{"meta":{"title":"MCP server usage in your company","intro":"You can manage MCP server usage to provide your developers with valuable tools while maintaining security and compliance.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/copilot","title":"GitHub Copilot"},{"href":"/en/enterprise-cloud@latest/copilot/concepts","title":"Concepts"},{"href":"/en/enterprise-cloud@latest/copilot/concepts/mcp-management","title":"MCP management"}],"documentType":"article"},"body":"# MCP server usage in your company\n\nYou can manage MCP server usage to provide your developers with valuable tools while maintaining security and compliance.\n\nThe Model Context Protocol (MCP) is an open standard that defines how applications share context with large language models (LLMs). MCP provides a standardized way to connect AI models to different data sources and tools, enabling them to work together more effectively.\n\nYou can manage MCP server usage in your organization or enterprise by configuring MCP policies on GitHub.\n\nThe **MCP servers in Copilot** policy defines whether MCP servers can run at all across Copilot clients. We recommend keeping this policy enabled and, if necessary, restricting the MCP servers that users can run to an approved list.\n\n## MCP allowlists\n\nThe recommended method for creating an allowlist is to use your enterprise's `managed-settings.json` file. This allows you to apply settings across clients that users cannot override.\n\nAlternatively, you can host your own MCP registry and restrict access to servers in the registry. However, this method has weaker enforcement than `managed-settings.json`.\n\n<div class=\"ghd-tool rowheaders\">\n\n| Method                 | Managed settings file                                                                                                                                                                                                                                                                 | Custom registry                                                                                                                                   |\n| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Release phase          | Generally available                                                                                                                                                                                                                                                                   | Public preview, not prioritized for development                                                                                                   |\n| Ease of setup          | You can host a configuration file on GitHub that applies automatically to clients.                                                                                                                                                                                                    | You must host your own registry that matches the MCP specification and serves HTTPS requests.                                                     |\n| Enforcement level      | Enterprise-wide settings, overridable for enterprise teams                                                                                                                                                                                                                            | Enterprise-wide or for individual organizations                                                                                                   |\n| Supported clients      | Clients supported by the `managed-settings.json` file, see [Configuring enterprise-managed settings](/en/enterprise-cloud@latest/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings). Planned to expand in the near future. | See [MCP private registry enforcement](/en/enterprise-cloud@latest/copilot/reference/enterprise-administrators/mcp-private-registry-enforcement). |\n| Server matching method | Secure matching based on name, URL, or `stdio` commands                                                                                                                                                                                                                               | Less secure matching, based on name or ID only. Users can bypass the restriction by editing configuration files.                                  |\n\n</div>\n\n## Next steps\n\nTo configure an allowlist on GitHub, see [Configuring an MCP server allowlist for your enterprise](/en/enterprise-cloud@latest/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist).\n\n## Further reading\n\n* [Supported surfaces for GitHub Copilot policies](/en/enterprise-cloud@latest/copilot/reference/supported-surfaces-for-policies)\n* [Configure an MCP registry for your organization or enterprise](/en/enterprise-cloud@latest/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-mcp-registry)"}