A GitHub changelog entry dated August 6, 2026 gives enterprise owners a way to decide, across an entire organisation, which MCP servers Copilot clients are allowed to run 1. Two keys — allowedMcpServers and deniedMcpServers — go into copilot/managed-settings.json. GitHub frames the purpose as letting administrators “approve the MCP servers your developers depend on and block untrusted or non-compliant ones across your enterprise” 1.
Servers can be identified three ways. serverUrl covers remote servers, accepts wildcards, and canonicalises URLs so the match cannot be dodged; serverCommand matches local servers on the exact command and arguments 1. The third, serverName, keys off the user-assigned label — and GitHub is explicit that it “is only supplied as a convenience, not a security control, since users can rename servers” 1. Only the first two, in other words, function as an actual boundary. Marking a key overridable lets individual teams layer their own policy on top of the enterprise baseline 1.
The behaviour worth noting is what happens when the configuration itself is wrong. GitHub states that “policies fail closed, meaning a malformed or unverifiable configuration is blocked rather than allowed” 1. Allowlists are currently enforced on the GitHub Copilot app, Copilot CLI, and VS Code 1.
Sources
- MCP allowlists in enterprise managed settings - GitHub Changelog (August 6, 2026)