エンタープライズ管理設定における MCP サーバーの許可リスト機能MCP allowlists in enterprise managed settings

GitHub has added a new capability to its enterprise managed settings that lets enterprise owners centrally control which Model Context Protocol (MCP) servers GitHub Copilot clients are allowed to run. The change, announced in the GitHub changelog, introduces two configuration keys — allowedMcpServers and deniedMcpServers — that give administrators a policy mechanism for governing MCP usage across an entire organization. For teams that have begun experimenting with agentic Copilot features, this matters because it shifts control of third-party tool connections from individual developers to a central administrative layer.

The Model Context Protocol is an open standard for connecting AI assistants to external tools, data sources, and services. An MCP server exposes a set of capabilities — such as reading from a database, querying an internal API, or interacting with a file system — that an MCP-compatible client can call on the user's behalf. GitHub Copilot supports MCP so that its chat and agent experiences can reach beyond the model's built-in knowledge and act against real systems. That flexibility is powerful, but it also expands the surface area that security and compliance teams need to consider, since an MCP server can, in effect, extend what an AI client is able to do inside a developer's environment.

The new allowedMcpServers and deniedMcpServers keys address that concern by letting enterprise owners define which servers are permitted and which are blocked. An allowlist approach — specifying only the servers that are explicitly approved — is generally considered a stricter security posture than a denylist, because anything not on the approved list is refused by default. The denylist key complements this by letting administrators block specific servers while otherwise allowing broader use. Because the settings live in enterprise managed settings, the policy is applied consistently across the organization rather than being left to each developer's local configuration.

This release fits into a broader pattern of GitHub building enterprise governance controls around Copilot as the product moves from simple code completion toward more autonomous, agent-style workflows. Over the past year, Copilot has gained agent mode in Visual Studio Code, a coding agent that can work on issues, and expanded extension support — all of which increase the value of MCP connections but also raise questions about what those connections are permitted to touch. Centralized allow and deny lists are a familiar tool from other areas of IT administration, such as controlling which browser extensions, packages, or applications employees can install, and applying that model to MCP servers appears to be a natural extension of existing enterprise policy frameworks.

For administrators, the practical takeaway is that MCP governance can now be handled the same way as other Copilot policies. Enterprise managed settings already allow owners to configure how Copilot behaves for members, and adding MCP server controls to that surface means security teams can enforce a single source of truth. This is likely to be especially relevant for regulated industries and larger organizations, where uncontrolled connections to external services could conflict with data-handling requirements or introduce untrusted code paths.

There are practical considerations worth noting. Maintaining an allowlist requires ongoing effort, since new MCP servers and internal tools will need to be reviewed and added as teams adopt them. Overly restrictive policies could slow developers who rely on specific integrations, while overly permissive ones weaken the protection the feature is meant to provide. Organizations will likely need to balance developer productivity against risk and to establish a process for evaluating and approving servers before adding them to the allowed list.

Enterprise owners who want to use the feature should consult GitHub's documentation on enterprise managed settings to confirm the exact syntax and precedence rules for the allowedMcpServers and deniedMcpServers keys, including how they interact when both are specified. As MCP adoption continues to grow across the developer tooling ecosystem, controls like these are becoming a standard part of how organizations weigh the benefits of AI-assisted development against the need to keep their environments secure and compliant.