Unsanctioned MCP server in useVanta MCP
Resolved: now enforcedObservedWhat happened
Vanta MCP connected at 14:09; 6 tool calls (list_controls, get_evidence …)
Why it violates
Detect use of an MCP server that is not sanctioned for the applicable user, team, device, or other governed scope.
TrainingUnapproved MCP servers3 minutes · assigned by the policy on detection · sent to User A on mac-a1Assignednothing is blocked meanwhile (D9)Open the training as User A →
History
4 rows · append-onlyTime | Kind | Actor | What → State | Cause |
|---|---|---|---|---|
| 2026-10-08 14:09 | System | qdash | detected → open | policy evaluation · Policy Config v12 |
| 2026-10-09 09:15 | Re-evaluationv12 | qdash | re-evaluated → resolved: allowed | CH-1Exception: Off for Team A — Team A owns the Vanta integration |
| 2026-10-14 08:00 | Re-evaluationv12 | qdash | reopened → open | CH-5Exception E-A revoked: Team A moved off Vanta |
| 2026-10-14 08:00 | Re-evaluationv12 | qdash | enforcement confirmed → resolved: now enforced | CH-5Now enforced on mac-a1 · Exception E-A revoked: Team A moved off Vanta |
Details
Severity
high
Status
Resolved: now enforced
Outcome
Observedat detection
User
UA
User ATeam
Team A
Endpoint
Configuration
Applies via
Framework(s)
OWASP LLM Top 10OWASP Agentic Top 10NIST AI RMFSOC 2Related Findings
Same sessionS-11 open · 0 resolved
Severity | Finding | User | Status |
|---|---|---|---|
| high | F-C Personal account is in useusera@gmail.com | User A | Open |
Same policyUnsanctioned MCP server in use0 open · 2 resolved
Unsanctioned MCP server in use0 open · 2 resolvedSeverity | Finding | User | Status |
|---|---|---|---|
| high | F-BVanta MCP | User B | Resolved: now enforced |
| high | F-ELinear MCP | Dev | Resolved: prevented |
Session
S-1 · 2026-10-08 14:02Chat Transcript
4 turnsI need help with compliance evidence export. Start by looking at what's in the repo.
UA
I'll read the project layout first.
Before we start, which account is this running under?
UA
Pull the current control list and the evidence for each one, and put it in a table I can send.
UA
I'll use the Vanta MCP tools to read the controls and their evidence.
Is that everything?
UA
Yes. That's the change, and I've left a note on what still needs a decision.