@vendortrace/mcp

MCP server for VendorTrace. Query your vendor compliance data from Claude, Cursor, Windsurf, and any MCP-compatible AI assistant.

What it does

Exposes your VendorTrace vendor register, scan results, transfer risk analysis, and questionnaire status as MCP tools. Ask your AI assistant about vendor compliance without leaving your workflow.

Tools

| Tool | Description | |------|-------------| | get_compliance_summary | Portfolio-wide briefing: transfer risk totals, unreviewed changes, pending questionnaires. Start here. | | list_vendors | List tracked vendors with transfer risk level, resolution status, and last scan date. | | get_vendor | Latest scan result for a domain: detected third-party services, geographic regions, certifications. | | scan_vendor | Trigger an outside-in scan of a vendor domain. Optionally wait for results. | | get_vendor_changes | Infrastructure changes detected since the last scan: new vendors, new countries added or removed. | | get_transfer_risks | Portfolio-wide breakdown of vendors by transfer mechanism (SCC, adequacy decision, no mechanism). | | list_questionnaires | Questionnaires sent to vendors with status and open discrepancy count. |

Setup

1. Get an API key

Create an API key at vendortrace.io/account/api-keys.

2. Add to your AI client

Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "vendortrace": {
      "command": "npx",
      "args": ["-y", "@vendortrace/mcp"],
      "env": {
        "VENDORTRACE_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor — add to .cursor/mcp.json in your project, or ~/.cursor/mcp.json globally:

{
  "mcpServers": {
    "vendortrace": {
      "command": "npx",
      "args": ["-y", "@vendortrace/mcp"],
      "env": {
        "VENDORTRACE_API_KEY": "your-api-key"
      }
    }
  }
}

Windsurf — edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "vendortrace": {
      "command": "npx",
      "args": ["-y", "@vendortrace/mcp"],
      "env": {
        "VENDORTRACE_API_KEY": "your-api-key"
      }
    }
  }
}

Claude Code — add .mcp.json to your project root:

{
  "mcpServers": {
    "vendortrace": {
      "command": "npx",
      "args": ["-y", "@vendortrace/mcp"],
      "env": {
        "VENDORTRACE_API_KEY": "your-api-key"
      }
    }
  }
}

Environment variables

| Variable | Required | Description | |----------|----------|-------------| | VENDORTRACE_API_KEY | Yes | API key from vendortrace.io/account/api-keys | | VENDORTRACE_API_URL | No | Override the API base URL. Defaults to https://api.vendortrace.io. |

Example prompts

• "Give me a compliance summary across my vendors"
• "Which vendors have no transfer mechanism in place?"
• "Show me unreviewed infrastructure changes from this week"
• "Scan stripe.com and tell me what third-party services they use"
• "Are there any questionnaires waiting for a response?"
• "What countries are in my vendor footprint?"

Requirements

• Node.js 20 or later
• A VendorTrace account with at least one domain scanned

License

MIT