DataGrail MCP Server

Provider-hosted MCP server for DataGrail's Vera privacy platform. Manage DSRs, opt-outs, data mapping, consent, and risk assessments from AI tools.

Security by DataGrail OAuth2 active

Connect (Remote Server) Docs

Overview

The DataGrail MCP Server (branded as "Vera MCP") is a provider-hosted Model Context Protocol server that exposes DataGrail's privacy operations to MCP-compatible AI clients such as Claude, Cursor, Windsurf, and ChatGPT. It covers DataGrail's four core product areas: data subject request (DSR) management, opt-out and consent management, Live Data Map data mapping, and risk and compliance assessments (PIAs and DPIAs).

DataGrail markets this as the first production-ready MCP server for privacy. It is designed for governed, human-supervised AI workflows: most tools are read-only, write actions are scoped, and tenant isolation, role-based permissions, OAuth 2.0 with PKCE, and full audit logging are enforced. Super admins control which tools are available to users and AI clients through an MCP Tool Access page. During the OAuth flow each user picks which subset of tools to authorize.

Access is included with the DataGrail Enterprise plan. The server is reached at a tenant-specific URL (https://<subdomain>.datagrail.io/api/v2/mcp) using HTTP streamable transport, so there is no local install or self-hosting. The tool set spans 23 operations across Request Manager, Opt-Out Management, Integrations, Risk & Compliance, Consent Management, Documentation, and Feedback.

Tools

Tool	Description
`search_tickets`	Search privacy request tickets with filters for date, email, status, request type, deadline, and more (read-only).
`get_ticket_activity_log`	Retrieve the chronological activity log for a specific privacy request ticket (read-only).
`get_request_policies`	Access configured privacy request policies including legal frameworks, verification methods, and supported privacy rights (read-only).
`search_opt_outs`	Query opt-out requests with filters for status, deadline, verification state, and location (read-only).
`fetch_integration_catalog`	Browse available DataGrail integrations or search by name (read-only).
`fetch_integration_errors`	Retrieve grouped integration errors with sample details for troubleshooting (read-only).
`fetch_configured_integration_catalog`	Review the organization's connected integrations with status and capabilities (read-only).
`search_risks`	Query identified risks filtered by risk level and mitigation status (read-only).
`search_assessments`	Find risk assessments such as PIAs and DPIAs with deadline and contributor filtering (read-only).
`search_assessment_templates`	Locate prebuilt and custom assessment templates (read-only).
`search_inventory`	Query Live Data Map systems with risk and assessment filters (read-only).
`create_assessment`	Generate a new risk assessment from a template (write).
`update_assessment`	Modify an assessment's name, due date, or status (write).
`answer_assessment_question`	Populate assessment responses by question key (write).
`add_system`	Create a new Live Data Map inventory entry (write).
`associate_processing_activity`	Link processing activities to inventory systems (write).
`fetch_cookies`	Access unmanaged, suggested, or categorized cookies (read-only).
`fetch_tags`	Retrieve services requiring consent categorization (read-only).
`get_banner_status`	Obtain consent banner configuration and deployment status (read-only).
`get_consent_updates`	Review consent change history and publish events (read-only).
`get_consent_privacy_policies`	Fetch policies defining banner behavior across privacy frameworks, including consent modes and GPC/DNT settings (read-only).
`search_knowledgebase_docs`	Semantic search across DataGrail documentation (read-only).
`submit_product_feedback`	Send feedback, feature requests, or bug reports to the DataGrail product team (write).

Setup Guide

Prerequisites

A DataGrail tenant on the Enterprise plan (MCP Server is included for Enterprise customers).
DataGrail Super admin enables the MCP Tool Access page and selects which tools and actions are available.
Your tenant subdomain, for example acme in acme.datagrail.io.

The server is hosted by DataGrail. There is nothing to install locally. Authentication is OAuth 2.0 with PKCE, so you do not paste any API keys into your MCP client.

Server URL

https://<your-subdomain>.datagrail.io/api/v2/mcp

Claude Code

claude mcp add --transport http datagrail https://<your-subdomain>.datagrail.io/api/v2/mcp

Claude Desktop (Custom Connector)

Open Settings → Connectors.
Click Add Custom Connector.
Enter the MCP endpoint URL above.
Complete the OAuth flow in the browser and select which DataGrail tools to authorize.

Cursor

Open Settings → MCP.
Add a new MCP server using HTTP transport.
Name it datagrail and paste the endpoint URL.

Equivalent configuration in mcp.json style:

{
  "mcpServers": {
    "datagrail": {
      "transport": "http",
      "url": "https://<your-subdomain>.datagrail.io/api/v2/mcp"
    }
  }
}

Windsurf and OpenAI Codex

Both support HTTP Streamable MCP servers. Add a new server in Settings → MCP, enter the endpoint URL, and complete OAuth in the browser. You can re-run the OAuth flow later to grant additional tools.

Use Cases

Triage DSRs from chat: search privacy request tickets by status, deadline, or requester email and pull the activity log for any ticket directly inside Claude or Cursor.
Monitor integration health: list grouped integration errors over the last N days and identify which connected systems need attention.
Run privacy assessments with an AI co-pilot: create a new PIA or DPIA from a template, set the due date, and have the agent draft answers via answer_assessment_question.
Audit consent and cookies: review banner configuration, unmanaged cookies, untagged services, and consent publish history across containers.
Maintain the data map: add new systems to Live Data Map and link processing activities to existing inventory items as your stack evolves.

Example Prompts

"Show me all open privacy request tickets with deadlines in the next 7 days and summarize who is overdue."
"List integration errors from the last 14 days grouped by integration so I can prioritize fixes."
"Create a DPIA named 'Marketing AI Launch' from our standard template, due in 30 days, and start answering the data minimization questions."
"Find every Live Data Map system flagged as containing sensitive personal data with AI risks and summarize their assessment status."
"Pull the consent banner status for our EU container and list any cookies still in the unmanaged state."

Pros

Official, provider-hosted server with OAuth 2.0 + PKCE, tenant isolation, role-based permission inheritance, and audit logging.
Broad coverage across DataGrail's product surface: DSRs, opt-outs, integrations, risk and compliance, consent, data map, and docs (23 tools).
Granular authorization, users pick exactly which tools to grant during the OAuth flow and admins gate availability via an MCP Tool Access page.
Mostly read-only tools with a small, scoped set of write actions, reducing the blast radius of AI mistakes.

Limitations

Restricted to DataGrail Enterprise plan customers, not available on lower tiers.
Server is closed source and provider-hosted only, you cannot self-host or extend it.
Some operations that privacy teams might expect (for example fulfilling or closing a DSR ticket) are not exposed as write tools; the focus is on read and assessment workflows.

Alternatives

OneTrust and Transcend offer comparable privacy platforms; neither currently publishes an official MCP server, so any integration would be via their REST APIs or community wrappers.
Securiti has begun publishing AI agent integrations for privacy automation, but as of this writing there is no official MCP server.
For DSR-only workflows, building a thin custom MCP server over the DataGrail REST API is an option if you need actions beyond Vera MCP's scope.