Vanta agent skills for Claude Code, Cursor and RevampKey

5 ready-made playbooks that teach an AI agent how to do real Vanta work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect Vanta

Connect Vanta once and all 5 skills install themselves and stay up to date. Mac, Windows and Linux.

All 5 Vanta skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereAsks before writing1 Vanta tools

Use the Vanta connector safely with AI

Confirms your Vanta region and role, reads compliance data before touching anything, and asks for your explicit yes before any change is made in Vanta.

Use it when

You have just connected Vanta to your AI assistant and want to check it is pointed at the right region
Your assistant reports a permission error and you need to know whether your role is the cause
You want to change something in Vanta and need the assistant to show the change before applying it

Tools it uses

addDocumentsToEvidenceRequest

Example

Connect me to Vanta and check I'm on the right region before we look at any controls.

You are connected to the US region as Jordan, signed in with the Editor role. I read 2 frameworks and 0 changes have been made. Adding the new evidence document to the access review request would change one request, and I have not done it yet. Say yes if you want me to proceed.

Use in RevampKeyRead the full skill →

Asks before writing3 Vanta tools

Triage failing Vanta controls with AI

Sorts failing Vanta controls and tests into a ranked fix-first list, separating real gaps from stale evidence, owner-less items and integration noise. It only reads and never changes anything in Vanta.

Use it when

Before an audit, when you need to know what to fix first
When a framework shows many failing tests and you need to find the real gaps
When you want to check which failures are stale evidence rather than missing controls

Tools it uses

assignTestOwnership
createControls
addDocumentsToEvidenceRequest

Example

Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.

I reviewed 38 failing items in the US instance, as an Editor. 9 are real gaps, 14 are stale evidence, 6 have no owner and 9 come from a disconnected GitHub integration. The top fix is production database encryption, which clears four tests and sits in the SOC 2 window. Nothing has been changed; I'll wait for your go-ahead before assigning owners or refreshing evidence.

Use in RevampKeyRead the full skill →

Asks before writing2 Vanta tools

Assemble evidence for Vanta evidence requests

Works out which open evidence requests need documents, matches current, in-period files to each one, and builds an attachment plan. It asks for your approval before attaching anything.

Use it when

An auditor has sent a list of open evidence requests and you need to know what you can answer today
A control needs a dated sample of artefacts and you want to know whether the count is met
A policy was updated and you want to check the attached version is still the approved one

Tools it uses

addDocumentsToEvidenceRequest
createCustomDocuments

Example

Which of the open SOC 2 evidence requests can I answer from existing documents? Show me the plan before attaching anything.

Of 14 open SOC 2 requests, 9 can be answered from existing approved documents. The information security policy is current and approved, so I'd attach it, but a newer draft sits beside it, so I've flagged that. Three requests need a fresh screenshot, and two need a sample you haven't yet collected. Nothing is attached until you approve the list.

Use in RevampKeyRead the full skill →

Asks before writing4 Vanta tools

Review Vanta policy and control mapping with AI

Finds unmapped risks, orphaned controls and empty policies in your Vanta mapping, and drafts the link changes for your approval. It does not change anything until you say yes.

Use it when

Before an audit, to check that every risk has a control behind it
After importing a framework, to see which controls have no policy
When a scope change leaves risks or controls pointing at nothing

Tools it uses

createPolicies
createControls
createPolicyControlMappings
createRiskScenarios

Example

Check our Vanta policy-to-control mapping and tell me which risks have no control.

I found 12 risks with no treating control. Seven look like missing mappings to existing access-review controls, and five need a new control. I have drafted the seven mappings as one batch and the five new controls as a second batch. Nothing is applied yet. Tell me which batch to apply.

Use in RevampKeyRead the full skill →

Asks before writing8 Vanta tools

Prepare a privacy assessment or data subject request in Vanta

Gathers the inventory, processing and vendor facts a privacy assessment needs, flags blocking gaps and deadlines, and drafts the records for review. It asks before creating or changing anything in Vanta.

Use it when

A new processing activity needs a privacy assessment before launch
A data subject request is coming in and the deadline needs checking
An existing processing record needs its facts refreshed before audit

Tools it uses

createDataController
createControllerProcessingActivity
createProcessorCategoryOfProcessing
createPrivacyAssessmentVersion
createPrivacyAssessment
createDataInventoryCustomFields
createTPRMVendorCustomFields
createDataSubjectRequest

Example

Prepare the privacy assessment for our new customer support chatbot, and tell me what's missing before we can sign it off.

Deadline: none recorded for this assessment. Confirmed in Vanta: the chatbot's vendor record exists with 2 data categories. Missing, blocking: no lawful basis recorded and the retention period is not stated. Weakens: the safeguards are described only generally. I have drafted the assessment text but created nothing. Approve creating the new assessment and I will do it.

Use in RevampKeyRead the full skill →

Get all 5 without copying a file

RevampKey adds the skills when you connect Vanta, updates them for you and removes them when you disconnect.

Download RevampKey

How Vanta skills work

Connect Vanta
The Vanta MCP server gives the agent its tools.
Ask in plain words
“Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install Vanta skills

In RevampKey the skills install themselves when you connect Vanta. In other tools each skill is one folder with a SKILL.md file, and you also need the Vanta MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect Vanta. All 5 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.”
Download RevampKeyConnect Vanta · 1 click
Get RevampKey to connect Vanta
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and Vanta is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials control-gap-triage evidence-request-assembly policy-and-control-mapping-review privacy-assessment-prep; do curl -fsSL --create-dirs -o .claude/skills/vanta-$s/SKILL.md https://revampkey.com/marketplace/vanta/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the Vanta MCP server in Claude Code.

Run this in your project folder to add all 5 skills:

for s in essentials control-gap-triage evidence-request-assembly policy-and-control-mapping-review privacy-assessment-prep; do
  curl -fsSL --create-dirs -o .claude/skills/vanta-$s/SKILL.md https://revampkey.com/marketplace/vanta/skills/$s/SKILL.md
done

Ask in plain language, for example “Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.”

Into the shared .agents/skills folder

Connect the Vanta MCP server in Cursor.

Run this in your project folder to add all 5 skills:

for s in essentials control-gap-triage evidence-request-assembly policy-and-control-mapping-review privacy-assessment-prep; do
  curl -fsSL --create-dirs -o .agents/skills/vanta-$s/SKILL.md https://revampkey.com/marketplace/vanta/skills/$s/SKILL.md
done

Ask in plain language, for example “Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.”

Into the shared .agents/skills folder

Connect the Vanta MCP server in Codex.

Run this in your project folder to add all 5 skills:

for s in essentials control-gap-triage evidence-request-assembly policy-and-control-mapping-review privacy-assessment-prep; do
  curl -fsSL --create-dirs -o .agents/skills/vanta-$s/SKILL.md https://revampkey.com/marketplace/vanta/skills/$s/SKILL.md
done

Ask in plain language, for example “Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.”

Into the shared .agents/skills folder

Connect the Vanta MCP server in VS Code.

Run this in your project folder to add all 5 skills:

for s in essentials control-gap-triage evidence-request-assembly policy-and-control-mapping-review privacy-assessment-prep; do
  curl -fsSL --create-dirs -o .agents/skills/vanta-$s/SKILL.md https://revampkey.com/marketplace/vanta/skills/$s/SKILL.md
done

Ask in plain language, for example “Triage our failing SOC 2 controls in Vanta and tell me what to fix first before the audit.”

RevampKey or copy the files?

In RevampKey

One click when you connect Vanta
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the Vanta MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

Vanta skills FAQ

What is a Vanta agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each Vanta skill describes one job, which Vanta tools to use in which order, what to check first and when to stop and ask you.

Do the Vanta skills change anything on their own?

The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in Vanta.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect Vanta; elsewhere you copy the folders into your project or skills directory.

Do I need the Vanta MCP server too?

Yes. The skills tell the agent how to do the work; the Vanta MCP server gives it the tools to do it. The Vanta MCP setup guide covers every client.

Vanta MCP server setup · This page as Markdown

Put Vanta’s best workflows in your agent

Download RevampKey, connect Vanta and ask your first question in about a minute.

Download RevampKey Connect Vanta · 1 click

All 5 Vanta skills

Use the Vanta connector safely with AI

Use it when

Tools it uses

Triage failing Vanta controls with AI

Use it when

Tools it uses

Assemble evidence for Vanta evidence requests

Use it when

Tools it uses

Review Vanta policy and control mapping with AI

Use it when

Tools it uses

Prepare a privacy assessment or data subject request in Vanta

Use it when

Tools it uses

Get all 5 without copying a file

How Vanta skills work

How to install Vanta skills

RevampKey or copy the files?

In RevampKey

Copy into your project

Vanta skills FAQ

Put Vanta’s best workflows in your agent

Skills for related tools