Replies: 1 comment
-
|
Awesome, this is super useful! |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
MCP Governance Using Registry & Secure Allowlisting
Modern Copilot + Model Context Protocol (MCP) adoption in enterprises demands strong governance: administrators must ensure only vetted, policy-compliant MCP servers run inside developer IDEs. A centrally curated MCP Registry acts as a trust boundary—developers receive only approved endpoints; shadow or unreviewed servers never surface. By combining the community MCP Registry v0.1 frozen API, dual schema acceptance (current + legacy), controlled validation, and secure HTTPS exposure, organizations achieve:
This guide walks through building a curated registry, exposing it securely, enforcing it at the GitHub Enterprise / org level, and verifying that VS Code / VS Code Insiders uses a custom registry and only shows allowlisted MCP servers pre-configured from the registry.
What We Implemented
data/seed.jsonwith 4 example MCP servers:io.github.hashicorp/terraform-mcp-server)io.github.cr7258/elasticsearch-mcp-server)com.atlassian/atlassian-mcp-server)ai.waystation/jira)/v0/serversand/v0.1/serversas paginated sources.Step by Step 1 Clone and Run
Clone / Fork
Confirm Dual Schema Support
pkg/model/constants.goand verify both schema versions are defined:internal/validators/validators.goand updated schema validation to accept both current and previous versions:/internal/importer/importer.goand extended API endpoint detection to support legacy v0.1 endpoints:This dual schema support allows the registry to accept servers using either the frozen v0.1 schema (
2025-09-29) or the current schema (2025-10-17).Review Curated Seed
The
data/seed.jsonfile contains four production MCP servers using the legacy schema (2025-09-29) for backwards compatibility:Run with Docker Compose
For local testing purpose with changes made, re-run with explicit local seed & validation:
Verify Import & Endpoints
API endpoint testing:
Step by Step 2: Secure HTTPS Exposure & Enterprise/Org Configuration
Choose Exposure Method
There are various tools in the market that you can use to expose an internal url like localhost, or if you can host the registry behind your own DNS and a public IP address in a prod like enviroment, that is even better. In my case, I chose ngrok as the tool to expose my docker running on my localhost, so GHE enterprise/org can fetch the url through Internet and communicate to the registry. Below are a few other example tools you can use:
Option A: Ngrok (Static Domain Recommended with ngrok paid plan)
ngrok http 8080 # Produces https://YOUR_SUBDOMAIN.ngrok.appOption B: Cloudflare Tunnel
Configure a tunnel → route subdomain → localhost:8080
Option C: Tailscale Funnel
Enable Funnel for the host service → acquire HTTPS URL
Test External Reachability using ngrok
curl -I https://YOUR_SUBDOMAIN.ngrok.app/v0.1/servers?limit=1Configure GitHub Enterprise / Org MCP Registry
https://YOUR_SUBDOMAIN.ngrok.app/v0.1/serversVerify from Developer IDE
In VS Code Output panel (Window log), look for successful MCP registry fetch.
Manual cross-check:
Fallback test (if Insiders has serialization issue):
Governance Best Practices
✅ Keep
MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=truein production✅ Pin Docker image versions (avoid
:dev)✅ Protect tunnel with auth / IP allowlists / SSO
✅ Monitor
/metricsendpoint for usage patterns✅ Use PR approvals for seed.json changes
Step by Step 3: IDE Consumption & Allowlisted Filtering
Terminal Output Window View for debugging purpose
You should see the [info] with your matching registry server url configured on GitHub admin console.
Extension Filtering
mcpIf extraneous servers appear:
?search=parameter)Security & Compliance Callouts
packages(Docker/PyPI) andremotes(SSE/streamable-http)Quick Command Recap
Repository and other resources
Fork: customer-success-architects/registry
Upstream: modelcontextprotocol/registry
Other Managed Service Solution - Azure API Center
Azure API Center is the managed service ("Easy Path") that accelerates time-to-value by providing built-in governance, validation, and a centralized catalog, thereby reducing infrastructure and design-time work. In contrast, self-hosting offers full control over the registry and deployment but demands greater initial and ongoing effort for infrastructure, security, validation, and change control.
https://learn.microsoft.com/azure/api-center/overview
Beta Was this translation helpful? Give feedback.
All reactions