Drata agent skills for Claude Code, Cursor and RevampKey

5 ready-made playbooks that teach an AI agent how to do real Drata work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect Drata

Connect Drata once and all 5 skills install themselves and stay up to date. Mac, Windows and Linux.

All 5 Drata skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereAsks before writing24 Drata tools

Use the Drata connector safely

Confirms the workspace and region, explains what your role and scopes allow, and asks for explicit approval before any change to your compliance records.

Use it when

First connecting Drata and checking what the assistant can see
Getting a permission or access error from Drata
Looking up controls, evidence or vendors without changing anything

Tools it uses

Drata_getCompany
Drata_listWorkspaces
Drata_lookupUserIdentity
Drata_createControl
Drata_listEvidence
Drata_getEvidence
Drata_listEvidenceArtifacts
Drata_listPolicies
Drata_listRequirements
Drata_listRiskRegisters
Drata_createRisk
Drata_deleteRisk
Drata_listVendors
Drata_getVendor
Drata_listVendorDocuments
Drata_listVendorSecurityReviews
Drata_listPersonnel
Drata_listPersonnelGroups
Drata_listDevices
Drata_createEvidence
Drata_createVendor
Drata_deleteEvidence
Drata_deleteEvidenceArtifact
Drata_deleteVendor

Example

Which Drata workspace am I connected to, and can you change evidence from here?

You are connected to Acme Corp in the US region, workspace Production. This connection can read evidence, policies and vendors. It has no write scope, so I cannot create or delete evidence from here. If you need edits, your administrator would need to grant a write scope.

Use in RevampKeyRead the full skill →

Read-only6 Drata tools

Find evidence gaps against your Drata framework before the audit

Starts from a chosen framework's requirements, checks each against linked and current evidence in Drata, and returns a read-only gap list ranked by audit risk. It asks before changing anything.

Use it when

Preparing for a SOC 2 or ISO 27001 audit and need to know what is missing
Checking whether evidence for quarterly controls is still current
Finding requirements that have no control or evidence mapped to them

Tools it uses

Drata_getCompany
Drata_listWorkspaces
Drata_listRequirements
Drata_listEvidence
Drata_getEvidence
Drata_listEvidenceArtifacts

Example

Review our Drata evidence against SOC 2 and rank the gaps by audit risk.

I checked 64 SOC 2 requirements for Acme Corp in the US region. 41 are covered, 9 are missing evidence, 8 have stale evidence from before the audit window, and 6 have no mapped control. The highest-risk gap is quarterly access review evidence, which has no artifact for the last two quarters. I have not changed anything in Drata.

Use in RevampKeyRead the full skill →

Read-only5 Drata tools

Audit personnel compliance in Drata with AI

Finds people with overdue training, missing offboarding evidence or failing devices in Drata, and summarises who needs action and who owns it. Read-only; it asks before uploading documents or changing any employment record.

Use it when

Before an audit, when you need to know which people would fail a sample check
After a round of offboarding, to confirm departures were evidenced
When device compliance drops and you need to know which employees are affected

Tools it uses

Drata_listPersonnel
Drata_listPersonnelGroups
Drata_listDevices
Drata_getEvidence
Drata_listEvidence

Example

Who in engineering is overdue on security training, and which of their devices are failing?

Across the engineering group there are 9 active people with overdue security training: 4 are more than 30 days late and 5 are within two weeks of the deadline. Two of the overdue people also have a failing laptop check. One departed employee has no offboarding record and should be treated as critical. I have not changed anything. Want me to draft the reminders for the owners?

Use in RevampKeyRead the full skill →

Asks before writing5 Drata tools

Review your Drata risk register with AI

Reviews a Drata risk register for untreated, unowned and stale risks, then drafts a prioritised summary for your risk committee. It only reads; it asks before creating any risk.

Use it when

Preparing the agenda for the quarterly risk committee
Checking whether every high-rated risk has an owner and a treatment
Finding risks that have not been reviewed in over a year

Tools it uses

Drata_getCompany
Drata_listWorkspaces
Drata_listRiskRegisters
Drata_createRisk
Drata_deleteRisk

Example

Review our Drata risk register for the committee and tell me which high risks have no owner or treatment.

I checked the EU workspace's main register. 3 risks have no owner and 2 high-rated risks have no treatment decided, so these need a decision first. The rest are stale medium or low risks that can be confirmed in a routine pass. I have drafted one new risk for vendor concentration, which I will create only if you approve it.

Use in RevampKeyRead the full skill →

Read-only5 Drata tools

Triage vendor risk in Drata with AI

Reviews your Drata vendor inventory and security reviews, then ranks third parties with missing documents, unreviewed high-risk vendors or no owner into a prioritised follow-up list. Read-only: it changes nothing in Drata.

Use it when

Before a SOC 2 or ISO audit, to find vendors missing a current security review
When a quarterly review cycle starts and you need to see which third parties are overdue
When an auditor asks which high-risk vendors have a document on file and who owns them

Tools it uses

Drata_listWorkspaces
Drata_listVendors
Drata_getVendor
Drata_listVendorSecurityReviews
Drata_listVendorDocuments

Example

Triage our vendors in Drata and tell me which high-risk ones are overdue for review or missing a document.

Workspace: Acme Production (US). 58 vendors in scope, 14 reviewed in full. P1: 3 high-risk vendors have no security review on record, including a payments processor with customer data and no current SOC 2 report on file. P2: 6 medium-risk vendors have reviews past the annual cycle. 9 active vendors have no named owner. Remaining low-risk items are counted only.

Use in RevampKeyRead the full skill →

Get all 5 without copying a file

RevampKey adds the skills when you connect Drata, updates them for you and removes them when you disconnect.

Download RevampKey

How Drata skills work

Connect Drata
The Drata MCP server gives the agent its tools.
Ask in plain words
“Review our Drata evidence against SOC 2 and rank the gaps by audit risk.” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install Drata skills

In RevampKey the skills install themselves when you connect Drata. In other tools each skill is one folder with a SKILL.md file, and you also need the Drata MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect Drata. All 5 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Review our Drata evidence against SOC 2 and rank the gaps by audit risk.”
Download RevampKeyConnect Drata · 1 click
Get RevampKey to connect Drata
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and Drata is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials evidence-gap-review personnel-compliance-audit risk-register-review vendor-risk-triage; do curl -fsSL --create-dirs -o .claude/skills/drata-$s/SKILL.md https://revampkey.com/marketplace/drata/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the Drata MCP server in Claude Code.

Run this in your project folder to add all 5 skills:

for s in essentials evidence-gap-review personnel-compliance-audit risk-register-review vendor-risk-triage; do
  curl -fsSL --create-dirs -o .claude/skills/drata-$s/SKILL.md https://revampkey.com/marketplace/drata/skills/$s/SKILL.md
done

Ask in plain language, for example “Review our Drata evidence against SOC 2 and rank the gaps by audit risk.”

Into the shared .agents/skills folder

Connect the Drata MCP server in Cursor.

Run this in your project folder to add all 5 skills:

for s in essentials evidence-gap-review personnel-compliance-audit risk-register-review vendor-risk-triage; do
  curl -fsSL --create-dirs -o .agents/skills/drata-$s/SKILL.md https://revampkey.com/marketplace/drata/skills/$s/SKILL.md
done

Ask in plain language, for example “Review our Drata evidence against SOC 2 and rank the gaps by audit risk.”

Into the shared .agents/skills folder

Connect the Drata MCP server in Codex.

Run this in your project folder to add all 5 skills:

for s in essentials evidence-gap-review personnel-compliance-audit risk-register-review vendor-risk-triage; do
  curl -fsSL --create-dirs -o .agents/skills/drata-$s/SKILL.md https://revampkey.com/marketplace/drata/skills/$s/SKILL.md
done

Ask in plain language, for example “Review our Drata evidence against SOC 2 and rank the gaps by audit risk.”

Into the shared .agents/skills folder

Connect the Drata MCP server in VS Code.

Run this in your project folder to add all 5 skills:

for s in essentials evidence-gap-review personnel-compliance-audit risk-register-review vendor-risk-triage; do
  curl -fsSL --create-dirs -o .agents/skills/drata-$s/SKILL.md https://revampkey.com/marketplace/drata/skills/$s/SKILL.md
done

Ask in plain language, for example “Review our Drata evidence against SOC 2 and rank the gaps by audit risk.”

RevampKey or copy the files?

In RevampKey

One click when you connect Drata
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the Drata MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

Drata skills FAQ

What is a Drata agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each Drata skill describes one job, which Drata tools to use in which order, what to check first and when to stop and ask you.

Do the Drata skills change anything on their own?

3 of the 5 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in Drata.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect Drata; elsewhere you copy the folders into your project or skills directory.

Do I need the Drata MCP server too?

Yes. The skills tell the agent how to do the work; the Drata MCP server gives it the tools to do it. The Drata MCP setup guide covers every client.

Drata MCP server setup · This page as Markdown

Put Drata’s best workflows in your agent

Download RevampKey, connect Drata and ask your first question in about a minute.

Download RevampKey Connect Drata · 1 click

All 5 Drata skills

Use the Drata connector safely

Use it when

Tools it uses

Find evidence gaps against your Drata framework before the audit

Use it when

Tools it uses

Audit personnel compliance in Drata with AI

Use it when

Tools it uses

Review your Drata risk register with AI

Use it when

Tools it uses

Triage vendor risk in Drata with AI

Use it when

Tools it uses

Get all 5 without copying a file

How Drata skills work

How to install Drata skills

RevampKey or copy the files?

In RevampKey

Copy into your project

Drata skills FAQ

Put Drata’s best workflows in your agent

Skills for related tools