Add Vanta plugin

.cursor-plugin/marketplace.json

@@ -617,6 +617,11 @@
       "name": "framer",
       "source": "third_party/framer",
       "description": "Design, build, and edit your Framer sites, pages, and CMS content."
+    },
+    {
+      "name": "vanta",
+      "source": "third_party/vanta",
+      "description": "Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta."
     }
   ]
 }

README.md

@@ -113,6 +113,7 @@ Official Cursor plugins for popular developer tools, frameworks, and SaaS produc
 | `lark` | [Lark](third_party/lark/) | Cursor | Integrations | Search, create, and update Lark Suite docs, and read Lark messages and groups. |
 | `feishu` | [Feishu](third_party/feishu/) | Cursor | Integrations | Search, create, and update Feishu docs, and read Feishu messages and groups. |
 | `framer` | [Framer](third_party/framer/) | Cursor | Integrations | Design, build, and edit your Framer sites, pages, and CMS content. |
+| `vanta` | [Vanta](third_party/vanta/) | Cursor | Integrations | Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta. |
 Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `plugins@cursor.com` in the manifest).
 
 ## Repository structure

third_party/vanta/.cursor-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "vanta",
+  "displayName": "Vanta",
+  "version": "1.0.0",
+  "minClientVersions": {
+    "cursor": "3.13.0"
+  },
+  "description": "Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta.",
+  "author": {
+    "name": "Cursor",
+    "email": "plugins@cursor.com"
+  },
+  "homepage": "https://www.vanta.com",
+  "repository": "https://github.com/cursor/plugins",
+  "license": "MIT",
+  "logo": "assets/logo.png",
+  "keywords": [
+    "vanta",
+    "compliance",
+    "security",
+    "soc2",
+    "iso27001",
+    "grc",
+    "mcp"
+  ],
+  "category": "integrations",
+  "tags": [
+    "vanta",
+    "compliance",
+    "security",
+    "mcp"
+  ],
+  "mcpServers": "./mcp.json"
+}

third_party/vanta/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+All notable changes to this plugin will be documented here.
+
+## 1.0.0 — initial release
+
+- Added one MCP server per Vanta region, pointing at Vanta's hosted Streamable HTTP endpoints: `vanta-us` (`https://mcp.vanta.com/mcp`), `vanta-eu` (`https://mcp.eu.vanta.com/mcp`), and `vanta-aus` (`https://mcp.aus.vanta.com/mcp`). Each uses `"placement": "server"` so Grok Bot connects through Cursor's hosted path. Server names match Vanta's own plugin (`VantaInc/vanta-mcp-plugin`).
+- Auth uses MCP OAuth with Vanta account login, Dynamic Client Registration, and PKCE — no API token, client secret, or custom header to configure.
+- Logo: the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.).

third_party/vanta/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

third_party/vanta/README.md

@@ -0,0 +1,73 @@
+# Vanta
+
+Cursor plugin that connects agents to [Vanta](https://www.vanta.com) through Vanta's official remote [Model Context Protocol](https://modelcontextprotocol.io/) servers.
+
+Ask about your compliance posture, such as which tests are failing, which controls map to a framework, or which vulnerabilities are past their SLA, and have the agent help remediate failing tests.
+
+## Install
+
+1. Open **Cursor Settings → Plugins**.
+2. Search for **Vanta**.
+3. Click **Install**.
+4. Connect only the server for your Vanta region (`vanta-us`, `vanta-eu`, or `vanta-aus`), then complete the Vanta sign-in prompt and click **Allow**.
+
+Or run `/add-plugin vanta` in chat.
+
+## MCP
+
+Vanta hosts a separate MCP server per region, so the plugin ships one server for each:
+
+```json
+{
+  "mcpServers": {
+    "vanta-us": {
+      "type": "http",
+      "url": "https://mcp.vanta.com/mcp",
+      "placement": "server"
+    },
+    "vanta-eu": {
+      "type": "http",
+      "url": "https://mcp.eu.vanta.com/mcp",
+      "placement": "server"
+    },
+    "vanta-aus": {
+      "type": "http",
+      "url": "https://mcp.aus.vanta.com/mcp",
+      "placement": "server"
+    }
+  }
+}
+```
+
+| Server | Vanta region | URL |
+|:-------|:-------------|:----|
+| `vanta-us` | United States | `https://mcp.vanta.com/mcp` |
+| `vanta-eu` | Europe | `https://mcp.eu.vanta.com/mcp` |
+| `vanta-aus` | Australia | `https://mcp.aus.vanta.com/mcp` |
+
+Auth is MCP OAuth (Bearer). Cursor discovers the authorization server when a server connects and prompts for Vanta login. Vanta supports Dynamic Client Registration with PKCE, so there is no API token, client ID, client secret, or custom header to configure. The servers for the regions you don't use stay unauthenticated and can be ignored.
+
+## Before you connect
+
+You need an active Vanta user. Any role can connect, including Editor, Collaborator, and View-only Admin. Unauthenticated requests to a server are rejected until that login completes.
+
+## Notes
+
+- Tool calls run as the Vanta user who authorizes the connection and cannot exceed that user's permissions. Admins get the full tool set; other roles get the same tools minus a few that Vanta restricts to Admins.
+- The agent can change your compliance data, such as creating risks or uploading policies. Review changes in Vanta.
+- What the agent reads from or changes in your account goes through Vanta's servers, under the [Vanta Privacy Policy](https://www.vanta.com/legal/privacy).
+- OAuth metadata is discovered at connect time. Each server publishes it at `/.well-known/oauth-protected-resource` with scope `mcp-api.all:write`.
+- If a connection stops working, remove and re-add it to start a fresh OAuth flow.
+- The hosted runtime is the source of truth for tool names and schemas; tools are listed after sign-in.
+
+## Docs
+
+- Vanta MCP server: https://developer.vanta.com/docs/vanta-mcp
+- Connecting to Vanta MCP: https://help.vanta.com/en/articles/14094979-connecting-to-vanta-mcp
+- Vanta's Claude Code plugin, which uses the same three servers: https://github.com/VantaInc/vanta-mcp-plugin
+
+Logo is the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.).
+
+## License
+
+MIT

third_party/vanta/mcp.json

@@ -0,0 +1,19 @@
+{
+  "mcpServers": {
+    "vanta-us": {
+      "type": "http",
+      "url": "https://mcp.vanta.com/mcp",
+      "placement": "server"
+    },
+    "vanta-eu": {
+      "type": "http",
+      "url": "https://mcp.eu.vanta.com/mcp",
+      "placement": "server"
+    },
+    "vanta-aus": {
+      "type": "http",
+      "url": "https://mcp.aus.vanta.com/mcp",
+      "placement": "server"
+    }
+  }
+}