GitHub ships enterprise MCP allowlists for Copilot with fail-closed policies

JeremyCMorgan · x · 2026-08-14

GitHub has made MCP allowlists generally available in enterprise managed settings: enterprise owners can centrally control which MCP servers GitHub Copilot clients are allowed to run via the new allowedMcpServers and deniedMcpServers keys, approving trusted servers and blocking untrusted or non-compliant ones across the enterprise.

Matchers: serverUrl matches remote HTTP/SSE servers with wildcards and URL canonicalization to prevent evasion; serverCommand matches local stdio servers by exact command and arguments; serverName matches the user-assigned label — a convenience only, not a security control, since users can rename servers.

Fail-closed semantics: malformed or unverifiable configurations are blocked rather than allowed; when policies come from multiple layers, a server must pass every layer. In server-managed deployments, both keys can be marked overridable so teams can layer their own lists on top of the baseline.

Enforced today on the GitHub Copilot app, Copilot CLI and VS Code; configuration lives in copilot/managed-settings.json in the source organization's .github-private repository on the default branch.

Original post →

More from coding & agent

coding & agent channel →