Drata
Drata compliance automation: workspaces, controls, monitoring tests, evidence, personnel, vendors, risks, policies, devices and assets.
About
Drata ships in the w6w first-party pack. It declares 27 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.drata- Version
- 0.1.0
- Author
- w6w
- Licence
- MIT
- Categories
- Legal & Compliance · Security & Identity
Overview
Drata is a compliance automation platform: it continuously tests a company’s systems against frameworks such as SOC 2, ISO 27001, HIPAA and GDPR, and keeps the evidence an auditor asks for. This app lets a workflow read and act on that data through the Drata Public API v2.
It covers the working surface of a compliance program: workspaces, controls and their monitoring tests (including which resources are failing and since when), the evidence library with file and link artifacts, personnel and users, the vendor register, risk registers and risks, policies, devices, assets and the account’s event log. Lists are cursor-paginated and return related objects only when asked for with Expand.
A connection holds one API key and the region the Drata account lives in (North America, Europe or Asia-Pacific); the key’s own permissions decide what each action may do, so a read-only key is a supported configuration. Health checks watch the Public API component for the connection’s own region on Drata’s status page.
Build with Drata
Three routes to the same 27 actions. The Workflow tab is generated from Drata's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Get Company
company-get Read the account's company profile — name, domain, training and background-check providers, entitlements.
List Controls
control-list List the controls in a workspace, filtered by readiness, monitoring, evidence or policy coverage.
List Devices
device-list List devices (managed laptops and workstations) with their compliance posture.
List Events
event-list List the account's audit-style events (who changed what, when), filtered by category, source or time window.
Create Evidence
evidence-create Create an evidence item with a URL, ticket or previously uploaded file artifact.
Upload Evidence File
evidence-file-upload Upload a file (base64) and get a file key to attach to an evidence item.
List Evidence
evidence-list List evidence items in a workspace with their artifacts, owners and status.
List Monitoring Test Failures
monitoring-test-failures-list List the resources currently failing one monitoring test (the "why is this red" answer).
List Monitoring Tests
monitoring-test-list List a workspace's monitoring tests — the automated checks — with their latest result.
List Personnel
personnel-list List personnel records — the people Drata tracks compliance for — filtered by employment or compliance status.
List Risk Registers
risk-register-list List the risk registers (each holds a set of risks) — the id every risk action needs.
List Users
user-list List Drata users (the people with a login), optionally filtered by name prefix.
Update Vendor
vendor-update Change a vendor's status, risk, contact or other details. Unset fields are left alone.
List Workspaces
workspace-list List the account's workspaces (the container every control, test and evidence item lives in).
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Drata's real ids.
{
"manifestVersion": "2",
"name": "drata-example",
"steps": [
{
"id": "control-get",
"uses": {
"app": "io.w6w.drata",
"action": "control-get",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"workspaceId": "<workspaceId>",
"controlId": "<controlId>"
}
}
]
}Here are some of the things you can do
-
Get Control
readcontrol-get -
List Assets
searchasset-list -
Get Company
readcompany-get -
List Controls
searchcontrol-list -
List Devices
searchdevice-list
+22 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Drata, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Drata. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "control-get",
payload: {
workspaceId: "<value>",
controlId: "<value>",
// expand: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action control-get --payload '{"workspaceId":"<value>","controlId":"<value>"}'Give an AI agent Drata — without giving it Drata's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.drata#control-get",
"input": {
"workspaceId": "<workspaceId>",
"controlId": "<controlId>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Drata connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Drata's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Drata itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Drata declares its own checks, so its health is a property of the app rather than something the host guesses at.
Drata public API status
The `Public API` and `API` components of status.drata.com for THIS connection's region (US, EU or APAC) — an outage in another region is not this connection's problem.