When you connect an AI assistant to Vansah MCP, it can use supported tools to read or change testing information on your behalf. Follow these practices to keep control of your access, data and changes.
Check the connection before authorizing
Use an official Vansah listing in your AI tool, or the Vansah MCP server address:
https://mcp.vansah.com/mcp
Check the domain carefully before signing in or approving access. Follow Connecting to Vansah MCP for the connection steps.
Sign in with the correct account
Vansah MCP uses OAuth, which lets you approve access through a sign-in and consent flow. Atlassian OAuth 2.0 (3LO) authorises access to Jira and Vansah.
Sign in with the Atlassian account that has access to the intended Jira site. Review the requested permissions and select the correct site if prompted. You do not need to paste your Atlassian password or an API token into the AI conversation.
The assistant operates within your existing Jira and Vansah permissions. Connecting it does not grant additional access. Administrators should give users only the permissions needed for their work.
Use an AI tool approved by your organization
Before connecting, check how the AI provider processes prompts, conversations and information returned by tools. Review its storage, retention and sharing settings against your organization’s requirements.
Only include testing data that you are allowed to share with that provider. Keep passwords, OAuth access tokens, Vansah API tokens and other credentials out of prompts, screenshots and attachments.
Review changes before they run
Where your AI client offers approval controls, enable confirmation for actions that create, update or delete information. Check:
The Jira site, space and records the assistant will use.
The exact Test Cases, Test Plan or other information being changed.
The proposed content and the number of records affected.
Start with a review-only request when appropriate. For example: “Review the tests linked to VANS-1234 and propose improvements. Do not create, update or delete anything.”
Note: A review-only instruction tells the assistant your intent. It does not replace account permissions or the client’s approval controls. Available actions are described in Supported MCP Tools.
Treat instructions inside retrieved content with care
A document, work item or test description may contain text that tries to redirect the assistant. This is often called prompt injection: content attempts to make an AI tool follow instructions you did not give.
For example, content might ask the assistant to ignore your request, send testing information elsewhere or change unrelated records. Treat that text as content to review. Check unexpected requests for access, exports or changes before approving them.
Understand data residency and external processing
For Vansah MCP’s hosting, data residency and security model, see Data Residency and Security in the MCP Overview.
You can also read Vansah’s Data Residency Policy and Information Security Policy. Information returned to your AI assistant is also subject to that provider’s processing and storage terms.
Remove connections you no longer need
Use your AI client’s connection settings to disconnect Vansah when it is no longer required. You can also review and revoke the relevant app’s access in your Atlassian account’s Connected apps.
Report a security concern
If you notice unexpected changes or believe a connection or credential has been compromised, stop using the connection and contact Vansah Support. Include the affected site, time and a description of what happened. Do not send passwords or access tokens.