An organization wants to allow teams to use approved MCP servers but prevent agents from connecting to arbitrary or untrusted external MCP servers. Which configuration approach achieves this?
Select an answer to reveal the explanation.
Short Explanation
You want approved MCP servers available without letting agents wander off to random endpoints. An organization-level MCP registry with an allowlist gives you that: pre-vetted servers work, and anything not on the list gets blocked by policy.
Full Explanation
Organizations using GitHub Copilot agents at scale need a governance mechanism for MCP server usage. An organization-level registry with an allowlist is the standard approach.
The correct approach is configuring an organization-level MCP registry with an allowlist of approved servers and enforcing it via policy. This allows security and platform teams to vet and approve specific MCP servers. Developers can connect to any server on the allowlist without additional review. Connections to servers not on the allowlist are blocked by policy. This balances security control with developer productivity.
The approach that requires developers to manually review every MCP server URL before each agent run is wrong because manual review before each agent run is operationally unsustainable at scale. It introduces human bottlenecks and inconsistency. Policy-based allowlists are faster and more reliable.
The approach that disables all MCP server support organization-wide is wrong because it eliminates the risk but also eliminates the capability. MCP is a core mechanism for extending agent functionality, and a blanket ban prevents legitimate use cases. The goal is governed access, not no access.
The approach that trusts all MCP servers by default and relies on network firewalls to block untrusted external endpoints is wrong because trusting all MCP servers by default is a security anti-pattern. A malicious actor could host an MCP server that exfiltrates data or performs unauthorized actions. Network firewalls operate at the IP/port level and cannot make security decisions based on the content or legitimacy of MCP server implementations.