Drata MCP integration for AI agents.
Connect AI agents to Drata through 8 structured actions, including get company, get control, and get personnel. Review authentication, inputs, workflows, and…
- ACTION CONTRACTS
- 8
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Drata integration exposes
The Drata Agent App exposes 8 provider-backed actions for security and productivity work. Its current contract lets an authorized agent get company metadata for the connected drata account, get one drata control by id or code-prefixed identifier, and get one drata personnel record by id or email-prefixed identifier. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Drata account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Drata capabilities.
Showing 8 of 8 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_companyREADGet company metadata for the connected Drata account.
get_controlREADGet one Drata control by ID or code-prefixed identifier.
INPUTS: workspaceId / controlId / cursor / size / sort
get_personnelREADGet one Drata personnel record by ID or email-prefixed identifier.
INPUTS: personnelId / expand
get_vendorREADGet one Drata vendor by ID.
INPUTS: vendorId / expand
list_controlsREADList controls in a Drata workspace.
INPUTS: workspaceId / cursor / size / sort / sortDir
list_personnelREADList Drata personnel visible to the current API key.
INPUTS: cursor / size / sort / sortDir / includeTotalCount
list_vendorsREADList vendors in Drata.
INPUTS: cursor / size / sort / sortDir / includeTotalCount
list_workspacesREADList Drata workspaces visible to the current API key.
INPUTS: cursor / size / sort / sortDir / includeTotalCount
INPUT CONTRACTS
Know what the action needs before it runs.
get_control
workspaceIdREQUIRED- The Drata workspace ID.
controlIdREQUIRED- The control ID or a code-prefixed identifier.
cursorOPTIONAL- The Drata cursor returned in pagination.cursor by a previous list response.
sizeOPTIONAL- The number of results to return.
sortOPTIONAL- The Drata field name to sort by.
get_personnel
personnelIdREQUIRED- The personnel ID or an email-prefixed identifier.
expandOPTIONAL- Related Drata subcollections and sub-objects to expand.
get_vendor
vendorIdREQUIRED- The Drata vendor ID.
expandOPTIONAL- Related Drata subcollections and sub-objects to expand.
list_controls
workspaceIdREQUIRED- The Drata workspace ID.
cursorOPTIONAL- The Drata cursor returned in pagination.cursor by a previous list response.
sizeOPTIONAL- The number of results to return.
sortOPTIONAL- The Drata field name to sort by.
sortDirOPTIONAL- The direction to sort returned data.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Company
Get company metadata for the connected Drata account. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_companyVerify with Get Control
Get one Drata control by ID or code-prefixed identifier. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_controlSAFETY BOUNDARY
Operate Drata with explicit limits
- Authorize Drata with API key and grant only the provider access required by the selected actions.
- The current action names appear read-oriented, but returned Drata data may still be sensitive and should be minimized before it enters model context.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Drata rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Drata task completed successfully.
CONNECTION MODEL
API key
Drata API key used with the Authorization Bearer header. Create or view API keys in Drata as documented at https://help.drata.com/en/articles/6695964.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 8
- WRITE SIGNALS
- 0
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 0
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Drata.