Restrict MCP server access to a custom registry

You can configure an MCP registry URL and access control policy to determine which MCP servers developers can discover and use in supported IDEs and Copilot 命令行界面（CLI）.

谁可以使用此功能？

Enterprise owners and organization owners

Copilot Enterprise or Copilot业务

在本文中

重要

This feature is in 公开预览 and is not the recommended method for restricting access to MCP servers. The more secure, generally available method is to define settings in your enterprise's managed-settings.json file. See Configuring an MCP server allowlist for your enterprise.

Prerequisites

Before you can fully configure MCP server access for your company, you need to create an MCP registry. See 为组织或企业配置 MCP 注册表.

Configuring the MCP allowlist policy for an enterprise

To ensure uniform access, you can set and maintain your MCP registry URL and allowlist policy at the enterprise level. Otherwise, if your teams have different needs, you should configure separate policies for each organization.

  1. 导航到您的企业。 例如，从 GitHub.com 上的 公司 页面。

  2. 在页面顶部，单击 AI 控件。

  3. 在边栏中，单击 MCP。

  4. Ensure MCP servers in Copilot is set to Enabled everywhere.

  5. In the MCP Registry URL section, enter the URL of your registry, then click Save.

    注意

    如果使用 Azure API 中心设置 MCP 注册表，请输入 API 中心（包括工作区路径）的基 URL，格式如下：

    https://SERVICE-NAME.data.REGION.azure-apicenter.ms/workspaces/WORKSPACE-NAME

    例如：

    https://contoso-apic.data.eastus.azure-apicenter.ms/workspaces/default

    包括其他路由后缀（例如 /v0.1/servers ）会导致注册表出错，因为 GitHub Copilot 会自动追加 MCP v0.1 路径。

  6. In the Restrict MCP access to registry servers section, select the dropdown menu, then click one of the following options:

    • Allow all: No restrictions. All MCP servers can be used.
    • Registry only: Only servers from the registry may run.

    Your chosen policy will immediately apply to developers in your enterprise.

Configuring the MCP allowlist policy for an organization

  1. 在 GitHub 的右上角，单击个人资料图片，然后单击“ Your organizations”****。

  2. 单击以选择一个组织。

  3. 在组织名称下，单击 “Settings”****。 如果看不到“设置”选项卡，请选择“”下拉菜单，然后单击“设置”********。

    组织配置文件中选项卡的屏幕截图。 “设置”选项卡以深橙色标出。

  4. 在边栏中的“代码、规划和自动化”下， click Copilot, then click Policies.

  5. In the "Features" section, ensure MCP servers in Copilot is set to Enabled.

  6. In the MCP Registry URL (optional) field, enter the URL of your registry, then click Save.

    注意

    如果使用 Azure API 中心设置 MCP 注册表，请输入 API 中心（包括工作区路径）的基 URL，格式如下：

    https://SERVICE-NAME.data.REGION.azure-apicenter.ms/workspaces/WORKSPACE-NAME

    例如：

    https://contoso-apic.data.eastus.azure-apicenter.ms/workspaces/default

    包括其他路由后缀（例如 /v0.1/servers ）会导致注册表出错，因为 GitHub Copilot 会自动追加 MCP v0.1 路径。

  7. In the Restrict MCP access to registry servers section, select the dropdown menu, then click one of the following options:

    • Allow all: No restrictions. All MCP servers can be used.
    • Registry only: Only servers from the registry may run.

    Your chosen policy will immediately apply to developers in your organization.

Next steps

For detailed information on MCP allowlist enforcement and limitations, see MCP private registry enforcement.

Further reading