Skip to content
English - United States
Get Support & Track Tickets
  • There are no suggestions because the search field is empty.

Using Cycle MCP Safely

This article explains the risk of using Cycle MCP with an AI coding agent and provides best practices for keeping your test suite, application, environment, and data safe.

 

Experimental Feature Notice Cycle MCP is an experimental feature. Its tools, resources, and agent behavior may change between Cycle releases. The feature itself may be revised or removed entirely as we learn how teams use it. The Cycle MCP server has been validated against Claude Code. We plan for future iterations to support GitHub Copilot, Cursor, VS Code and more!

What Cycle MCP Does

Cycle MCP is a Model Context Protocol (MCP) server built into  cycle-cli.exe that lets a connected AI coding agent, such as Claude Code, author, run, and debug CycleScript feature files on your behalf through plain-language prompts. The agent does the typing, you review and iterate.

For a full description of capabilities, see  Cycle MCP in the User Manual.
Understanding the Risks
Because Cycle MCP hands an AI agent real browser control and direct access to your Cycle environment, the same categories of risk that apply to any AI agent in a browser apply here.
 
Unintended test execution The agent may run tests against environments you did not intend to target. Including staging or production systems. IF your prompt is ambiguous or if the agent misinterprets the context. Tests that involve create, update, or delete operations could modify real application data.
 
Prompt injection from application content When the agent navigates your application to capture locators, it reads on-screen content. Malicious or unexpected content in the application under test could attempt to redirect agent behavior. While Claude Code includes built-in safeguards against prompt injection, no defense is absolute.
 
Locator and feature file accuracy The agent generates locators and step code based on what it observes in a live browser session. Auto-generated locators may be brittle, overly broad, or inadvertently capture sensitive data visible on screen (personally identifiable information, authentication tokens, test credentials) if those values are present during the capture.
 
Access to your Cycle account and environment The agent authenticates using your sign-in Cycle account. The same credentials used by the Cycle Desktop client. Any test the agent authors and executes runs under your account and against whatever environment your cycle-cli configuration points to. Mistakes are attributed to your account.
 
Probabilistic agent behavior AI agent responses are non-deterministic. The same prompt may produce different .feature files or take different actions across sessions. Always review generated files before committing them or running them in a shared environment.
What Cycle MCP Cannot Do (Current Release)
  1. Cycle MCP does not replace manual review. The agent proposes; you approve.
  2. The MCP server does not have access to your CI/CD pipeline configuration or deployment credentials unless you separately provide them.
  3. Agent-driven execution does not bypass Cycle's existing permission model. The agent operates within the same authenticated session as a logged-in user.

Protecting Yourself and Your Team

Point the agent at a sage environment first Configure cycle-cli to target a dedicated test or development environment before connecting an agent. Never point an agent at a production environment for initial exploration.
 
Review generated feature files before running them Read the .feature files the agent produces before executing them, especially if they involve write, delete, or transactional steps. Confirm step definitions, locators, and data values match your intent.
 
Watch for unexpected navigation or actions If the agent starts navigating pages outside the application you described, stops and asks for credentials, or behaves in ways that seem unrelated to your prompt, stop the session and review what happened. This could indicate a misunderstood prompt or unexpected content in your application.
 
Use test data, not real data Avoid running agent-assisted sessions against environments populated with real user data, real financial records, or other sensitive information. Locator capture involves reading page content, and that content may be included in the agent's context.
 
Keep prompts specific Vague prompts increase the chance of unintended actions. Describe exactly which feature, workflow, and environment you want to test. The more specific your prompt, the more predictable the agent's output.
 
Validate locators in the Cycle Desktop client After the agent generates a feature file, open the Cycle Desktop client to inspect and validate the locators it chose. The desktop client's interactive locator tools let you confirm accuracy before committing to the file.
Your Responsibility
You remain responsible for all the actions the AI agent takes through the Cycle MCP server on your behalf, including:
  1. Feature files authored, modified, or deleted
  2. Tests executed and any data changes those tests caused in your application
  3. Any environment configuration that agent is given access to
  4. Compliance with your organization's policies on automated tool access to internal systems