# AX Check: vanta.com Checked 2026-09-23. Vanta's setup docs are solid, but pricing stays hidden behind a quote MCP quickstart and API docs are concrete and quick to follow, but the pricing page lists tiers with no dollar amounts, only "Get personalized pricing." ## Onboarding needs a login ## Coding sessions All three independent sessions completed and found Vanta's quickstart and docs usable. On pricing, one session reported no public numbers exist, one cited a third-party estimate (~$10k+/year) with caveats, and one listed the four tiers and their gated features without a cost figure. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/bee542b0-7e72-4cfe-a84b-484f7814d73f) · [Read transcript](https://www.ax-check.com/vanta.com/sessions/deepseek.json) Agent never states a cost figure at all — final output only says pricing is quote-based/"no public numbers" and lists tier feature names, explicitly avoiding a number rather than giving one with assumptions (seq 62, final output). #### End-to-end onboarding - **Onboarding needs a login**: The agent never obtained real Vanta credentials or executed an authenticated API call. It read public docs, wrote a Python script (vanta_list_soc2.py) that exchanges OAuth client credentials for a token and lists frameworks/documents, then ran it without credentials and got a graceful failure. Creating a Vanta app requires a human to sign in to the Developer Console (admin access), which the agent flagged as an unresolved requirement rather than something it could self-serve. Event 83: ```text Set VANTA_CLIENT_ID and VANTA_CLIENT_SECRET first. exit=1 ``` Event 85: ````text I **cannot execute the actual API calls** — they require a real Vanta tenant plus: ``` export VANTA_CLIENT_ID="vci_..." export VANTA_CLIENT_SECRET="vcs_..." python3 vanta_list_soc2.py ``` ```` Event 37: ```text **Vanta Dashboard** — sign in to Vanta, open [Settings → Developer Console](https://app.vanta.com/settings/developer-console), and click **Create**. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No self-service way to obtain Vanta API credentials**: Vanta requires a human with admin access to sign into the Vanta Dashboard and create a Manage Vanta application in the Developer Console to get a client_id/client_secret. This is normal product authentication design (not a defect), and it stopped the agent from running its example against a live tenant. The agent correctly identified this as a credential gap rather than a broken workflow. Event 37: ```text **Vanta Dashboard** — sign in to Vanta, open [Settings → Developer Console](https://app.vanta.com/settings/developer-console), and click **Create**. ``` Event 85: ````text I **cannot execute the actual API calls** — they require a real Vanta tenant plus: ``` export VANTA_CLIENT_ID="vci_..." export VANTA_CLIENT_SECRET="vcs_..." python3 vanta_list_soc2.py ``` ```` #### Suggested Changes - **Publish an official SDK for the Manage Vanta API**: The Vanta SDKs page states SDKs currently only cover the Auditor API, leaving the most common entry-point API (Manage Vanta, used in the quickstart) to be called via raw HTTPS/JSON. Add TypeScript/Java (or Python) SDK coverage for Manage Vanta similar to what exists for the Auditor API, and verify by checking that /docs/sdks lists Manage Vanta alongside Auditor API. Event 36: ```text **SDKs are currently only available for the Auditor API.** The [Manage Vanta API](/reference/manage-vanta/overview) and the [Build Integrations API](/reference/build-integrations/overview) are not yet supported. ``` - **Publish list pricing or a self-serve tier on the pricing page**: The public pricing page shows tier names and features (Essentials, Plus, Professional, Enterprise) but no dollar figures, requiring a sales demo for any number. Add at least a starting price or price range per tier on www.vanta.com/pricing, and confirm by checking the page renders a numeric price instead of only 'Get personalized pricing' CTAs. Event 63: ```text Request a free demo today to discuss your business needs and get personalized pricing. ``` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/33f2c1d3-3cb4-4d67-b461-1bd75120717c) · [Read transcript](https://www.ax-check.com/vanta.com/sessions/kimi.json) Final output states Vanta is quote-based with tier/add-on structure and gives a cost figure (~$10k+/year) explicitly caveated as a third-party anecdotal estimate for typical startup contracts, naming the assumption behind the number. #### End-to-end onboarding - **Onboarding needs a login**: Agent never obtained real Vanta credentials. It fetched public docs, confirmed the OAuth token endpoint returns 401 for a fake demo/demo credential pair, then wrote a local Python script requiring VANTA_CLIENT_ID/VANTA_CLIENT_SECRET env vars. Running the script without real credentials just printed an instructional error and exited — no authenticated call to the hosted API was ever made. The agent explicitly flagged that creating an app requires a Vanta admin account via the dashboard, which it could not do itself. Event 34: ```text curl -s -m 15 https://api.vanta.com/oauth/token -H 'Content-Type: application/json' -d '{"client_id":"demo","client_secret":"demo","scope":"vanta-api.all:read","grant_type":"client_credentials"}' -w '\nHTTP %{http_code}\n' ``` Event 44: ```text Set VANTA_CLIENT_ID and VANTA_CLIENT_SECRET first. exit=1 ``` Event 46: ```text executing a real call requires a Vanta account with admin access** to create an app in Settings → Developer Console. There's no sandbox or unauthenticated demo mode, so I can't run the example end-to-end from here. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **Admin account required to generate API credentials**: Vanta's Manage Vanta API requires signing in as an admin and creating an OAuth app in Settings -> Developer Console to get a client_id/client_secret. This is normal product authentication behavior, not a defect, but it stopped the agent from completing an end-to-end authenticated call in this session since no human-supplied credentials were provided. Event 27: ```text Make sure you have: * A Vanta account with admin access. * A terminal or HTTP client (cURL, Postman, or your language of choice). ``` Event 46: ```text One hard blocker: **executing a real call requires a Vanta account with admin access** to create an app in Settings → Developer Console. There's no sandbox or unauthenticated demo mode, so I can't run the example end-to-end from here. ``` #### Suggested Changes - **Publish concrete dollar pricing or a self-serve estimate tool on the pricing page**: The pricing page (www.vanta.com/pricing) lists tier names (Essentials, Plus, Professional, Pro, Enterprise) and add-ons but no dollar figures, forcing a sales conversation to get any number. Add at least a starting price or an interactive estimator on that page, and confirm by re-fetching the page and checking for a currency figure without needing to click "Get a demo". Event 31: ```text Request a free demo today to discuss your business needs and get personalized pricing. ``` - **Offer a sandbox or test-mode credential for the Manage Vanta API**: The quickstart at developer.vanta.com/docs/quickstart/manage-vanta.md requires a live admin account to generate client_id/client_secret before any code can be exercised end-to-end. Adding a sandbox tenant or demo credential path (similar to how many API platforms offer test-mode keys) would let evaluators run the documented quickstart without waiting on human-provisioned admin access. Verify by having a fresh, non-admin session request a sandbox token and successfully call a read endpoint like /v1/frameworks. Event 27: ```text Create a Manage Vanta application ``` Event 46: ```text There's no sandbox or unauthenticated demo mode, so I can't run the example end-to-end from here. ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/759da65f-b6ab-41f0-baba-2bd1c74318a0) · [Read transcript](https://www.ax-check.com/vanta.com/sessions/qwen.json) Final output states pricing is quote-based with no public numbers, lists the four tiers and what each gates (Essentials/Plus/Professional/Enterprise), notes annual contracts scale with headcount/frameworks/add-ons, and flags the ~$10k+/yr figure as unverified third-party chatter rather than a hard number. #### End-to-end onboarding - **Onboarding needs a login**: The agent could not obtain any Vanta credentials on its own. Vanta's auth model requires an OAuth client_id/client_secret created via the Developer Console at app.vanta.com, which requires human admin login to a paid tenant. The agent confirmed there is no sandbox or trial tenant, tested the token endpoint with placeholder credentials and got 401, and then wrote a ready-to-run script and README but never executed an authenticated call against the real API. Event 48: ```text Vanta does **not** support API keys, basic auth, or session cookies for the API. Every authenticated request goes through the OAuth bearer token model below. ``` Event 54: ```text Unauthorized HTTP 401 ``` Event 80: ```text The `client_id`/`client_secret` come from **app.vanta.com → Settings → Developer Console**, which requires **admin access to a paid Vanta tenant**. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No self-serve credentials or sandbox tenant**: Vanta's Manage Vanta API only accepts OAuth client_credentials tokens minted from a Developer Console that requires an already-existing, admin-level paid Vanta account. There is no free trial, sandbox, or API-key path the agent could use unattended. This is product behavior (deliberate gating to paid admin tenants), not agent error — the agent verified the 401 response with placeholder credentials before stopping. Event 52: ```text timeout 20 curl -sS -X POST https://api.vanta.com/oauth/token -H 'Content-Type: application/json' -d '{"client_id":"vci_demo_notreal","client_secret":"vcs_demo_notreal","scope":"vanta-api.all:read","grant_type":"client_credentials"}' -w "\nHTTP %{http_code}\n" ``` Event 54: ```text Unauthorized HTTP 401 ``` Event 80: ```text There is **no sandbox, free tier, or trial tenant**. (`sandbox` appears in their docs only as Postman marketing copy.) ``` #### Suggested Changes - **Offer a public sandbox tenant or API-key trial for the Manage Vanta API**: On developer.vanta.com/docs/quickstart/manage-vanta, add a path to get a disposable sandbox client_id/secret without requiring an existing paid, admin-owned tenant. Verify by having a fresh, unauthenticated developer follow the quickstart and successfully call POST https://api.vanta.com/oauth/token and GET /v1/frameworks end to end without a human logging into app.vanta.com first. Event 48: ```text Create a Manage Vanta application ``` Event 80: ```text There is **no sandbox, free tier, or trial tenant**. ``` - **Publish list prices or a pricing calculator on the pricing page**: vanta.com/pricing currently shows only tier names and feature comparisons behind a 'Get personalized pricing' demo request, with zero dollar figures. Add indicative starting prices per tier (Essentials/Plus/Professional/Enterprise) so prospects can self-qualify before contacting sales. Check by loading vanta.com/pricing and confirming a dollar amount renders for at least one tier. Event 29: ```text Get personalized pricing Get personalized pricing Essentials The fastest, simplest path to compliance ``` ### Task given to each agent Help me build a simple example using Vanta. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: C · 55/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Failed** — Homepage answers Markdown requests ```text Homepage returned text/html for a text/markdown request; no Markdown representation offered. ``` - **Failed** — llms.txt provides an actionable documentation index ```text https://vanta.com/llms.txt returns 404, so no documentation index is published. ``` - **Skipped** — llms.txt provides navigation guidance ```text llms.txt is 404, so its navigation guidance cannot be evaluated. ``` - **Skipped** — llms.txt mentions offered API, MCP, and skills ```text llms.txt is 404, so its API/MCP/skills mentions cannot be evaluated. ``` - **Pass** — A compact guide representation exists ```text Developer hub serves Markdown; MCP quickstart and MCP guide are standalone .md pages. ``` - **Pass** — A focused guide is directly retrievable ```text MCP quickstart .md gives concrete steps: prerequisites, connect tool, list failing tests, remediate. ``` - **Pass** — Equivalent instructions fit a token budget ```text MCP quickstart measured 3728 tokens, well under 8000 budget. ``` - **Skipped** — Product-docs links survive format changes ```text Homepage Markdown unsupported, so link preservation across formats cannot be measured. ``` - **Pass** — The compact guide is independently actionable ```text MCP quickstart gives prerequisites, region URLs, and concrete remediation steps for Claude Code, Cursor, Codex. ``` - **Pass** — Install and next-step links resolve ```text Fetched developer hub, MCP docs, help center, and getting-started hub all returned HTTP 200. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text Help Center Getting Started Hub offers first-step guides and quick links for new Vanta users. ``` - **Skipped** — Installation commands are extractable ```text No installation or CLI setup commands appear in the fetched Vanta help pages. ``` - **Skipped** — Code examples are available without interaction ```text Fetched pages are help-center articles; no code examples are shown without interaction. ``` - **Skipped** — Prerequisites and auth boundaries are explicit ```text No API auth or prerequisite details appear in the fetched help-center pages. ``` ### Pricing - **Failed** — Prices are stated, not gated ```text Pricing page shows plan names and features but no dollar amounts; only 'Get personalized pricing'. ``` - **Failed** — Pricing units and limits are explicit ```text No pricing units or limits stated; only questionnaire counts (25/144 per year) appear. ``` - **Failed** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 1 fell short. DeepSeek V4 Pro: Agent never states a cost figure at all — final output only says pricing is quote-based/"no public numbers" and lists tier feature names, explicitly avoiding a number rather than giving one with assumptions (seq 62, final output). Kimi K3: Final output states Vanta is quote-based with tier/add-on structure and gives a cost figure (~$10k+/year) explicitly caveated as a third-party anecdotal estimate for typical startup contracts, naming the assumption behind the number. Qwen 3.8 Max: Final output states pricing is quote-based with no public numbers, lists the four tiers and what each gates (Essentials/Plus/Professional/Enterprise), notes annual contracts scale with headcount/frameworks/add-ons, and flags the ~$10k+/yr figure as unverified third-party chatter rather than a hard number. This behavioural item does not affect the fast grade. ``` - **Pass** — Pricing is readable without interaction ```text Pricing page renders plan tiers and feature comparison without any interaction or login. ``` ### Activation - **Pass** — An API reference or OpenAPI spec is reachable ```text Developer hub links an API Reference with base URLs, auth, rate limits, and every endpoint. ``` - **Pass** — An MCP server is documented and well-formed ```text MCP server documented with regional URLs, OAuth, prerequisites, and client setup steps. ``` - **Skipped** — A CLI install path is documented ```text No CLI install path for a Vanta product CLI is documented in fetched pages. ``` - **Skipped** — SDK packages resolve on their registries ```text SDK page referenced but no registry lookup result for a Vanta package was fetched. ``` - **Pass** — Agent skills are published ```text AI Skills page offered, giving Cursor and Claude Code Vanta-specific context. ``` [Full report data](https://www.ax-check.com/vanta.com/report.json)