The MCP ecosystem continues to evolve rapidly. Following these best practices will help protect your testing data while enabling AI assistants to work safely within your Vansah workspace.
Connect Only to Official Vansah MCP Endpoints
Always verify that your AI client is connecting to the official Vansah MCP server.
Recommended (Streamable HTTP)
https://mcp.vansah.com/mcp
Only connect to official Vansah endpoints. If you are installing Vansah MCP through a third-party marketplace or AI client, verify that the source and domain are trusted before authorizing access.
Use Trusted MCP Clients
Security begins with using trusted AI assistants and development tools.
Vansah MCP is compatible with many popular MCP clients, including ChatGPT, Claude, Cursor and other MCP-compatible applications.
When you authenticate, the AI assistant receives access to your Vansah workspace based on your existing permissions. It cannot perform actions beyond what your account is authorized to do, but it can perform those actions on your behalf.
Before connecting any AI client:
Verify the application comes from a trusted source.
Review the permissions being requested.
Ensure you understand how the AI client stores conversations and data.
Authenticate Securely
Vansah MCP uses Atlassian OAuth 2.0 to securely authenticate users.
Authentication occurs directly with Atlassian, allowing Vansah to verify your identity without requiring Jira API tokens or passwords.
Never share:
OAuth access tokens
Vansah API tokens
Personal access credentials
Treat these credentials as securely as you would your account password.
Protect Your Testing Data
Like any AI integration, MCP clients may process the information you provide through prompts.
Malicious prompts or untrusted AI agents could attempt to perform actions you did not intend, such as:
Modifying requirements or test cases
Creating or updating defects
Exporting testing information
Deleting testing assets
Always review prompts carefully before approving AI-generated actions.
Beware of Prompt Injection
Prompt injection is a technique where malicious content attempts to convince an AI assistant to ignore your instructions or perform unauthorized actions.
For example, an external document could contain hidden instructions that attempt to:
Ignore previous instructions.
Export confidential testing assets.
Modify or delete project information.
Send data to external systems.
Only allow AI assistants to process information from trusted sources whenever possible.
Review Permissions
AI assistants operate using your Vansah permissions.
Before connecting Vansah MCP, ensure your account has only the permissions necessary for your role.
If you're an administrator, consider granting users the minimum level of access required to perform their work.
Enable Human Confirmation
For workflows that create, update, or delete data, we strongly recommend enabling human confirmation within your MCP client.
This allows you to:
Review AI-generated actions before execution.
Approve updates to requirements, test cases, defects, and test runs.
Prevent accidental or unintended changes.
Maintain control over your testing workspace.
Human confirmation is one of the most effective ways to reduce operational risk when using AI.
Understand External Integrations
Vansah MCP only accesses the data you authorize within your Vansah workspace.
However, your AI client or connected tools may communicate with external services. Before enabling integrations, review how those applications collect, process, and store your information.
Always use trusted applications that follow your organization's security and compliance requirements.
Report Security Concerns
If you believe your Vansah workspace has been compromised or you discover a potential security issue, contact Vansah support immediately.
By following these best practices, you can confidently use Vansah MCP to automate quality engineering workflows while keeping your testing data secure and under your control.