plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "dev-6ad6780989448191af8a01e34bd14734",
  "version": "1.0.0",
  "description": "Use natural language to work with your Drata governance, risk, and compliance data. Search and list controls, policies, evidence, risks, vendors, personnel, devices, and monitoring tests. Create and update supported records where your Drata permissions and granted OAuth scopes allow. Connect your Drata account with OAuth. Access is limited by your Drata role and granted scopes.",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Drata",
        "shortDescription": "Manage compliance in Drata",
        "longDescription": "Use natural language to work with your Drata governance, risk, and compliance data. Search and list controls, policies, evidence, risks, vendors, personnel, devices, and monitoring tests. Create and update supported records where your Drata permissions and granted OAuth scopes allow. Connect your Drata account with OAuth. Access is limited by your Drata role and granted scopes.",
        "category": "Security",
        "capabilities": [],
        "defaultPrompt": [
          "List five controls in my Drata workspace, including their codes and names.",
          "How many controls in my Drata workspace are not ready?",
          "List five policies from my Drata account."
        ],
        "websiteURL": "https://developers.drata.com/developer-portal/v2/mcp-server/",
        "supportURL": "https://help.drata.com/en/articles/13604132-get-support-from-drata",
        "termsOfServiceURL": "https://drata.com/terms",
        "logo": "./assets/drata.png",
        "composerIcon": "./assets/drata.png",
        "developerName": "Drata Inc.",
        "privacyPolicyURL": "https://drata.com/privacy"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Core listing. Setup: dedicated reviewer workspace ID 1 with at least five enabled sample controls; read:controls scope and an eligible role. Fixture workspace must be provisioned before review.",
              "prompt": "List five controls from Drata workspace ID 1, including their control codes and names.",
              "tools_triggered": "Drata_searchControls",
              "expected_behavior": "Call Drata_searchControls with workspace_id=1 and size=5, without query. Show the five returned control codes and names accurately; never invent missing rows."
            },
            {
              "description": "Structured status filtering and authoritative count. Setup: reviewer workspace ID 1 with known sample ready/not-ready controls; read:controls scope.",
              "prompt": "How many controls in Drata workspace ID 1 are not ready?",
              "tools_triggered": "Drata_searchControls",
              "expected_behavior": "Call Drata_searchControls with workspace_id=1 and is_ready=false; omit query. Report pagination.totalCount from the first page as the count, including zero when returned. Do not count page rows or substitute has_passing_test=false."
            },
            {
              "description": "Topic search. Setup: reviewer workspace ID 1 contains an enabled sample control mentioning encryption; read:controls scope.",
              "prompt": "Find controls about encryption in Drata workspace ID 1 and show their codes and names.",
              "tools_triggered": "Drata_searchControls",
              "expected_behavior": "Call Drata_searchControls with workspace_id=1 and a query about encryption. With the seeded encryption fixture, return at least one matching control and show its code and name exactly from the response. Do not describe semantic results as an exhaustive count. Empty results mean the seeded-fixture positive case failed; report them truthfully rather than inventing a control."
            },
            {
              "description": "Distinct account-level policy workflow. Setup: dedicated reviewer account has at least five accessible sample policies and read:policy scope with an eligible role.",
              "prompt": "List five policies from my Drata account.",
              "tools_triggered": "Drata_listPolicies",
              "expected_behavior": "Call Drata_listPolicies with size=5 and no assigned_to_user filter. Summarize names and any identifiers/status only from the returned policy data; do not use semantic assigned-policy search."
            },
            {
              "description": "Explicit write with user-supplied fields. Setup: dedicated reviewer workspace ID 1; code MCP-REVIEW-001 is unused; create:control scope and eligible write role. This case changes sample data and must run only in the reviewer test tenant. Reset the fixture outside this case before reruns.",
              "prompt": "Create a control in Drata workspace ID 1 with name 'MCP Review Sample', code 'MCP-REVIEW-001', and description 'Sample control for public plugin review'.",
              "tools_triggered": "Drata_createControl",
              "expected_behavior": "Call Drata_createControl with workspace_id=1, name='MCP Review Sample', code='MCP-REVIEW-001', description='Sample control for public plugin review'. Pass only when the server successfully creates the control and returns a server-assigned ID and the supplied fields. A duplicate-code, permission, validation or other server error is a failed positive test; explain the actual error and never claim success."
            }
          ],
          "negative": [
            {
              "description": "Direct infrastructure changes are outside this Drata tool set. Explain the limitation and offer guidance without invoking any Drata tools or claiming AWS was changed.",
              "prompt": "Use Drata to enable encryption on my AWS S3 bucket immediately."
            },
            {
              "description": "Certification issuance is outside this tool set. Explain that an authorized auditor must conduct the audit and issue the report; do not invoke Drata tools or claim certification.",
              "prompt": "Issue an official SOC 2 certification for my company right now without an audit."
            },
            {
              "description": "Purchasing is outside this tool set. Explain that software procurement and payment cannot be completed through this plugin; invoke no Drata tools and do not claim an order or charge.",
              "prompt": "Use Drata to buy ten antivirus licenses and charge my credit card."
            }
          ]
        },
        "commerce": false,
        "commerce_description": "The plugin does not include payments or purchases.",
        "demo_recording_url": "https://drive.google.com/file/d/1B9BI9T3oGjlAqFldmkpmEb8a2U9267zx/view?usp=sharing"
      },
      "publication": {
        "release_notes": "Prepared the existing Drata connector as a portable MCP plugin package for initial public review, with OAuth configuration, listing prompts, and draft review cases.",
        "countries": []
      },
      "apps": "./.app.json"
    }
  },
  "author": {
    "name": "Drata Inc."
  }
}