重要
This feature is in パブリック プレビュー and is not the recommended method for restricting access to MCP servers. The more secure, generally available method is to define settings in your enterprise's managed-settings.json file. See Configuring an MCP server allowlist for your enterprise.
Supported surfaces
The following table lists where MCP private registry features are supported.
| Surface | Registry display | Allowlist enforcement |
|---|---|---|
| Copilot CLI (コパイロット CLI) | v1.0.11+ | |
| Copilot クラウドエージェント | ||
| Eclipse | v4.38+ | |
| JetBrains | v1.5.64+ | |
| Visual Studio | v18.4.0+ | |
| VS Code | v1.109.3+ | |
| Xcode | v0.47.0+ |
メモ
For Eclipse, JetBrains, and Xcode, MCP management features are supported in the pre-release versions of Copilot.
Current enforcement limitations
MCP private registry enforcement currently has the following limitations:
- Enforcement is based only on server name/ID matching, which can be bypassed by editing configuration files.
- Strict enforcement that prevents installation of non-registry servers is not yet available. For stricter URL-based enforcement that users cannot override locally, see Configuring an MCP server allowlist for your enterprise.
Enforcement for local servers
MCP private registry enforcement applies to both remote and local MCP servers. When "Registry only" is configured, local servers must be included in your registry with the correct server ID, which must exactly match the installed server ID. A server's canonical ID is often defined in its documentation or manifest.
Policy resolution for users with multiple seats
MCP private registry enforcement is always tied to the organization or enterprise that assigns the GitHub Copilot seat. If a user has multiple seats, GitHub automatically resolves conflicts and applies a single active policy and registry.
The resolution logic is:
- Scope: Policies set by a parent enterprise override those set by an organization. Enterprise policies trickle down to all organizations and members within that enterprise.
- Enforcement strictness: Since
Registry onlyis more restrictive thanAllow all, it will always take precedence. - Recency of registry upload: If two policies have the same scope and strictness, the most recently uploaded registry will be applied.