# GitHub Copilot MCP Registry GitHub Copilot MCP Registry is the ability, in public preview, to point a GitHub organization or enterprise at a private [[Model Context Protocol (MCP)|MCP]] registry so that [[GitHub Copilot]] clients only discover, and optionally only allow, the MCP servers your company approves. Admins configure it under **AI Controls → MCP** in the org/enterprise Copilot policies: set the **MCP Registry URL** and pick the enforcement level, "Allow all MCP servers" (discovery only) or **"Registry only"** (hard allowlist). It serves three jobs at once: 1. **Document**: the registry is the single inventory of approved MCP servers, with their source, transport, endpoints, packages, and runtime parameters 2. **Enforce**: with "Registry only", any server not in the registry is blocked; in [[Visual Studio Code (VSCode)]] it shows disabled with a warning, and the MCP access control setting is greyed out so users can't loosen it 3. **Discover**: developers browse and install approved servers directly from their client. In [[Visual Studio Code (VSCode)]], type `@MCP` in the extensions view and only registry servers appear. In [[GitHub Copilot CLI]], `/mcp search` (experimental) searches the public GitHub MCP Registry by default, but once an org/enterprise registry URL is configured it connects to *that* registry instead; `/mcp add` then pre-populates the configuration form (command, args, env, headers) from the registry entry, so wiring up an approved server is fill-in-the-secrets-and-save ## Registry requirements Any registry implementing the [[Model Context Protocol Registry]] v0.1 spec works. Required endpoints: - `GET /v0.1/servers` - `GET /v0.1/servers/{serverName}/versions/latest` - `GET /v0.1/servers/{serverName}/versions/{version}` All must return permissive CORS headers (`Access-Control-Allow-Origin: *`). You can self-host the open-source reference registry, roll your own, or use [[Azure API Center]] as a managed registry (its endpoint format: `https://<name>.data.<region>.azure-apicenter.ms/workspaces/default`; GitHub appends `/v0.1/servers` itself, and the `workspaces/default` segment is mandatory). ## Client support The v0.1 registry is consumed by VS Code (Stable and Insiders), Visual Studio, JetBrains IDEs, Eclipse, Xcode, and [[GitHub Copilot CLI]]. In the CLI, servers land in `~/.copilot/mcp-config.json` (project-level `.mcp.json` / `.github/mcp.json` override it), managed via `/mcp show|add|edit|disable|delete` or the `copilot mcp` subcommands; when a registry URL plus allowlist policy is set at org/enterprise level, only allowlisted servers execute regardless of how they were configured. ## Registry vs managed settings Two overlapping control planes exist for MCP governance, and GitHub itself calls [[GitHub Copilot Managed Settings]] the "more secure, production-ready" option: - **MCP Registry (this note)**: preview; optimized for *discovery plus* allowlisting; needs a spec-compliant registry endpoint (currently anonymous-read) - **`allowedMcpServers` / `deniedMcpServers` in `managed-settings.json`**: GA; pure allow/deny matching by server name, URL pattern, or exact command; no discovery experience In practice they compose: the registry gives developers a curated storefront, managed settings give admins the hard enforcement floor. ## Caveats - The registry endpoint must currently allow anonymous read access (authenticated private endpoints aren't supported yet), so don't put secrets in server metadata - An MCP server with an empty description field doesn't show up in VS Code's gallery - Policy changes need a client restart to propagate ## References - Configure an MCP registry: https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-mcp-registry - VS Code Stable public preview announcement: https://github.blog/changelog/2025-11-18-internal-mcp-registry-and-allowlist-controls-for-vs-code-stable-in-public-preview/ - Initial announcement (Insiders): https://github.blog/changelog/2025-09-12-internal-mcp-registry-and-allowlist-controls-for-vs-code-insiders/ - Walkthrough with Azure API Center: https://devblogs.microsoft.com/all-things-azure/locking-down-mcp-create-a-private-registry-on-azure-api-center-and-enforce-it-in-github-copilot-and-vs-code/ - Azure API Center MCP inventory/registry endpoint: https://learn.microsoft.com/en-us/azure/api-center/register-discover-mcp-server - MCP Center (build your own enterprise MCP registry): https://mcp.azure.com/about - Reference registry implementation: https://github.com/modelcontextprotocol/registry - Adding MCP servers in Copilot CLI (/mcp search, /mcp add, mcp-config.json): https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-mcp-servers - Copilot CLI custom-registry-based MCP allowlists: https://github.blog/changelog/2026-04-16-copilot-cli-supports-custom-registry-based-mcp-allowlists/ ## Related - [[GitHub Copilot]] - [[GitHub Copilot CLI]] - [[GitHub Copilot Managed Settings]] - [[Azure API Center]] - [[Model Context Protocol (MCP)]] - [[Model Context Protocol Registry]] - [[MCP Gateway Registry]] - [[Docker MCP Catalog]] - [[Visual Studio Code (VSCode)]] - [[AI Governance]] - [[GitHub]]