GitHub ships centrally managed MCP allowlists for Copilot clients

GitHub announced MCP allowlists in enterprise managed settings on 2026-08-06. Enterprise owners can now centrally control which Model Context Protocol servers GitHub Copilot clients are allowed to run by adding allowedMcpServers and deniedMcpServers keys to copilot/managed-settings.json in the source organization's .github-private repository.

The matchers identify MCP servers three ways. serverUrl matches remote HTTP and SSE servers, supports * wildcards, and canonicalizes URLs to prevent evasion. serverCommand matches local stdio servers by exact command and arguments. serverName matches the user-assigned label, and the changelog notes it is a convenience only, not a security control. Policies fail closed: malformed or unverifiable configurations block the server rather than allowing it, and when policies come from multiple layers a server must pass every layer. Both keys can be marked overridable to allow team-level customization.

The capability is generally available and currently enforced in the GitHub Copilot app, Copilot CLI, and VS Code. It extends the registry-based allowlist controls GitHub previously shipped for individual clients into a single enterprise-wide policy surface for publisher GitHub's Copilot products.