What changed
GitHub made enterprise allow and deny lists for Model Context Protocol servers generally available through Copilot managed settings. Policies can match canonicalized remote URLs or exact local commands and arguments, combine across layers, fail closed on malformed configuration and apply to the Copilot app, CLI and VS Code.
Why it matters
MCP server selection moves from developer convention into centrally testable policy. URL canonicalization, exact command matching and fail-closed evaluation reduce easy bypasses, but team overrides and client coverage still require configuration and enforcement tests.
What to do
In a test enterprise, allow one remote server and one exact stdio command, deny close URL and argument variants, add a narrower team override, then test supported clients with malformed, renamed, redirected and overlapping rules. Preserve the effective policy and denial logs before rollout.
Caveat
GitHub establishes the feature and matcher semantics, not independent bypass resistance. Names are explicitly not a security boundary, enforcement covered only the listed clients at launch, and least-restrictive team combinations or future clients can create policy gaps if operators assume uniform coverage.