{"componentChunkName":"component---src-templates-simple-markdown-js","path":"/developer-portal/v2/mcp-server/","matchPath":"","result":{"data":{"markdownRemark":{"html":"

MCP Server

\n

Overview

\n

The Drata MCP (Model Context Protocol) Server allows AI assistants like Claude, ChatGPT, Cursor, and Microsoft Copilot to securely access your Drata data. This guide walks you through setting up OAuth authentication for MCP clients.

\n

Prerequisites

\n\n

Configuration Steps

\n

1. Configure the Drata MCP Server

\n
    \n
  1. \nClick \nSettings\n in your Drata account\n
    2. \n
  2. \nClick \nMCP Configuration\n
    3. \n
\n
\n

Note: You must be an administrator in Drata to access this page.

\n
\n

2. Configure Your MCP Client

\n

Follow the setup instructions for your specific MCP client. Drata provides remote hosted MCP servers at the following endpoints:

\n\n

Client-Specific Setup Instructions

\n\n

MCP Tools

\n

The Drata MCP Server exposes the following tools. Each tool maps to a Drata Public API v2 operation and requires the OAuth scope shown below. Access is always limited to the intersection of the scopes you grant and the permissions your Drata role already provides.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ToolDescriptionOAuth ScopeAllowed Roles
Get CompanyGet the account's company information.read:companyAdmin
Search ControlsSearch or list controls for a workspace.read:controlsAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Restricted Risk Manager, Risk Manager, Risk Register Owner, Workspace Administrator
Create ControlCreate a new control in a workspace.create:controlAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
Update ControlUpdate an existing control in a workspace.update:controlAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
List DevicesList a person's devices with each device's per-monitor compliance checks.read:deviceAdmin, Information Security Lead, Personnel Compliance Manager, Workspace Administrator
Get Evidence BucketGet one evidence bucket, including its renewal date, renewal cadence, and status.read:evidenceAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
List Evidence ArtifactsList the individual files inside one evidence bucket.read:evidenceAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
List Evidence BucketsList or search Evidence Library items via Public API v2, with optional client-side filtering.read:evidenceAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
Create Evidence BucketRegister (POST) a new evidence bucket with exactly one artifact via Public API v2.create:evidenceAdmin, Control Manager, Information Security Lead, Restricted Control Manager, Workspace Administrator
Delete Evidence ArtifactPermanently delete one file from an evidence bucket.delete:evidenceAdmin, Control Manager, Information Security Lead, Restricted Control Manager, Workspace Administrator
Delete Evidence BucketDelete an existing evidence library item.delete:evidenceAdmin, Control Manager, Information Security Lead, Restricted Control Manager, Workspace Administrator
Update Evidence ArtifactsAdd, replace, archive, or restore the files inside one evidence bucket.update:evidenceAdmin, Control Manager, Information Security Lead, Restricted Control Manager, Workspace Administrator
Update Evidence BucketUpdate an existing Evidence Library item.update:evidenceAdmin, Control Manager, Information Security Lead, Restricted Control Manager, Workspace Administrator
List RequirementsList framework requirements, with optional client-side code/name filter.read:frameworkAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
List Personnel GroupsList the personnel groups (teams / departments) in the account.read:personnelAdmin, Information Security Lead, Personnel Compliance Manager, Workspace Administrator
Search Monitoring TestsSearch or list monitoring tests for a workspace.read:monitor-testAdmin, Control Manager, DevOps Engineer, Information Security Lead, Restricted Control Manager, Workspace Administrator
List PersonnelList/search personnel (identity, employment, overall compliance) via OpenSearch.read:personnelAdmin, Information Security Lead, Personnel Compliance Manager, Workspace Administrator
Search Device ComplianceFind personnel by a specific DEVICE compliance reason (agent, encryption, antivirus, etc.).read:personnelAdmin, Information Security Lead, Personnel Compliance Manager, Workspace Administrator
Search Personnel ComplianceFind personnel by a specific PERSON compliance reason (policies, BG check, MFA, training, offboarding).read:personnelAdmin, Information Security Lead, Personnel Compliance Manager, Workspace Administrator
Update PersonnelUpdate a person's employment record, identified by personnel_id, email, or resolved name.update:personnelAdmin, Information Security Lead, Personnel Compliance Manager, Workspace Administrator
List PoliciesList account policies, or a user's assigned policies when assignedtouser is set.read:assigned-policies
read:policy		Admin, Control Manager, DevOps Engineer, Employee, Information Security Lead, Internal Auditor, Knowledge Base, Personnel Compliance Manager, Policy Manager, Restricted Control Manager, Restricted Risk Manager, Reviewer, Risk Manager, Trust Center Manager, Trust Center Reviewer, Trust User, Workspace Administrator
Search My Assigned PoliciesSearch policies assigned to the authenticated user.read:assigned-policiesAdmin, Control Manager, DevOps Engineer, Employee, Information Security Lead, Internal Auditor, Knowledge Base, Personnel Compliance Manager, Policy Manager, Restricted Control Manager, Restricted Risk Manager, Reviewer, Risk Manager, Trust Center Manager, Trust Center Reviewer, Trust User, Workspace Administrator
List Risk RegistersList all risk registers for the account.read:risk-registersAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager
Search RisksSearch or list risks from the risk register.read:riskAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Risk Register Owner, Workspace Administrator
Create RiskCreate a new risk in a risk register.create:riskAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Risk Register Owner, Workspace Administrator
Delete RiskDelete an existing risk from a risk register.delete:riskAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Risk Register Owner, Workspace Administrator
Update RiskUpdate an existing risk.update:riskAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Risk Register Owner, Workspace Administrator
Look Up User IdentityLook up a Drata account (incl. roles / SSO identities) via Public API v2.read:user
read:users		Admin, Control Manager, DevOps Engineer, Employee, Information Security Lead, Internal Auditor, Knowledge Base, Personnel Compliance Manager, Policy Manager, Restricted Control Manager, Restricted Risk Manager, Reviewer, Risk Manager, Risk Register Owner, Trust Center Manager, Trust Center Reviewer, Trust User, Workspace Administrator
Get VendorGet a single vendor by ID.read:vendorAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
List Vendor DocumentsList documents for a vendor, with optional filtering.read:vendor-documentAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
List Vendor Security ReviewsList security reviews for a vendor, with optional filtering.read:vendor-security-reviewAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
List VendorsList third-party vendors for the account, with optional filtering.read:vendorAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
Create VendorCreate a new vendor in the account.create:vendorAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
Delete VendorPermanently delete a vendor from the account.delete:vendorAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
Update VendorUpdate an existing vendor.update:vendorAdmin, Information Security Lead, Restricted Risk Manager, Risk Manager, Workspace Administrator
List WorkspacesList all workspaces.read:workspaceAdmin, Control Manager, DevOps Engineer, Information Security Lead, Personnel Compliance Manager, Policy Manager, Restricted Control Manager, Restricted Risk Manager, Risk Manager, Risk Register Owner
\n

Notes on roles:

\n\n\n

Important Security Considerations

\n
\n

Access Control: End users can only access the intersection of what the OAuth scopes offer and what their roles provide them access to. They cannot access anything beyond what their roles inside the application give them access to while using the MCP.

\n
\n

This means that even if an OAuth scope is granted, users are still limited by their role-based permissions within Drata.

\n

Next Steps

\n

After completing the OAuth configuration:

\n
    \n
  1. \nTest the connection with your MCP client\n
    2. \n
  2. \nVerify that the appropriate data is accessible (see \nBest Practices\n)\n
    3. \n
  3. \nMonitor usage and adjust scopes as needed\n
    4. \n
\n

Best Practices for Using the Drata MCP Server

\n

ChatGPT-Specific Tips

\n\n

Claude-Specific Tips

\n\n

Cursor-Specific Tips

\n\n

Security Reminders

\n\n

Prompt Library

\n

See the Drata MCP Setup & Usage Guide for a full prompt library and additional usage tips.

\n

Privacy

\n

The Drata MCP server operates on your own Drata data, in your own session, through your own OAuth grant — the connection stores no credentials of its own, and what any request can reach is bounded by the scopes you grant and your Drata role. Your data is handled under Drata's Privacy Notice. For how Drata secures its platform, see the Drata Trust Center.

\n

Support

\n","headings":[{"value":"MCP Server","depth":1},{"value":"Overview","depth":2},{"value":"Prerequisites","depth":2},{"value":"Configuration Steps","depth":2},{"value":"1. Configure the Drata MCP Server","depth":3},{"value":"2. Configure Your MCP Client","depth":3},{"value":"Client-Specific Setup Instructions","depth":4},{"value":"MCP Tools","depth":2},{"value":"Important Security Considerations","depth":2},{"value":"Next Steps","depth":2},{"value":"Best Practices for Using the Drata MCP Server","depth":2},{"value":"ChatGPT-Specific Tips","depth":3},{"value":"Claude-Specific Tips","depth":3},{"value":"Cursor-Specific Tips","depth":3},{"value":"Security Reminders","depth":3},{"value":"Prompt Library","depth":3},{"value":"Privacy","depth":2},{"value":"Support","depth":2}]},"contentItem":{"data":{"lastModified":"2026-09-03T23:32:02.000Z","enableToc":null,"disableLastModified":null,"tocMaxDepth":null,"requestLogin":false}},"siteConfig":{"enableToc":false,"disableLastModified":false,"tocMaxDepth":4}},"pageContext":{"matchPath":"","id":"426fba61-52a9-5047-bbc6-07abbd2e3526__redocly content/developer-portal/v2/mcp-server/","seo":{"title":"MCP Server","description":null,"image":"","keywords":null,"jsonLd":null,"lang":null,"siteUrl":null},"pageId":"developer-portal/v2/mcp-server.md","pageBaseUrl":"/developer-portal/v2/mcp-server","type":"markdown","toc":{"enable":true,"maxDepth":4,"headings":[{"depth":1,"value":"MCP Server","id":"mcp-server"},{"depth":2,"value":"Overview","id":"overview"},{"depth":2,"value":"Prerequisites","id":"prerequisites"},{"depth":2,"value":"Configuration Steps","id":"configuration-steps"},{"depth":3,"value":"1. Configure the Drata MCP Server","id":"1-configure-the-drata-mcp-server"},{"depth":3,"value":"2. Configure Your MCP Client","id":"2-configure-your-mcp-client"},{"depth":4,"value":"Client-Specific Setup Instructions","id":"client-specific-setup-instructions"},{"depth":2,"value":"MCP Tools","id":"mcp-tools"},{"depth":2,"value":"Important Security Considerations","id":"important-security-considerations"},{"depth":2,"value":"Next Steps","id":"next-steps"},{"depth":2,"value":"Best Practices for Using the Drata MCP Server","id":"best-practices-for-using-the-drata-mcp-server"},{"depth":3,"value":"ChatGPT-Specific Tips","id":"chatgpt-specific-tips"},{"depth":3,"value":"Claude-Specific Tips","id":"claude-specific-tips"},{"depth":3,"value":"Cursor-Specific Tips","id":"cursor-specific-tips"},{"depth":3,"value":"Security Reminders","id":"security-reminders"},{"depth":3,"value":"Prompt Library","id":"prompt-library"},{"depth":2,"value":"Privacy","id":"privacy"},{"depth":2,"value":"Support","id":"support"}]},"data":{"title":""},"catalogInfo":null,"link":"/developer-portal/v2/mcp-server/","sidebarName":"training","isLanding":false,"showPrevButton":null,"showNextButton":null,"apiVersions":null,"apiVersionId":null,"isDefaultApiVersion":null}},"staticQueryHashes":["1123603147","1302185487","1344209882","1398840060","1520077861","1975142765","2667623876","2950305614","3240152602","3743992808","561138138"]}