ReleaseBytes
github GitHub Changelog ·

GitHub Copilot: Enterprise MCP Allowlists for Managed Settings

governanceinfraengineer
feature announcement

Enterprise owners can now centrally control Model Context Protocol (MCP) servers used by GitHub Copilot clients through new managed settings. This feature allows administrators to approve or deny specific MCP servers, enhancing security and compliance by blocking untrusted or non-compliant servers across the enterprise. It is now generally available and enforced on the GitHub Copilot app, Copilot CLI, and VS Code, with configuration managed via `copilot/managed-settings.json`.

  • →Centralized MCP Server Control for GitHub Copilot Enterprise
  • →MCP Allowlist Configuration and Enforcement
  • →Supported Clients and Getting Started
Features (1) ›
  • Centralized MCP Server Control for GitHub Copilot Enterprise

    Enterprise owners can now use `allowedMcpServers` and `deniedMcpServers` keys in enterprise managed settings to control which Model Context Protocol (MCP) servers GitHub Copilot clients connect to. This allows for central management of approved servers across an organization, enhancing security and compliance.

Notes (2) ›
  • MCP Allowlist Configuration and Enforcement

    The MCP allowlist feature supports matching servers by URL, local command, or name, with wildcard support for `serverUrl`. Policies fail closed, and when multiple policy layers exist, a server must pass all layers. In server-managed deployments, these keys can be marked as overridable for team-level customization.

  • Supported Clients and Getting Started

    MCP allowlists are currently enforced on the GitHub Copilot app, Copilot CLI, and VS Code. To get started, enterprise owners should add the relevant keys to `copilot/managed-settings.json` in their source organization's `.github-private` repository and commit the changes.

Read the original announcement →

https://github.blog/changelog/2026-08-06-mcp-allowlists-in-enterprise-managed-settings

Related releases