接入你的智能体
發布者自己的指令。不是 PlugMCP 端點。
用我們的金鑰與日誌託管一份副本。
npx -y @vantagate/[email protected]Claude Code 沒有本機指令的安裝連結。複製下方指令並在終端機中執行。
VANTA_API_KEY=<secret> claude mcp add io.github.aderix-vantagate-mcp-server -- npx -y @vantagate/mcp-server@1.0.2在終端機中執行。
{ "mcpServers": { "io.github.aderix-vantagate-mcp-server": { "command": "npx", "args": [ "-y", "@vantagate/[email protected]" ], "env": { "VANTA_API_KEY": "<secret>" } } }}claude_desktop_config.json
遠端 URL 還是本機指令？ 兩種安裝方式的差異
來自發布者
Human-in-the-Loop authorization for AI Agents. VantaGate intercepts high-risk actions, routes them to a human approver via Slack or Email, and returns a cryptographically-signed decision - so your agent resumes or halts with a full audit trail.
VantaGate MCP Server & OpenAPI integration - Human-in-the-Loop for AI Agents
AI agents are increasingly capable of executing consequential real-world actions: sending emails to thousands of users, deleting database records, moving money, deploying to production. VantaGate is the trust layer that ensures humans remain in control.
Agent hits risky action
↓
POST /v1/checkpoint ──→ Human receives Slack/Email notification
↓ ↓
id and status Human reviews payload & decides
↓ ↓
Poll GET /v1/checkpoint/{id} ←── Decision recorded + payload purged
↓
APPROVED → Resume workflow
REJECTED → Halt + report reason
GET /checkpoint/{id} never returns the original payloadThis package ships two integration artifacts for connecting any AI agent to VantaGate:
The fastest path. No manual setup required.
Step 1: Get your API key from https://vanta-gate.com/dashboard/projects
Step 2: Add VantaGate to your Claude Desktop config.
Open your claude_desktop_config.json:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"vantagate": {
"command": "npx",
"args": ["-y", "@vantagate/mcp-server"],
"env": {
"VANTA_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}
Step 3: Restart Claude Desktop. The tools create_vantagate_checkpoint and check_vantagate_status will appear in Claude's tool list.
Step 4: Ask Claude to do something that requires approval:
"Delete all records from the staging database where created_at < 2024-01-01"
Claude will automatically pause, create a checkpoint, and tell you to check your email or Slack for the approval notification.
Import vanta-gate-openapi.json directly into your tool of choice.
API Key → Header: X-API-KEYThe GPT will now pause before high-risk tool calls and ask for human approval.
vanta-gate-openapi.jsonX-API-KEY to your VantaGate API key in the credential storecreate_vantagate_checkpoint to your agent's "before high-risk action" triggerX-API-KEY header in the credential configurationfrom langchain.tools import OpenAPITool
vanta_tool = OpenAPITool.from_openapi_spec(
spec_path="./vanta-gate-openapi.json",
headers={"X-API-KEY": os.environ["VANTA_API_KEY"]}
)
agent = initialize_agent([vanta_tool], llm, agent=AgentType.OPENAI_FUNCTIONS)
create_vantagate_checkpointPauses the agent workflow and routes a human approval request.
When Claude uses it: Before any high-risk action - financial operations, data deletion, production deployments, bulk communications.
Returns: checkpoint_id and step-by-step instructions for the agent.
check_vantagate_statusPolls the decision status of a pending checkpoint.
Returns: status (PENDING / APPROVED / REJECTED / RESOLVED / EXPIRED), selected_option, reject_reason, and the full audit trail.
Base URL: https://api.vanta-gate.com/v1
Authentication: X-API-KEY header
PENDING → APPROVED (human chose first/positive option)
→ REJECTED (human rejected with optional reason)
→ RESOLVED (human chose non-primary option)
→ EXPIRED (timeout elapsed, no decision)
All errors follow the envelope:
{
"statusCode": 400,
"error": "Machine_Readable_Code",
"message": "Human-readable description."
}
Timeout values are silently clamped to your plan's maximum. A Free plan request with
timeout: "7d"will be capped to24h.
When a human decides, VantaGate sends a signed HTTPS POST to your callback_url (up to 5 retry attempts with exponential back-off).
Request headers:
Content-Type: application/json
X-Vanta-Signature: sha256=<HMAC-SHA256 of body>
User-Agent: VantaGate-Webhook/1.0
Signature verification (Node.js):
const crypto = require('crypto')
function verifyVantaSignature(rawBody, signature, projectSecret) {
const expected = 'sha256=' + crypto
.createHmac('sha256', projectSecret)
.update(rawBody)
.digest('hex')
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature)
)
}
app.post('/webhook/vanta', express.raw({ type: 'application/json' }), (req, res) => {
const sig = req.headers['x-vanta-signature']
if (!verifyVantaSignature(req.body, sig, process.env.VANTA_PROJECT_SECRET)) {
return res.status(401).json({ error: 'Invalid signature' })
}
const event = JSON.parse(req.body)
if (event.status === 'APPROVED') {
// ✅ Resume agent workflow
} else if (event.status === 'REJECTED') {
// ❌ Halt - check event.reject_reason
}
res.json({ received: true })
})
Your Webhook Signing Secret (VANTA_PROJECT_SECRET) is distinct from your API key. Find it in Dashboard → Project Settings.
# Install dependencies
npm install
# Build TypeScript
npm run build
# Run the server directly
VANTA_API_KEY=YOUR_API_KEY_HERE npm start
{
"mcpServers": {
"vantagate": {
"command": "npx",
"args": ["-y", "@vantagate/mcp-server"],
"env": {
"VANTA_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}
{
"mcpServers": {
"vantagate": {
"command": "node",
"args": ["/absolute/path/to/dist/index.js"],
"env": {
"VANTA_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}
X-API-KEY is hashed server-side - VantaGate never stores plaintext keys.slack_webhook_url is sent per-request and purged atomically after the decision. Zero retention.callback_url is validated against private IP ranges (SSRF prevention).MIT - see LICENSE
VantaGate MCP Server & OpenAPI integration - Human-in-the-Loop for AI Agents
{ "mcpServers": { "io.github.aderix-vantagate-mcp-server": { "command": "npx", "args": [ "-y", "@vantagate/[email protected]" ], "env": { "VANTA_API_KEY": "<secret>" } } }}工具
尚無工具清單。遠端伺服器會在首次健康檢查後取得工具清單。
常見問題
在本頁複製適用於 Cursor、Claude Desktop、Claude Code 或 VS Code 的 stdio 設定。它使用發布者的安裝方式，而不是 PlugMCP 代理伺服器。
發布者列出了以下環境變數：VANTA_API_KEY。
Vantagate 透過 stdio 在本機執行。
上次檢查時間：2026-11-08。 VantaGate MCP Server & OpenAPI integration - Human-in-the-Loop for AI Agents