A command-line tool for fetching data from the Vanta API.
vanta-cli authenticates using OAuth client credentials.
Follow the Vanta docs on how to obtain these credentials.
Set the following environment variables before running any command:
export VANTA_CLIENT_ID=your-client-id
export VANTA_CLIENT_SECRET=your-client-secretEach resource is a subcommand.
All subcommands support a --format flag with the following options: json (default), csv, tsv, markdown.
vanta-cli [command] --format [json|csv|tsv|markdown]
Available commands:
| Command | Description |
|---|---|
controls |
Fetch controls |
discovered-vendors |
Fetch discovered vendors |
documents |
Fetch documents |
frameworks |
Fetch frameworks |
groups |
Fetch groups |
integrations |
Fetch integrations |
monitored-computers |
Fetch monitored computers |
people |
Fetch people |
policies |
Fetch policies |
risk-scenarios |
Fetch risk scenarios |
schema |
Emit machine-readable schema of subcommands and data models |
tests |
Fetch tests |
vendor-risk-attributes |
Fetch vendor risk attributes |
vendors |
Fetch vendors |
vulnerabilities |
Fetch vulnerabilities |
vulnerability-remediations |
Fetch vulnerability remediations |
vulnerable-assets |
Fetch vulnerable assets |
Pagination is handled automatically — all pages are fetched and concatenated before output.
Fetch all vulnerabilities as JSON:
vanta-cli vulnerabilitiesFetch all vendors as CSV:
vanta-cli vendors --format csvCount vulnerabilities using jq:
vanta-cli vulnerabilities | jq 'length'Fetch all policies as a markdown table:
vanta-cli policies --format markdownEmit the machine-readable schema (useful for LLM consumption):
vanta-cli schema- mise — manages the Go toolchain and task runner
Install dependencies:
mise installmise run buildThis produces a ./vanta-cli binary in the current directory.
mise run testThis runs three checks in sequence:
- lint —
golintwith exit-on-warnings - fmt —
go fmt(fails the pipeline if formatting changes are needed) - unit —
go test ./...
Releases are automated via GoReleaser and GitHub Actions. Pushing a v* tag triggers the release workflow, which runs tests then publishes a GitHub Release with binaries for macOS and Linux (amd64 and arm64).
To release a new version:
git tag v1.2.3
git push origin v1.2.3The release workflow will:
- Run the full test suite
- Cross-compile for all platforms
- Create a GitHub Release with
.tar.gzarchives and achecksums.txt
The version is embedded in the binary at build time — vanta-cli --version will print the tag.