Enterprise owners can now centrally control which Model Context Protocol (MCP) servers GitHub Copilot clients are allowed to run by using the new allowedMcpServers
and deniedMcpServers
keys in enterprise managed settings. Approve the MCP servers your developers depend on and block untrusted or non-compliant ones across your enterprise. This capability is generally available.
How it works
Add either or both keys to copilot/managed-settings.json
. Each key is a list of matchers that identify MCP servers by remote URL, local command, or name:
serverUrl
: Matches remote (HTTP/SSE) servers. It supports*
wildcards and canonicalizes URLs to prevent evasion.serverCommand
: Matches local (stdio) servers by exact command and arguments.serverName
: Matches the user-assigned label. This is only supplied as a convenience, not a security control, since users can rename servers.
Policies fail closed, meaning a malformed or unverifiable configuration is blocked rather than allowed. When policies come from multiple layers, a server must pass every layer.
In server-managed deployments, both keys can be marked overridable
so enterprise teams can define their own allow and deny lists on top of your baseline. To learn more, see our docs on overriding settings for individual teams.
For configuration examples and the full matcher syntax, see [Enterprise managed settings reference](https://docs.github.com/en/copilot/reference/enterprise-administrators/enterprise-managed-settings#example-configuration).
[Supported clients](#supported-clients)
MCP allowlists are currently enforced on the GitHub Copilot app, Copilot CLI and VS Code.
Getting started
In your source organization’s .github-private
repository, add the keys to copilot/managed-settings.json
and commit to the default branch.
To learn more, see configuring enterprise managed settings.