Drata MCP

Drata MCP gives an AI assistant direct access to the compliance graph an organization maintains in Drata, a security and compliance automation platform. That graph normally spans framework mappings, control ownership, evidence links and continuous monitoring results, which is tedious to correlate by hand when an auditor asks a specific question. On reads the server covers controls, policies, frameworks, requirements and the mappings between them, risks and risk registers, evidence library items and what each is linked to, personnel records with groups, compliance status and custom fields, devices and their compliance checks, vendors with questionnaires and security reviews, monitoring tests with their results, and workspace identity and access information. That is enough for an assistant to answer audit style questions such as which controls a failing test affects, which personnel are out of compliance, or what evidence backs a given requirement. Writes are supported but gated. An agent can create, update and delete controls, evidence items, risks and vendors, update personnel details such as employment status and custom fields, and create or update policies. Access is the intersection of the OAuth scopes granted to the connection and the role the user already holds in Drata, so the server can never exceed what its operator could do in the app. Write capable scopes are meant to be granted deliberately, which makes a read only setup the sensible default for most compliance teams.