Skip to main content
Glama
tobiaslofton

Trust Center, SOC 2 Compliance & IAM Security Auditor

by tobiaslofton
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

🛡️ Trust Center, SOC 2 Compliance & IAM Security Auditor — MCP Server

tobiaslofton/trust-center-iam-auditor MCP server

A standalone, self-contained Model Context Protocol (MCP) Server written in Python (mcp_server.py) that enables AI assistants (Claude Desktop, Cursor, Windsurf, Cline, and custom MCP clients) to audit any company domain's live Trust Center, SOC 2 / ISO 27001 / HIPAA certifications, AI & cloud sub-processors, DNS/TXT Identity & Security stack, SPF/DMARC email hardening, and Status Page health directly over local stdio.

Zero third-party API keys or external cloud subscriptions are required. All DNS resolution (dnspython) and HTTP Trust Center inspection (httpx + BeautifulSoup4) execute locally inside the server process.

🔧 MCP Tools Provided

This MCP server exposes two tools over JSON-RPC 2.0 stdio:

1. audit_vendor_domain

Audits a single company domain and returns a structured compliance, sub-processor, and DNS security posture report.

  • Input Schema:

    • domain (string, required): Company domain to inspect (e.g., "vanta.com", "drata.com", "linear.app").

2. batch_audit_vendor_domains

Concurrently audits up to 15 company domains in parallel using asynchronous DNS and HTTP probing.

  • Input Schema:

    • domains (array[string], required): List of company domains to inspect concurrently.

Related MCP server: domain-security-mcp-server

📦 Installation & Local MCP Configuration

Prerequisites

  • Python 3.11+ (or Docker)

  • Dependencies: httpx, dnspython, beautifulsoup4, pydantic

git clone https://github.com/tobiaslofton/trust-center-iam-auditor.git
cd trust-center-iam-auditor
pip install -r requirements.txt

Option 1: Claude Desktop / Cursor / Windsurf (uv or python over stdio)

Add the following entry to your claude_desktop_config.json or .cursor/mcp.json:

{
  "mcpServers": {
    "trust-center-iam-auditor": {
      "command": "python",
      "args": [
        "/absolute/path/to/trust-center-iam-auditor/mcp_server.py"
      ]
    }
  }
}

Or using uv:

{
  "mcpServers": {
    "trust-center-iam-auditor": {
      "command": "uv",
      "args": [
        "--directory",
        "/absolute/path/to/trust-center-iam-auditor",
        "run",
        "python",
        "mcp_server.py"
      ]
    }
  }
}

Option 2: Run via Docker (stdio)

Build the local image and connect via docker run -i:

docker build -t trust-center-iam-auditor .
{
  "mcpServers": {
    "trust-center-iam-auditor": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "trust-center-iam-auditor"
      ]
    }
  }
}

🔍 What Signals Does the MCP Server Extract?

Category

Extracted Signals & Fields

Trust Center Platform

Fingerprints Vanta, Drata, SafeBase, Conveyor, Secureframe, Whistic, OneTrust, Hyperproof, or custom Trust Centers + direct URL via HTML signatures and trust.<domain> / security.<domain> CNAME inspection.

Compliance Frameworks

Detects SOC 2 Type II, SOC 3, ISO 27001, ISO 27701, ISO 42001 (AI), HIPAA, GDPR, PCI-DSS, FedRAMP, CSA STAR, NIST CSF / 800-53, CCPA / CPRA.

DNS Identity & Security Stack

Inspects root TXT, MX, and CNAME records for Okta, Microsoft Entra ID / M365, Google Workspace, Ping Identity, OneLogin, Duo, 1Password, Wiz, Proofpoint, Mimecast, KnowBe4, Atlassian Cloud, and Slack Enterprise.

Cloud & AI Sub-processors

Identifies disclosed sub-processors including AWS, Google Cloud (GCP), Azure, Snowflake, Databricks, OpenAI, Anthropic, Stripe, Datadog, Cloudflare, MongoDB, Auth0, and Vercel.

Email & DNS Hardening

Verifies SPF (v=spf1), DMARC (_dmarc.<domain> v=DMARC1), MX routing hosts, and subdomain CNAME targets.

Live Status Page Health

Probes status.<domain> (including Atlassian Statuspage /api/v2/status.json) for real-time operational health.

Risk Score & GRC Summary

Computes a deterministic 0–100 Trust Score, Risk Tier (LOW, MODERATE, ELEVATED), GRC TPRM Summary, and Technographic Footprint.

📊 Example Tool Output (audit_vendor_domain)

{
  "domain": "vanta.com",
  "trust_score": 100,
  "risk_tier": "LOW RISK (Enterprise Ready)",
  "trust_center_platform": "Vanta",
  "trust_center_url": "https://trust.vanta.com",
  "certifications": [
    "CCPA / CPRA",
    "FedRAMP",
    "GDPR",
    "HIPAA",
    "ISO 27001",
    "ISO 42001 (AI)",
    "NIST CSF / 800-53",
    "PCI-DSS",
    "SOC 2 Type II"
  ],
  "subprocessors": [
    "Amazon Web Services (AWS)",
    "Datadog",
    "HubSpot",
    "Intercom",
    "Okta",
    "OpenAI",
    "Snowflake"
  ],
  "identity_providers": [
    "Atlassian Cloud",
    "Google Workspace",
    "Microsoft Entra ID / M365",
    "Slack Enterprise"
  ],
  "spf_enabled": true,
  "dmarc_enabled": true,
  "status_page_url": "https://status.vanta.com",
  "status_page_indicator": "NONE (All Systems Operational)",
  "grc_summary": "vanta.com operates a Vanta trust posture (Score: 100/100) with CCPA / CPRA, FedRAMP, GDPR, HIPAA, ISO 27001, ISO 42001 (AI), NIST CSF / 800-53, PCI-DSS, SOC 2 Type II. Email/DNS authentication is enforced (SPF+DMARC).",
  "b2b_sales_signal": "Technographic footprint for vanta.com: Trust Platform=Vanta; Identity/Security DNS=Atlassian Cloud, Google Workspace, Microsoft Entra ID / M365, Slack Enterprise; Detected Cloud/Sub-processors=Amazon Web Services (AWS), Datadog, HubSpot, Intercom, Okta."
}

📄 License

MIT License — see LICENSE.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • websec-auditor

    sheiscypher
    F
    license
    Not graded
    quality
    B
    maintenance
    Passive website security and trust auditor that checks for security, SEO, AI surface, email, and other exposures, producing a score and remediation plan.
    -

  • CyberMCP

    mrobi27
    F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to perform cybersecurity analysis including RDAP lookup, DNS analysis, SSL inspection, security header detection, and more, returning structured security reports.
    -

  • trust-score

    Br0ski777
    A
    license
    Not graded
    quality
    C
    maintenance
    Provides AI agents with zero-cost, zero-dependency trust evaluation for domains, URLs, wallets, APIs, and IPs, returning a 0-100 score with SSL, DNS, WHOIS, security header, and content sub-scores, plus batch comparison to rank multiple targets.
    MIT