + "mcp" + ], + "mcpServers": "./mcp.json" +} diff --git a/third_party/vanta/CHANGELOG.md b/third_party/vanta/CHANGELOG.md new file mode 100644 index 000000000..9d75ec660 --- /dev/null +++ b/third_party/vanta/CHANGELOG.md @@ -0,0 +1,9 @@ +# Changelog + +All notable changes to this plugin will be documented here. + +## 1.0.0 — initial release + +- Added the `vanta` MCP server pointing at Vanta's hosted Streamable HTTP endpoint for US instances (`https://mcp.vanta.com/mcp`), with `"placement": "server"` so Grok Bot connects through Cursor's hosted path. +- Auth uses MCP OAuth with Vanta account login, Dynamic Client Registration, and PKCE — no API token, client secret, or custom header to configure. +- Logo: the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.). diff --git a/third_party/vanta/LICENSE b/third_party/vanta/LICENSE new file mode 100644 index 000000000..ca2bba771 --- /dev/null +++ b/third_party/vanta/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Cursor + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/third_party/vanta/README.md b/third_party/vanta/README.md new file mode 100644 index 000000000..f1bb88c71 --- /dev/null +++ b/third_party/vanta/README.md @@ -0,0 +1,56 @@ +# Vanta + +Cursor plugin that connects agents to [Vanta](https://www.vanta.com) through Vanta's official remote [Model Context Protocol](https://modelcontextprotocol.io/) server. + +Ask about your compliance posture, such as which tests are failing, which controls map to a framework, or which vulnerabilities are past their SLA, and have the agent help remediate failing tests. + +## Install + +1. Open **Cursor Settings → Plugins**. +2. Search for **Vanta**. +3. Click **Install**, then complete the Vanta sign-in prompt and click **Allow**. + +Or run `/add-plugin vanta` in chat. + +## MCP + +```json +{ + "mcpServers": { + "vanta": { + "type": "http", + "url": "https://mcp.vanta.com/mcp", + "placement": "server" + } + } +} +``` + +Auth is MCP OAuth (Bearer). Cursor discovers the authorization server when the plugin connects and prompts for Vanta login. Vanta supports Dynamic Client Registration with PKCE, so there is no API token, client ID, client secret, or custom header to configure. + +## Before you connect + +You need an active Vanta user on a US-hosted Vanta instance. Any role can connect, including Editor, Collaborator, and View-only Admin. Unauthenticated requests to the server are rejected until that login completes. + +Vanta hosts a separate MCP server per region. This plugin targets the US endpoint. EU and Australia instances use `https://mcp.eu.vanta.com/mcp` and `https://mcp.aus.vanta.com/mcp`; add those as a custom MCP server instead. + +## Notes + +- Tool calls run as the Vanta user who authorizes the connection and cannot exceed that user's permissions. Admins get the full tool set; other roles get the same tools minus a few that Vanta restricts to Admins. +- The agent can change your compliance data, such as creating risks or uploading policies. Review changes in Vanta. +- What the agent reads from or changes in your account goes through Vanta's servers, under the [Vanta Privacy Policy](https://www.vanta.com/legal/privacy). +- OAuth metadata is discovered at connect time (protected resource `https://mcp.vanta.com/.well-known/oauth-protected-resource`, authorization server `https://api.vanta.com/mcp`, scope `mcp-api.all:write`). +- If a connection stops working, remove and re-add it to start a fresh OAuth flow. +- The hosted runtime is the source of truth for tool names and schemas; tools are listed after sign-in. + +## Docs + +- Vanta MCP server: https://developer.vanta.com/docs/vanta-mcp +- Connecting to Vanta MCP: https://help.vanta.com/en/articles/14094979-connecting-to-vanta-mcp +- Server URL: https://mcp.vanta.com/mcp + +Logo is the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.). + +## License + +MIT diff --git a/third_party/vanta/assets/logo.png b/third_party/vanta/assets/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..e65400507bac4cb30c177ee3d6ac5837f9c595cd GIT binary patch literal 5582 zcmd5==T{RCuw7bciJ-IqN)eGJ5TqzgdjHX-2m+xBf=G#ko=6o?QRzrWKtMWz1~CF6 zy-PRrjzH)&@YeSiypQkfhuyQYXLoky&fGf_V`QKOqvN0h005?=t!@GUWZ)$kKtm3m zh8UG3z!StlPfH!R_;=(q79{`xOSq1@%6E`xaT$L~Hui?^`^AVlVP?cyj)p zzHYbDy?s{Z> zdvRUt7P&O$O~MSMwd{0i>pKqLhqisW=Qh2#;d9Pf7 ze+ew6!cm%z%a1*ldWSbCxA`u#FParM4LmeG*NbL!$gRPOHQhHKNp2bv&< zCqpopHk0S-A!imbsUoZUX2QdXUa5A>crqeAF$#QK#k4Ij-Y2>|?D@;EFJr&i2W>DW zD|gX`Y^&u;l%W)i30E%Jgca+G_~hsz)e1~Vn@^ukOiXH{Nbg$5uh;}wo0az6~gkJ znWP?eefxN1w3N~#tn1}f?HKxiZ<`ZP)iyV77I~VYVxi(T)fLdsk0>-L4!zj62H)l( zZjGbdQF*%#Fse?SZM+-gM>4$lt;#3RK^)FKJ8L`ncHXxL6~Al0lS*6>0xwLyQ7eOf zA7G~1g>|uFPEMWOn;RDbakk=gsfgI&;l2K8CL$N0`a(1Re5MASm(ZL;FOi&I6XK_H z9mQf&)$jH|F~!Pi^#@+SNEx8vmD7uhA33)+YQMXp`qBiUMCeT44!>>TqnnUHxT=pg z&{WCDrzgInb*98JIxHh=P`jt!&$Id?p%q>#awyut>e|7Ap4Sp2xxoI-Eua;AYHoJp zWIO86OE4@Z*3%<1DN6X}JB1<2u+><7~htLEO zaUkN2-NpJ9Pdqc7Ox$YrFRxuxq38Q7?)ACNpOx^(u~4j4*-4)>-hM}e()yBtpHU6R z;-e>y8ieF*x3E|!!25HkZG#j)9acW)b}y8xpTE7RzCOM@_rfy!LCnxNtD1f>8BfHA z1x>c@<#l>3`Q3DqOs#y`1`4K^;s;BFJHEk((hR|$rMDFYrei+frz@XraE)<%@SXj;Sivx;FrRd*cdqPI z9^01waa?{Pxp_n4fN7CyP2v;SehcmzspcE|j*+e*&B4Un@_%;eNWN!0p+_J-GrUZN zPLUA5io<)mUH)UhBvlU_y*`N5i^hyR#QVsjX#WnEO`{JF6l0^#{tFFF{z`>qG&#^a zQVfu>*j!tcsSi*|x=*k}i;ph+P3w-cZ-r7YW^>KX!W1<2rZP_(>bN4xo|i58T7b>d zNa~hY-^_8Mlq3|ZSvqT_wN&s)W$% zmnQ-Y)ZFZSXB5cXp`|{($a2*H8++VlMRr5~}hxRh|#|-ujJCnWpO7Pg{CpHuwuwSJQt<>rdMH#lF`L3%2 zG~D^k>q-{COpWZGauX;fYd?0x%JZ5g0t-F*WEZaY0%sN?Yf`|t{mOb0{nQq(KVXDc zmzWMcS5E}SBU7T}GD{v5EbG_7*zA^JYq zz3i3z_dM5ByX4Me_N6|4Bfy2<;E;Qr!n&nry`EvS@Yqj7#yw?tP$Mx~v_p`F8A#HV zjt*~03z)k75kIYLG4-1m0}?8tLJLApg(X(0IfIErHHdWOP8Miq@Vu{MZ@>+do9wjQMVw3|y$)+S7ike5fwt7QwhsYszXjDm`D=UVI^5pr&l;veP zkOLhqv39A!Xs%8Koy{Fe5$r$;JrWQQ$)n~e6(kG3>F5|@+9i#h-&@hdh@z~xP7FT1 z-~!yOMTiA|Kn{98+OEjcKQ&^EKL#{f_RcIVR?2R&Ur_`i;zh$tQl2Ip-)&q=dWIrQ zn?z;=+uwi!wC`CI#AuFq(w25D@Fd-l`Mr{qp_fg^RQ`Sc0k$S>tPm{Yy?c}+9d~)W zoTlrQGIGcB^z7c|o4?mNL<68vm5%j;yJ&5tw1-WDb>06uCT#^{&@!ls1hK_P{>;ggbhi1;#m;YBmT)ZhHsX#!7TI%HsUHfxZzT2GLh#vE z0xuE>P0UanA`DU0MX3eF+cj#}hqfG>#4a7992tytctm_jF8a03jjSIn?$lKvCfbpzu7db?4m%XTA6ECEQc1{UzxW zc{pT-7A&9{>JATU{MKxU&g-H4$&=2mQAMs3d52XbkcC`ECOk+5ti#pYR!F1Bq5e`3{`;Az?O66CuU;F}RGgYW!*S*$9DXY+rTQZppGep-uw zp^pTcM5Y1^gdLOqBT(KHdWPMs@ab1#4eTHwSAxJ@mJ#u|ngLvGjbv68a$dC(; z&0Xlz|6Dr=R&+?lR6cd4wFuf&>SZhg4AjecxmWCgsJRt~>~!kjH{Bc7XwLO`6RAHY zUr$x2{V>tb$>0zMLzUtCaf_oSiWhgk%6(XDGm*M42>pR@FmX9L3ivTnS#;2^9X}+$ zONeCB>NELM>J=(?WSX6U09uSn&8X`}Wv z9LOj3v&e*cK3u$=-q8mNTTnVO!&qPx$i(hue`*2wF%B6{bjB2@jHa*3>U)!9o!w?Q z$=ewykjx_PU4P%Hk8w;)${qZ^gvsC{G-*Y=nbRO<`|Pv;@VIEOnk}Ha%)f`n8{K*g zVnqz&(iMc5{pXlypx7#KHlfnLMsKa=7&27G`9$q3^2s{KN;2b$Z0ZReIR%2;cZotg zd24-RvNrJJ9e=O|S_g3w6UcLsfF`n6&uzxtsnj;OZWN?L{5}8Jx%6Y_Vvt#GG8Z7> z*vnqe(7L@@wAN}Ml0iuqw286W?J&n>7U)rNlCD815VsYeG=B+x3*+2==zWh5a@HUj zAc=dlH`xmA!?AC5+F$GuA@>Bk5j*2@Kd#E{jBk(wQjLxc@67RNLc)KjcIXQ4H4DdCD zvw#r+bomz_@EnFL-f<4U@ZbBPgX`#fpg}vs^eq5Omcz^?>D=xAmEm2-uz*&pQkBdG z=Atro)8r)fAuEdz7Xw9zFFOgABbJ%x}zbA#8N8f-9l`_Ktar42vJW4E3v zH7Q>u(K3{8CziVA*nWw6M!U@4cxei^{GWb;_HzE_9oFxomeUJsv)^{|VJNl^!56-$ zsz=tTKE*4Vj04y<#l|YfeLg}RY-BByTk~h6vPBbpFy-x-NCSCmq?DEZEcuL0<52|Jzg@xh8I|5++m{V&L>JcJW&mOOvq|N)cwPk~ zdc8E)9!TBZKg>vLcN8CL>*JG?y^5nVum>#XYD7L&w7>P8sH>iFx|*DkOt@e8n5k9a5eTavO5*d zeESkEmOJ1W*Y-$V)uKrn3Iv@&Wx;W&d2_3uSl?pXq_--kN53Nc!bfd)l@A^K- zn$)Mec5!^ba5d9=-OzDX09*U;Pp0tUxop1j>)k}3{f<&}=!=T;%T0zr+Eu0CKtd!x LFi Date: Wed, 21 Oct 2026 20:25:25 -0700 Subject: [PATCH 2/2] feat(vanta): add EU and AUS regional MCP servers Co-authored-by: Cursor --- third_party/vanta/CHANGELOG.md | 2 +- third_party/vanta/README.md | 35 +++++++++++++++++++++++++--------- third_party/vanta/mcp.json | 12 +++++++++++- 3 files changed, 38 insertions(+), 11 deletions(-) diff --git a/third_party/vanta/CHANGELOG.md b/third_party/vanta/CHANGELOG.md index 9d75ec660..1a521590d 100644 --- a/third_party/vanta/CHANGELOG.md +++ b/third_party/vanta/CHANGELOG.md @@ -4,6 +4,6 @@ All notable changes to this plugin will be documented here. ## 1.0.0 — initial release -- Added the `vanta` MCP server pointing at Vanta's hosted Streamable HTTP endpoint for US instances (`https://mcp.vanta.com/mcp`), with `"placement": "server"` so Grok Bot connects through Cursor's hosted path. +- Added one MCP server per Vanta region, pointing at Vanta's hosted Streamable HTTP endpoints: `vanta-us` (`https://mcp.vanta.com/mcp`), `vanta-eu` (`https://mcp.eu.vanta.com/mcp`), and `vanta-aus` (`https://mcp.aus.vanta.com/mcp`). Each uses `"placement": "server"` so Grok Bot connects through Cursor's hosted path. Server names match Vanta's own plugin (`VantaInc/vanta-mcp-plugin`). - Auth uses MCP OAuth with Vanta account login, Dynamic Client Registration, and PKCE — no API token, client secret, or custom header to configure. - Logo: the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.). diff --git a/third_party/vanta/README.md b/third_party/vanta/README.md index f1bb88c71..38b9c9159 100644 --- a/third_party/vanta/README.md +++ b/third_party/vanta/README.md @@ -1,6 +1,6 @@ # Vanta -Cursor plugin that connects agents to [Vanta](https://www.vanta.com) through Vanta's official remote [Model Context Protocol](https://modelcontextprotocol.io/) server. +Cursor plugin that connects agents to [Vanta](https://www.vanta.com) through Vanta's official remote [Model Context Protocol](https://modelcontextprotocol.io/) servers. Ask about your compliance posture, such as which tests are failing, which controls map to a framework, or which vulnerabilities are past their SLA, and have the agent help remediate failing tests. @@ -8,38 +8,55 @@ Ask about your compliance posture, such as which tests are failing, which contro 1. Open **Cursor Settings → Plugins**. 2. Search for **Vanta**. -3. Click **Install**, then complete the Vanta sign-in prompt and click **Allow**. +3. Click **Install**. +4. Connect only the server for your Vanta region (`vanta-us`, `vanta-eu`, or `vanta-aus`), then complete the Vanta sign-in prompt and click **Allow**. Or run `/add-plugin vanta` in chat. ## MCP +Vanta hosts a separate MCP server per region, so the plugin ships one server for each: + ```json { "mcpServers": { - "vanta": { + "vanta-us": { "type": "http", "url": "https://mcp.vanta.com/mcp", "placement": "server" + }, + "vanta-eu": { + "type": "http", + "url": "https://mcp.eu.vanta.com/mcp", + "placement": "server" + }, + "vanta-aus": { + "type": "http", + "url": "https://mcp.aus.vanta.com/mcp", + "placement": "server" } } } ``` -Auth is MCP OAuth (Bearer). Cursor discovers the authorization server when the plugin connects and prompts for Vanta login. Vanta supports Dynamic Client Registration with PKCE, so there is no API token, client ID, client secret, or custom header to configure. +| Server | Vanta region | URL | +|:-------|:-------------|:----| +| `vanta-us` | United States | `https://mcp.vanta.com/mcp` | +| `vanta-eu` | Europe | `https://mcp.eu.vanta.com/mcp` | +| `vanta-aus` | Australia | `https://mcp.aus.vanta.com/mcp` | -## Before you connect +Auth is MCP OAuth (Bearer). Cursor discovers the authorization server when a server connects and prompts for Vanta login. Vanta supports Dynamic Client Registration with PKCE, so there is no API token, client ID, client secret, or custom header to configure. The servers for the regions you don't use stay unauthenticated and can be ignored. -You need an active Vanta user on a US-hosted Vanta instance. Any role can connect, including Editor, Collaborator, and View-only Admin. Unauthenticated requests to the server are rejected until that login completes. +## Before you connect -Vanta hosts a separate MCP server per region. This plugin targets the US endpoint. EU and Australia instances use `https://mcp.eu.vanta.com/mcp` and `https://mcp.aus.vanta.com/mcp`; add those as a custom MCP server instead. +You need an active Vanta user. Any role can connect, including Editor, Collaborator, and View-only Admin. Unauthenticated requests to a server are rejected until that login completes. ## Notes - Tool calls run as the Vanta user who authorizes the connection and cannot exceed that user's permissions. Admins get the full tool set; other roles get the same tools minus a few that Vanta restricts to Admins. - The agent can change your compliance data, such as creating risks or uploading policies. Review changes in Vanta. - What the agent reads from or changes in your account goes through Vanta's servers, under the [Vanta Privacy Policy](https://www.vanta.com/legal/privacy). -- OAuth metadata is discovered at connect time (protected resource `https://mcp.vanta.com/.well-known/oauth-protected-resource`, authorization server `https://api.vanta.com/mcp`, scope `mcp-api.all:write`). +- OAuth metadata is discovered at connect time. Each server publishes it at `/.well-known/oauth-protected-resource` with scope `mcp-api.all:write`. - If a connection stops working, remove and re-add it to start a fresh OAuth flow. - The hosted runtime is the source of truth for tool names and schemas; tools are listed after sign-in. @@ -47,7 +64,7 @@ Vanta hosts a separate MCP server per region. This plugin targets the US endpoin - Vanta MCP server: https://developer.vanta.com/docs/vanta-mcp - Connecting to Vanta MCP: https://help.vanta.com/en/articles/14094979-connecting-to-vanta-mcp -- Server URL: https://mcp.vanta.com/mcp +- Vanta's Claude Code plugin, which uses the same three servers: https://github.com/VantaInc/vanta-mcp-plugin Logo is the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.). diff --git a/third_party/vanta/mcp.json b/third_party/vanta/mcp.json index 3270da9cf..e498be3ec 100644 --- a/third_party/vanta/mcp.json +++ b/third_party/vanta/mcp.json @@ -1,9 +1,19 @@ { "mcpServers": { - "vanta": { + "vanta-us": { "type": "http", "url": "https://mcp.vanta.com/mcp", "placement": "server" + }, + "vanta-eu": { + "type": "http", + "url": "https://mcp.eu.vanta.com/mcp", + "placement": "server" + }, + "vanta-aus": { + "type": "http", + "url": "https://mcp.aus.vanta.com/mcp", + "placement": "server" } } }