# How to control MCP servers in GitHub Copilot

DevFeed: [How to control MCP servers in GitHub Copilot](<https://devfeed.tech/articles/how-to-control-mcp-servers-in-github-copilot-104667.md>)

Original publisher: [Read original article](<https://nirmata.com/2026/10/25/how-to-control-mcp-servers-in-github-copilot/>)

Author: Ritesh Patel

Published: 2026-10-25T15:00:00Z

Content type: tutorial

Language: en

Sources: [Nirmata](<https://devfeed.tech/sources/nirmata.md>)

Topics: [GitHub Copilot](<https://devfeed.tech/topics/github-copilot.md>), [GitHub Copilot CLI](<https://devfeed.tech/topics/github-copilot-cli.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [ai-governance](<https://devfeed.tech/tags/ai-governance.md>), [blocking](<https://devfeed.tech/tags/blocking.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cloud-agent](<https://devfeed.tech/tags/cloud-agent.md>), [coding-agents](<https://devfeed.tech/tags/coding-agents.md>), [copilot](<https://devfeed.tech/tags/copilot.md>), [github](<https://devfeed.tech/tags/github.md>), [github-copilot](<https://devfeed.tech/tags/github-copilot.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [managed](<https://devfeed.tech/tags/managed.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-servers](<https://devfeed.tech/tags/mcp-servers.md>), [policy](<https://devfeed.tech/tags/policy.md>), [registry](<https://devfeed.tech/tags/registry.md>), [security](<https://devfeed.tech/tags/security.md>), [settings](<https://devfeed.tech/tags/settings.md>)

## AI overview

GitHub Copilot MCP access requires enabling the "MCP servers in Copilot" policy for governed Business and Enterprise seats, then applying an allowlist. The registry-only option is in public preview and matches by server name or ID, so users can bypass it through configuration edits; it also does not cover the cloud agent. The generally available `managed-settings.json` offers stronger enforcement with URL wildcards for remote servers and exact commands for local ones. Deny rules take precedence, and when an allowlist is present, unmatched servers are blocked; malformed lists fail closed except for built-in defaults. Configure cloud-agent servers separately in repository settings: it supports tools but not resources or prompts, does not support OAuth remote servers, and calls tools without approval prompts. Free, Pro, Pro+, and Max users are outside the MCP policy.

## Source excerpt

Control MCP servers in GitHub Copilot with the MCP policy, registry-only mode, managed-settings allowlists and cloud agent settings. See where each one applies.