feat(integrations): add Vanta integration with compliance, evidence file, people, vendor, vulnerability, and risk tools

[waleedlatif1]

Summary

• Add Vanta integration with 29 tools covering frameworks, controls, tests (incl. failing test entities), evidence documents (list/get/upload file/download file/submit), people, policies, vendors, monitored computers, vulnerabilities, vulnerability remediations, vulnerable assets, and risk scenarios
• Auth via Vanta OAuth client credentials (client ID + secret), exchanged server-side per request; supports US (api.vanta.com) and Gov/FedRAMP (api.vanta-gov.com) regions
• Three internal API routes (/api/tools/vanta/query|upload|download) behind withRouteHandler + checkInternalAuth, with a contract-validated discriminated-union body; responses normalized field-for-field against Vanta's OpenAPI spec
• Evidence file upload uses the standard UserFile pipeline (processFilesToUserFiles + assertToolFileAccess + downloadFileFromStorage, multipart to Vanta); document file download returns execution files via FileToolProcessor
• Vanta block with operation dropdown, conditional/advanced subblocks, basic/advanced file input (canonicalParamId), BlockMeta with 7 templates + 5 skills grounded in Vanta's own guides
• Generated docs page with manual intro; bumped check:api-validation route baseline 812 → 815 for the new routes

Type of Change

• New feature

Testing

• Typecheck clean, biome clean, check:api-validation:strict passes
• Tool/block registry test suites pass (157 tests)
• Every endpoint, parameter, and enum cross-validated against Vanta's published OpenAPI spec (manage-vanta.json); token flow and upload scope verified against Vanta's auth and document-upload guides

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jun 12, 2026 5:45pm

[cursor]

PR Summary

Medium Risk
New server routes handle OAuth secrets and can upload/submit auditor-visible evidence; mitigations include internal auth, file access checks, and size limits, but mis-scoped credentials or workflows could affect real Vanta data.

Overview
Adds a Vanta security/compliance integration end-to-end: 29 workflow tools (frameworks, controls, tests and failing entities, evidence documents, people, policies, vendors, devices, vulnerabilities, risk scenarios) plus a large Vanta block, registry wiring, VantaIcon, docs (vanta.mdx, integrations catalog), and icon mappings.

Server-side access goes through /api/tools/vanta/query, upload, and download, with Zod contracts, internal auth, OAuth client-credentials per request (US vs Gov base URL), normalized API responses, and scoped tokens for read/write/document upload. Evidence upload uses the existing file pipeline and access checks; download streams with a 100MB cap and returns base64 execution files.

Submit document is a write operation on the query route. BlockMeta adds templates and agent skills for common compliance workflows.

^{Reviewed by Cursor Bugbot for commit c160878. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[greptile-apps]

Greptile Summary

This PR adds a complete Vanta integration with 29 tools spanning compliance frameworks, controls, tests, evidence documents (upload/download/submit), people, policies, vendors, monitored computers, vulnerabilities, and risk scenarios. Auth is handled server-side via OAuth client credentials with an in-memory token cache that includes SHA-256 hashing of secrets, scope-based cache keys, concurrent-request deduplication, and a 401-triggered force-refresh retry.

• Three internal API routes (/api/tools/vanta/query|upload|download) behind withRouteHandler + checkInternalAuth; the download route uses an incremental streaming read to enforce the 100 MB cap without buffering; the upload route validates fileContent size at the schema level before Buffer.from allocates.
• All tool params, normalizers, and contract schemas are cross-validated against Vanta's OpenAPI spec; a Zod discriminated union covers all 27 query operations, and the block's params function correctly applies dropdown/tri-state transformations while letting the executor auto-merge the raw block inputs.

Confidence Score: 5/5

Safe to merge; the one open question is whether Vanta's single-active-token-per-application constraint is global across scopes or per-scope, which determines whether the current scope-split caching causes extra retries in mixed read/write workflows.

Auth logic, token caching (SHA-256 hashing, TTL buffer, in-flight deduplication, 401 retry), upload size guards (schema-level .max() + post-decode check), and download size cap (incremental streaming read) all look correct. No missing required fields, broken contracts, or data-loss paths were found.

apps/sim/tools/vanta/utils.ts — specifically the three scope-keyed token cache entries and whether they interact correctly with Vanta's per-application token revocation behavior.

Important Files Changed

Filename	Overview
apps/sim/tools/vanta/utils.ts	Token caching, SHA-256 secret hashing, concurrent deduplication, 401-retry via fetchVantaWithAuth, and all normalizer functions. Logic is correct; token cache eviction relies on TTL check rather than explicit pruning.
apps/sim/app/api/tools/vanta/query/route.ts	Discriminated-union dispatch for 27 query/submit operations; scope promoted to WRITE for submit_document; auth inside try/catch; error body and status code forwarded from Vanta.
apps/sim/app/api/tools/vanta/upload/route.ts	Handles both UserFile pipeline and base64 fileContent paths; size guard fires before the Vanta multipart POST; schema-level max on fileContent prevents large allocations.
apps/sim/app/api/tools/vanta/download/route.ts	Incremental streaming read via readBodyWithLimit cancels on size exceeded; Content-Length early reject; base64 result returned in JSON response body.
apps/sim/lib/api/contracts/tools/vanta.ts	Discriminated-union body schema with all 27 query operations, upload/download contracts, response schemas, and a max constraint on fileContent base64.
apps/sim/blocks/blocks/vanta.ts	Block config with 29 operations, conditional/advanced subblocks, dropdown/tri-state transformation in params, canonicalParamId for file upload, and complete inputs/outputs.
apps/sim/tools/vanta/upload_document_file.ts	Tool definition for document file upload; clientId/clientSecret correctly marked user-only; fileContent hidden as programmatic field.
apps/sim/tools/vanta/download_document_file.ts	Tool definition for evidence file download; outputs typed as file for executor FileToolProcessor integration.

Sequence Diagram

sequenceDiagram
participant Block as Vanta Block
participant QR as /api/tools/vanta/query
participant UR as /api/tools/vanta/upload
participant DR as /api/tools/vanta/download
participant Cache as Token Cache (in-memory)
participant Vanta as Vanta API
Block->>QR: "POST {operation, clientId, clientSecret}"
QR->>QR: checkInternalAuth
QR->>Cache: vantaTokenCacheKey(sha256(secret))
alt cache hit
Cache-->>QR: cached token
else cache miss / expired
QR->>Vanta: POST /oauth/token
Vanta-->>QR: access_token
QR->>Cache: store with TTL-10min
end
QR->>Vanta: GET/POST /v1/resource
alt 401 token revoked
Vanta-->>QR: 401
QR->>Vanta: POST /oauth/token forceRefresh
Vanta-->>QR: new token
QR->>Vanta: retry request
end
Vanta-->>QR: response
QR-->>Block: success + normalized output
Block->>UR: "POST {documentId, file}"
UR->>UR: checkInternalAuth + assertToolFileAccess
UR->>Vanta: POST /v1/documents/id/uploads multipart
Vanta-->>UR: file metadata
UR-->>Block: success + upload
Block->>DR: "POST {documentId, uploadedFileId}"
DR->>DR: checkInternalAuth
DR->>Vanta: GET /v1/documents/id/uploads/fileId/media
Vanta-->>DR: binary stream
DR->>DR: readBodyWithLimit 100MB
DR-->>Block: success + base64 file

Loading

_{Reviews (9): Last reviewed commit: "improvement(integrations): expose vanta ..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR adds a Vanta integration with 29 tools spanning compliance frameworks, controls, tests, evidence documents (list/get/upload/download/submit), people, policies, vendors, monitored computers, vulnerabilities, and risk scenarios. Auth uses Vanta's OAuth client-credentials flow exchanged server-side on each request, with three internal Next.js routes protected by checkInternalAuth.

• All 29 tools are backed by Zod-validated discriminated-union contracts and defensive normalizers that guard every field against null/wrong-type values from the Vanta API.
• Evidence file upload supports both a direct UserFile pipeline (with storage-access authorization) and a raw base64 fallback; download streams the binary back as base64 with content-length and post-decode size guards.
• normalizeVantaPolicy reads latestVersionStatus from the nested path resource.latestVersion.status; if Vanta returns this as a flat top-level string field (as the TypeScript type and output descriptor suggest), every policy response will silently return null for that field.
• fileContent in the upload contract is declared z.string().nullish() without a .max() bound, so a large base64 payload (≈133 MB for the 100 MB limit) is fully decoded into memory before the size guard fires.

Confidence Score: 3/5

The core routing, auth, and normalization logic is well-structured, but two correctness issues in the new code need addressing before merging: a field-path mismatch in the policy normalizer that silently drops latestVersionStatus, and a missing schema-level size bound on the base64 upload path.

The policy normalizer reads latestVersionStatus from a nested latestVersion.status path that is unlikely to match the actual Vanta API response shape, silently returning null for every policy. The fileContent contract field has no .max() constraint, allowing an authenticated caller to trigger a large in-memory allocation before the 100 MB guard fires. Both issues are in newly introduced code and affect live behavior.

apps/sim/tools/vanta/utils.ts (normalizeVantaPolicy field path), apps/sim/lib/api/contracts/tools/vanta.ts (fileContent size bound), apps/sim/app/api/tools/vanta/query/route.ts and download/route.ts (auth outside try/catch)

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/vanta/query/route.ts	Central dispatch route for all 27 read/query operations; auth check is placed outside the try/catch, diverging from the upload route's pattern and risking unlogged errors on unexpected auth throws
apps/sim/app/api/tools/vanta/upload/route.ts	Handles evidence file upload via UserFile pipeline or raw base64; auth, file access, and size checks are present, but the base64 path lacks a schema-level size constraint before the in-memory decode
apps/sim/app/api/tools/vanta/download/route.ts	Downloads a Vanta evidence file and returns it as base64; auth check is outside the try/catch (same issue as the query route); content-length pre-check plus post-download size guard looks correct
apps/sim/tools/vanta/utils.ts	All normalizers, URL builder, token exchange, and list-result unwrapper; normalizeVantaPolicy reads latestVersionStatus from a nested path that likely doesn't match Vanta's flat API field, causing it to always return null
apps/sim/lib/api/contracts/tools/vanta.ts	732-line Zod contract covering all three routes; fileContent is z.string().nullish() without a max-length bound, allowing a large base64 payload to be decoded into memory before the 100 MB guard fires
apps/sim/tools/vanta/types.ts	779-line type definitions for all Vanta entities and response shapes; well-structured with consistent nullable fields throughout
apps/sim/blocks/blocks/vanta.ts	Block config with 29 operations, conditional subblocks, file upload via canonicalParamId, BlockMeta templates and skills; logic looks correct and consistent with other integrations

Sequence Diagram

sequenceDiagram
participant Tool as Vanta Tool (client)
participant QRoute as /api/tools/vanta/query
participant URoute as /api/tools/vanta/upload
participant DRoute as /api/tools/vanta/download
participant Auth as checkInternalAuth
participant VantaOAuth as Vanta /oauth/token
participant VantaAPI as Vanta REST API
Note over Tool,VantaAPI: Query / read flow (27 operations)
Tool->>QRoute: "POST {operation, clientId, clientSecret}"
QRoute->>Auth: checkInternalAuth(request)
Auth-->>QRoute: "{success, userId}"
QRoute->>VantaOAuth: "POST {client_credentials, scope: read}"
VantaOAuth-->>QRoute: "{access_token}"
QRoute->>VantaAPI: GET/POST (operation URL, Bearer token)
VantaAPI-->>QRoute: raw JSON
QRoute-->>Tool: "{success, output: normalizedData}"
Note over Tool,VantaAPI: Upload evidence file flow
Tool->>URoute: "POST {clientId, clientSecret, documentId, file|fileContent}"
URoute->>Auth: checkInternalAuth(request)
Auth-->>URoute: "{success, userId}"
URoute->>URoute: processFilesToUserFiles / Buffer.from(base64)
URoute->>VantaOAuth: "POST {client_credentials, scope: read+write+upload}"
VantaOAuth-->>URoute: "{access_token}"
URoute->>VantaAPI: "POST /documents/{id}/uploads (multipart)"
VantaAPI-->>URoute: uploaded file metadata
URoute-->>Tool: "{success, output: {upload}}"
Note over Tool,VantaAPI: Download evidence file flow
Tool->>DRoute: "POST {clientId, clientSecret, documentId, uploadedFileId}"
DRoute->>Auth: checkInternalAuth(request)
Auth-->>DRoute: "{success}"
DRoute->>VantaOAuth: "POST {client_credentials, scope: read}"
VantaOAuth-->>DRoute: "{access_token}"
DRoute->>VantaAPI: "GET /documents/{id}/uploads/{fileId}/media"
VantaAPI-->>DRoute: binary file data
DRoute-->>Tool: "{success, output: {file: {name, mimeType, data, size}}}"

Loading

_{Reviews (2): Last reviewed commit: "fix(integrations): use write-only scope ..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9576c47. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds a full Vanta integration with 29 tools spanning compliance frameworks, controls, tests, evidence documents (upload/download/submit), people, policies, vendors, monitored computers, vulnerabilities, and risk scenarios. Auth is handled via OAuth client credentials exchanged server-side per request, with three dedicated internal API routes (/api/tools/vanta/query|upload|download) protected by withRouteHandler and checkInternalAuth.

• Query route: a discriminated-union handler backed by exhaustive Zod contracts validates 27 operations, builds Vanta API URLs, and normalizes responses field-by-field against Vanta's OpenAPI spec.
• Upload route: routes evidence files through the existing processFilesToUserFiles/assertToolFileAccess pipeline before posting multipart data to Vanta, with a 100 MB size guard; auth check sits inside the try block (inconsistently with the other two routes) and could surface as 500 on unusual auth exceptions.
• Block: the config.params function correctly handles all renaming/transformation cases (e.g., documentStatusFilter→statusMatchesAny, tri-state dropdowns→booleans), relying on the generic handler's { ...inputs, ...transformedParams } merge for same-named pass-through params.

Confidence Score: 4/5

Safe to merge with the concurrent-token issue noted; it only manifests when two Vanta tool calls share credentials and run in parallel.

The integration is well-structured with thorough Zod contract validation, correct credential visibility, proper file-access authorization in the upload path, and solid normalizers for all 14 resource types. The two areas that could bite in production are the token-per-request pattern (Vanta invalidates prior tokens on each exchange, so parallel executions with the same credentials race) and the auth check inside the upload route's try-catch. Neither is a showstopper but both are worth addressing before the feature gets heavy parallel use.

apps/sim/tools/vanta/utils.ts (token exchange without caching), apps/sim/app/api/tools/vanta/upload/route.ts (auth check placement)

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/vanta/query/route.ts	Discriminated-union handler for 27 read/write Vanta operations; uses Zod contract validation, per-request OAuth token exchange, and properly delegates auth before the try-block. No issues found.
apps/sim/app/api/tools/vanta/upload/route.ts	Handles evidence file uploads to Vanta with file-access authorization and size limits; auth check is placed inside try-catch (inconsistent with the other two routes), which could mask auth errors as 500s in rare exception paths.
apps/sim/app/api/tools/vanta/download/route.ts	Streams Vanta document files with incremental size limits; the reader-less fallback path buffers the entire body before checking size, which could double memory usage for large files at the 100 MB ceiling.
apps/sim/tools/vanta/utils.ts	Core utilities: per-request OAuth token exchange, URL building, comma-list splitting, and normalizers for all 14 Vanta resource types. Token exchange without caching can cause concurrent-request races given Vanta's one-active-token-per-app constraint.
apps/sim/blocks/blocks/vanta.ts	Comprehensive 1225-line block with 29 operations; config.params correctly renames/transforms block inputs (e.g., documentStatusFilter→statusMatchesAny, searchQuery→q) while relying on the generic-handler merge for same-named params. No issues found.
apps/sim/lib/api/contracts/tools/vanta.ts	732-line Zod contract covering all 3 routes and 27 operations with discriminated-union validation; region locked to enum, required IDs use trimmed min-1 strings, pageSize bounded 1-100, boolean filters properly typed. Well-validated.
apps/sim/tools/vanta/upload_document_file.ts	Upload tool correctly uses user-only visibility for clientId/clientSecret; offers both file and fileContent (hidden) paths consistent with the upload route handler.
apps/sim/tools/vanta/download_document_file.ts	Minimal download tool routing to the dedicated download endpoint; correct param structure and output types.

Sequence Diagram

sequenceDiagram
participant Block as VantaBlock
participant GenHandler as GenericHandler
participant Tool as VantaTool
participant QueryRoute as /api/tools/vanta/query
participant UploadRoute as /api/tools/vanta/upload
participant DownloadRoute as /api/tools/vanta/download
participant VantaOAuth as Vanta OAuth
participant VantaAPI as Vanta REST API
Block->>GenHandler: resolve inputs + config.params()
GenHandler->>GenHandler: "finalInputs = inputs + transformedParams"
GenHandler->>Tool: executeTool(toolId, finalInputs)
alt query / read operations
Tool->>QueryRoute: POST with operation + credentials
QueryRoute->>QueryRoute: checkInternalAuth
QueryRoute->>VantaOAuth: POST /oauth/token
VantaOAuth-->>QueryRoute: access_token
QueryRoute->>VantaAPI: GET /v1/resource
VantaAPI-->>QueryRoute: JSON response
QueryRoute-->>Tool: normalized output
else file upload
Tool->>UploadRoute: POST with documentId + file
UploadRoute->>UploadRoute: checkInternalAuth + assertToolFileAccess
UploadRoute->>VantaOAuth: POST /oauth/token (upload scope)
VantaOAuth-->>UploadRoute: access_token
UploadRoute->>VantaAPI: POST multipart upload
VantaAPI-->>UploadRoute: upload metadata
UploadRoute-->>Tool: upload output
else file download
Tool->>DownloadRoute: POST with documentId + uploadedFileId
DownloadRoute->>DownloadRoute: checkInternalAuth
DownloadRoute->>VantaOAuth: POST /oauth/token (read scope)
VantaOAuth-->>DownloadRoute: access_token
DownloadRoute->>VantaAPI: GET media endpoint
VantaAPI-->>DownloadRoute: binary stream
DownloadRoute->>DownloadRoute: readBodyWithLimit 100MB
DownloadRoute-->>Tool: base64 file output
end
Tool-->>GenHandler: ToolResponse
GenHandler-->>Block: output

Loading

_{Reviews (3): Last reviewed commit: "fix(integrations): bound vanta base64 fi..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6519dac. Configure here.}

[waleedlatif1]

@greptile review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4e3d257. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c160878. Configure here.}