From b951b8e51567ed3dde6e811313f64600c8dc148c Mon Sep 17 00:00:00 2001 From: djiang-jq Date: Wed, 21 Oct 2026 21:55:39 -0700 Subject: [PATCH] Vanta: one server with a region variable instead of three regional servers Co-authored-by: Cursor --- third_party/vanta/.cursor-plugin/plugin.json | 17 +++++++- third_party/vanta/CHANGELOG.md | 5 +++ third_party/vanta/README.md | 41 ++++++++------------ third_party/vanta/mcp.json | 14 +------ 4 files changed, 40 insertions(+), 37 deletions(-) diff --git a/third_party/vanta/.cursor-plugin/plugin.json b/third_party/vanta/.cursor-plugin/plugin.json index 93d66d1ec..d4976d6fa 100644 --- a/third_party/vanta/.cursor-plugin/plugin.json +++ b/third_party/vanta/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "vanta", "displayName": "Vanta", - "version": "1.0.0", + "version": "1.1.0", "minClientVersions": { "cursor": "3.13.0" }, @@ -30,5 +30,20 @@ "security", "mcp" ], + "variables": { + "type": "object", + "properties": { + "VANTA_MCP_HOST": { + "type": "string", + "title": "Vanta region", + "description": "The MCP host for your Vanta region: mcp.vanta.com (United States), mcp.eu.vanta.com (Europe), or mcp.aus.vanta.com (Australia).", + "enum": [ + "mcp.vanta.com", + "mcp.eu.vanta.com", + "mcp.aus.vanta.com" + ] + } + } + }, "mcpServers": "./mcp.json" } diff --git a/third_party/vanta/CHANGELOG.md b/third_party/vanta/CHANGELOG.md index 1a521590d..6e615e92d 100644 --- a/third_party/vanta/CHANGELOG.md +++ b/third_party/vanta/CHANGELOG.md @@ -2,6 +2,11 @@ All notable changes to this plugin will be documented here. +## 1.1.0 + +- Replaced the three regional servers with one `vanta` server at `https://${VANTA_MCP_HOST}/mcp`, so a user sees one Vanta connection instead of three. +- Added the `VANTA_MCP_HOST` setup value ("Vanta region"), an enum of `mcp.vanta.com`, `mcp.eu.vanta.com`, and `mcp.aus.vanta.com`. Grok Bot asks for it when you sign in; Cursor shows it as a setup choice. + ## 1.0.0 — initial release - Added one MCP server per Vanta region, pointing at Vanta's hosted Streamable HTTP endpoints: `vanta-us` (`https://mcp.vanta.com/mcp`), `vanta-eu` (`https://mcp.eu.vanta.com/mcp`), and `vanta-aus` (`https://mcp.aus.vanta.com/mcp`). Each uses `"placement": "server"` so Grok Bot connects through Cursor's hosted path. Server names match Vanta's own plugin (`VantaInc/vanta-mcp-plugin`). diff --git a/third_party/vanta/README.md b/third_party/vanta/README.md index 38b9c9159..52a31e33a 100644 --- a/third_party/vanta/README.md +++ b/third_party/vanta/README.md @@ -8,55 +8,49 @@ Ask about your compliance posture, such as which tests are failing, which contro 1. Open **Cursor Settings → Plugins**. 2. Search for **Vanta**. -3. Click **Install**. -4. Connect only the server for your Vanta region (`vanta-us`, `vanta-eu`, or `vanta-aus`), then complete the Vanta sign-in prompt and click **Allow**. +3. Click **Install**, choose your Vanta region, then complete the Vanta sign-in prompt and click **Allow**. Or run `/add-plugin vanta` in chat. +In Grok Bot, the region is asked when you sign in, the same way Zoho asks for its data center. In Cursor, the region is the plugin's **Vanta region** setup value. + ## MCP -Vanta hosts a separate MCP server per region, so the plugin ships one server for each: +Vanta hosts a separate MCP server per region. The plugin ships one server whose host is the region you choose: ```json { "mcpServers": { - "vanta-us": { - "type": "http", - "url": "https://mcp.vanta.com/mcp", - "placement": "server" - }, - "vanta-eu": { + "vanta": { "type": "http", - "url": "https://mcp.eu.vanta.com/mcp", - "placement": "server" - }, - "vanta-aus": { - "type": "http", - "url": "https://mcp.aus.vanta.com/mcp", + "url": "https://${VANTA_MCP_HOST}/mcp", "placement": "server" } } } ``` -| Server | Vanta region | URL | -|:-------|:-------------|:----| -| `vanta-us` | United States | `https://mcp.vanta.com/mcp` | -| `vanta-eu` | Europe | `https://mcp.eu.vanta.com/mcp` | -| `vanta-aus` | Australia | `https://mcp.aus.vanta.com/mcp` | +| Vanta region | `VANTA_MCP_HOST` | URL | +|:-------------|:-----------------|:----| +| United States | `mcp.vanta.com` | `https://mcp.vanta.com/mcp` | +| Europe | `mcp.eu.vanta.com` | `https://mcp.eu.vanta.com/mcp` | +| Australia | `mcp.aus.vanta.com` | `https://mcp.aus.vanta.com/mcp` | + +`VANTA_MCP_HOST` is declared in `plugin.json` as an enum of those three hosts, so no other host can be stored. Grok Bot's region picker lists the same three regions; keep the two in sync if Vanta adds one. -Auth is MCP OAuth (Bearer). Cursor discovers the authorization server when a server connects and prompts for Vanta login. Vanta supports Dynamic Client Registration with PKCE, so there is no API token, client ID, client secret, or custom header to configure. The servers for the regions you don't use stay unauthenticated and can be ignored. +Auth is MCP OAuth (Bearer). Cursor discovers the authorization server when the server connects and prompts for Vanta login. Vanta supports Dynamic Client Registration with PKCE, so there is no API token, client ID, client secret, or custom header to configure. ## Before you connect -You need an active Vanta user. Any role can connect, including Editor, Collaborator, and View-only Admin. Unauthenticated requests to a server are rejected until that login completes. +You need an active Vanta user. Any role can connect, including Editor, Collaborator, and View-only Admin. Unauthenticated requests to the server are rejected until that login completes. ## Notes - Tool calls run as the Vanta user who authorizes the connection and cannot exceed that user's permissions. Admins get the full tool set; other roles get the same tools minus a few that Vanta restricts to Admins. - The agent can change your compliance data, such as creating risks or uploading policies. Review changes in Vanta. - What the agent reads from or changes in your account goes through Vanta's servers, under the [Vanta Privacy Policy](https://www.vanta.com/legal/privacy). -- OAuth metadata is discovered at connect time. Each server publishes it at `/.well-known/oauth-protected-resource` with scope `mcp-api.all:write`. +- OAuth metadata is discovered at connect time. Each regional server publishes it at `/.well-known/oauth-protected-resource` with scope `mcp-api.all:write`. +- Switching regions needs a new sign-in: each region keeps its own sign-in. - If a connection stops working, remove and re-add it to start a fresh OAuth flow. - The hosted runtime is the source of truth for tool names and schemas; tools are listed after sign-in. @@ -64,7 +58,6 @@ You need an active Vanta user. Any role can connect, including Editor, Collabora - Vanta MCP server: https://developer.vanta.com/docs/vanta-mcp - Connecting to Vanta MCP: https://help.vanta.com/en/articles/14094979-connecting-to-vanta-mcp -- Vanta's Claude Code plugin, which uses the same three servers: https://github.com/VantaInc/vanta-mcp-plugin Logo is the "V" glyph from Vanta's official wordmark, from `https://cdn.prod.website-files.com/64009032676f24f376f002fc/6400ac82429afb0f7b31fa6c_vanta-logo.svg` (Vanta Inc.). diff --git a/third_party/vanta/mcp.json b/third_party/vanta/mcp.json index e498be3ec..e0c592b43 100644 --- a/third_party/vanta/mcp.json +++ b/third_party/vanta/mcp.json @@ -1,18 +1,8 @@ { "mcpServers": { - "vanta-us": { + "vanta": { "type": "http", - "url": "https://mcp.vanta.com/mcp", - "placement": "server" - }, - "vanta-eu": { - "type": "http", - "url": "https://mcp.eu.vanta.com/mcp", - "placement": "server" - }, - "vanta-aus": { - "type": "http", - "url": "https://mcp.aus.vanta.com/mcp", + "url": "https://${VANTA_MCP_HOST}/mcp", "placement": "server" } }