Initial revision of enterprise MCP allowlist support, by dmitrivMS · Pull Request #309356 · microsoft/vscode

dmitrivMS · 2026-04-13T04:41:06Z

Fixes https://github.com/microsoft/vscode-internalbacklog/issues/6959

Co-authored-by: Copilot <copilot@github.com>

Copilot

Pull request overview

Adds a first pass of enterprise MCP allowlist enforcement by flowing enterprise registry metadata from the default account policy into MCP startup/connection logic, and by introducing a workbench service that fetches and evaluates an enterprise allowlist.

Changes:

Extend default account policy data to include enterprise MCP allowlist entries derived from copilot/mcp_registry.
Introduce IMcpAllowListService + implementation to fetch/cache allowlisted server fingerprints and gate MCP server launches.
Gate MCP autostart and connection resolution on allowlist readiness / evaluation, and add @github/mcp-registry for fingerprint computation.

Show a summary per file

File	Description
src/vs/workbench/services/accounts/browser/defaultAccount.ts	Extracts enterprise allowlist entries from MCP registry response into policy data.
src/vs/workbench/contrib/mcp/common/mcpService.ts	Waits for allowlist readiness before autostarting MCP servers.
src/vs/workbench/contrib/mcp/common/mcpRegistry.ts	Gates `resolveConnection()` on allowlist evaluation; computes server fingerprint via SDK.
src/vs/workbench/contrib/mcp/common/mcpAllowListService.ts	New service to fetch/merge/cache enterprise allowlist fingerprints and evaluate server permission.
src/vs/workbench/contrib/mcp/browser/mcp.contribution.ts	Registers the allowlist service singleton.
src/vs/workbench/contrib/git/common/utils.ts	Exports `parseRemoteUrl` for allowlist repo-scoping logic.
src/vs/platform/mcp/common/mcpAllowListService.ts	New platform-level allowlist service interface and state enum.
src/vs/base/common/defaultAccount.ts	Adds `IMcpAllowlistEntry` and stores allowlist entries on policy data.
package.json	Adds `@github/mcp-registry` dependency.
package-lock.json	Locks `@github/mcp-registry` dependency.

Copilot's findings

Comments suppressed due to low confidence (2)

src/vs/workbench/contrib/mcp/common/mcpAllowListService.ts:261

AllowList is a Set<string>, but it's being persisted via JSON.stringify({ value }). JSON.stringify(new Set([...])) serializes to {}, so the cached allowlist will be corrupted on disk and later reads will not return a Set. Persist a JSON-friendly representation (e.g. an array of strings plus a marker for "not applicable"), and reconstruct a Set when reading from storage.

	private async loadAllowList(query: RegistryQuery, authToken: LazyStatefulPromise<string>, token: CancellationToken): Promise<AllowList> {
		const { entry, repo } = query;
		const storageKey = `${ALLOWLIST_CACHE_KEY}.${entry.ownerId}${repo ? `.${repo}` : ''}`;

		const cached = this.storageService.getObject<{ value: AllowList }>(storageKey, StorageScope.APPLICATION);
		if (cached) {
			this.logService.debug(`[McpAllowlist] Loaded allowlist for ${repo ?? '<none>'} from cache`);
			return cached.value;
		}

		const value = await this.fetchAllowList(query, authToken, token);
		this.storageService.store(storageKey, JSON.stringify({ value }), StorageScope.APPLICATION, StorageTarget.MACHINE);
		return value;

src/vs/workbench/contrib/mcp/common/mcpRegistry.ts:595

_checkAllowlist awaits waitForReady() without handling rejection. Since the allowlist service can cancel/reject its readiness promise on load failure, this can throw and make resolveConnection() fail with an exception rather than cleanly treating the allowlist as Unavailable/"cannot verify". Handle errors from waitForReady() (or ensure waitForReady() never rejects) so server resolution behavior remains deterministic.

		if (this._mcpAllowlistService.state === McpAllowListState.Loading) {
			await raceTimeout(this._mcpAllowlistService.waitForReady(), 10_000);
		}

Files reviewed: 9/10 changed files
Comments generated: 5

Copilot · 2026-04-13T04:45:53Z

+		// Enterprise allowlist gate: wait for allowlist data and check if server is permitted
+		const allowlistResult = await this._checkAllowlist(definition);
+		if (allowlistResult !== true) {
+			if (opts.errorOnUserInteraction) {
+				throw new UserInteractionRequiredError('allowlist');
+			}
+			this._notificationService.notify({
+				severity: Severity.Warning,
+				message: allowlistResult.value,
+			});
+			return undefined;
+		}


Enterprise allowlist gating is now part of resolveConnection(), but there are no tests covering allowed/blocked/loading/unavailable outcomes. Since this file already has a dedicated test suite, add tests that stub the allowlist service and verify (1) allowed fingerprints proceed, (2) blocked fingerprints prevent connection and surface a warning / UserInteractionRequiredError('allowlist') when errorOnUserInteraction is set, and (3) unavailable/loading states behave as intended.

This issue also appears on line 592 of the same file.

How does a user know if an installed MCP server is allowed or not by looking at it in the extensions view?

I think we do the access validation in the mcp workbench service which is the source for all installed mcp servers and disable them if they are not valid. Please check here -

vscode/src/vs/workbench/contrib/mcp/browser/mcpWorkbenchService.ts

Lines 802 to 823 in 503edcb

if (accessValue === McpAccessValue.Registry) {

if (!mcpServer.gallery) {

return {

state: McpServerEnablementState.DisabledByAccess,

message: {

severity: Severity.Warning,

text: new MarkdownString(localize('disabled - some not allowed', "This MCP Server is disabled because it is configured to be disabled in the Editor. Please check your [settings]({0}).", settingsCommandLink))

}

};

}

const remoteUrl = mcpServer.local.config.type === McpServerType.REMOTE && mcpServer.local.config.url;

if (remoteUrl && !mcpServer.gallery.configuration.remotes?.some(remote => remote.url === remoteUrl)) {

return {

state: McpServerEnablementState.DisabledByAccess,

message: {

severity: Severity.Warning,

text: new MarkdownString(localize('disabled - some not allowed', "This MCP Server is disabled because it is configured to be disabled in the Editor. Please check your [settings]({0}).", settingsCommandLink))

}

};

}

}

- IMO we should do the same here

…-list

github-actions · 2026-04-13T08:17:58Z

Screenshot Changes

Base: 93250509 Current: c25e18ca

Changed (2)

chat/aiCustomizations/aiCustomizationManagementEditor/McpBrowseMode/Light

Before	After

editor/inlineCompletions/other/JumpToHint/Dark

Before	After

…-list

Co-authored-by: Copilot <copilot@github.com>

joshspicer

Looks reasonable to me! Would be great to get @sandy081 's 👀 if possible

hstaudacher · 2026-04-15T11:52:25Z

A change has been made to the /copilot/mcp_registry endpoint that should be respected here as well. It does support adding a repo param to scope the response to the repo's enterprise/org. Details can be found in this issue (right now the team is fixing a bug with this param. Should work as expected soon).

sandy081

Very good work on this, I liked how the overall changes look. I left some comments on the implementation. Thanks.

sandy081 · 2026-04-16T08:06:32Z

+		// Enterprise allowlist gate: wait for allowlist data and check if server is permitted
+		const allowlistResult = await this._checkAllowlist(definition);
+		if (allowlistResult !== true) {
+			if (opts.errorOnUserInteraction) {
+				throw new UserInteractionRequiredError('allowlist');
+			}
+			this._notificationService.notify({
+				severity: Severity.Warning,
+				message: allowlistResult.value,
+			});
+			return undefined;
+		}


How does a user know if an installed MCP server is allowed or not by looking at it in the extensions view?

I think we do the access validation in the mcp workbench service which is the source for all installed mcp servers and disable them if they are not valid. Please check here -

vscode/src/vs/workbench/contrib/mcp/browser/mcpWorkbenchService.ts

Lines 802 to 823 in 503edcb

if (accessValue === McpAccessValue.Registry) {

if (!mcpServer.gallery) {

return {

state: McpServerEnablementState.DisabledByAccess,

message: {

severity: Severity.Warning,

text: new MarkdownString(localize('disabled - some not allowed', "This MCP Server is disabled because it is configured to be disabled in the Editor. Please check your [settings]({0}).", settingsCommandLink))

}

};

}

const remoteUrl = mcpServer.local.config.type === McpServerType.REMOTE && mcpServer.local.config.url;

if (remoteUrl && !mcpServer.gallery.configuration.remotes?.some(remote => remote.url === remoteUrl)) {

return {

state: McpServerEnablementState.DisabledByAccess,

message: {

severity: Severity.Warning,

text: new MarkdownString(localize('disabled - some not allowed', "This MCP Server is disabled because it is configured to be disabled in the Editor. Please check your [settings]({0}).", settingsCommandLink))

}

};

}

}

- IMO we should do the same here

…-list

Initial revision of enterprise MCP allowlist support,

e3a9376

Co-authored-by: Copilot <copilot@github.com>

dmitrivMS requested review from Copilot, joshspicer and sandy081 April 13, 2026 04:41

dmitrivMS self-assigned this Apr 13, 2026

Copilot started reviewing on behalf of dmitrivMS April 13, 2026 04:42 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

austindyoung mentioned this pull request Apr 13, 2026

[mirror] microsoft/vscode#309356 Initial revision of enterprise MCP allowlist support, austindyoung/vscode-driftfence-mirror-fork#1623

Open

Merge remote-tracking branch 'origin/main' into dev/dmitriv/mcp-allow…

6a438eb

…-list

dmitrivMS and others added 7 commits April 13, 2026 22:46

Merge remote-tracking branch 'origin/main' into dev/dmitriv/mcp-allow…

a218bb0

…-list

Fix build break

b773790

Co-authored-by: Copilot <copilot@github.com>

Fix build break

de84891

PR feedback

89f4781

Co-authored-by: Copilot <copilot@github.com>

Fix broken tests

59ea7c0

Merge branch 'main' into dev/dmitriv/mcp-allow-list

a7dd483

Merge branch 'main' into dev/dmitriv/mcp-allow-list

c720a38

dmitrivMS added plg gpo Group policies github-mcp-server Issues related to the GitHub MCP Server integration in the Copilot Chat extension mcp and removed plg github-mcp-server Issues related to the GitHub MCP Server integration in the Copilot Chat extension labels Apr 14, 2026

joshspicer previously approved these changes Apr 14, 2026

View reviewed changes

Merge branch 'main' into dev/dmitriv/mcp-allow-list

2b4082f

sandy081 reviewed Apr 16, 2026

View reviewed changes

Merge branch 'main' into dev/dmitriv/mcp-allow-list

fc0482e

dmitrivMS dismissed joshspicer’s stale review via fc0482e April 20, 2026 19:33

Merge branch 'main' into dev/dmitriv/mcp-allow-list

0ffbc83

dmitrivMS added 5 commits April 21, 2026 08:39

Merge remote-tracking branch 'origin/main' into dev/dmitriv/mcp-allow…

2c7a1d1

…-list

Merge remote-tracking branch 'origin/main' into dev/dmitriv/mcp-allow…

bed0a51

…-list

Merge branch 'main' into dev/dmitriv/mcp-allow-list

96c494f

Update mcp-registry.

d946327

Merge branch 'main' into dev/dmitriv/mcp-allow-list

1ca0f0c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial revision of enterprise MCP allowlist support,#309356

Initial revision of enterprise MCP allowlist support,#309356
dmitrivMS wants to merge 17 commits intomainfrom
dev/dmitriv/mcp-allow-list

dmitrivMS commented Apr 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

sandy081 Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

joshspicer left a comment

Uh oh!

hstaudacher commented Apr 15, 2026

Uh oh!

sandy081 left a comment

Uh oh!

sandy081 Apr 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	if (accessValue === McpAccessValue.Registry) {
	if (!mcpServer.gallery) {
	return {
	state: McpServerEnablementState.DisabledByAccess,
	message: {
	severity: Severity.Warning,
	text: new MarkdownString(localize('disabled - some not allowed', "This MCP Server is disabled because it is configured to be disabled in the Editor. Please check your [settings]({0}).", settingsCommandLink))
	}
	};
	}

	const remoteUrl = mcpServer.local.config.type === McpServerType.REMOTE && mcpServer.local.config.url;
	if (remoteUrl && !mcpServer.gallery.configuration.remotes?.some(remote => remote.url === remoteUrl)) {
	return {
	state: McpServerEnablementState.DisabledByAccess,
	message: {
	severity: Severity.Warning,
	text: new MarkdownString(localize('disabled - some not allowed', "This MCP Server is disabled because it is configured to be disabled in the Editor. Please check your [settings]({0}).", settingsCommandLink))
	}
	};
	}
	}

Conversation

dmitrivMS commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

sandy081 Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Screenshot Changes

Changed (2)

Uh oh!

joshspicer left a comment

Choose a reason for hiding this comment

Uh oh!

hstaudacher commented Apr 15, 2026

Uh oh!

sandy081 left a comment

Choose a reason for hiding this comment

Uh oh!

sandy081 Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dmitrivMS commented Apr 13, 2026 •

edited

Loading

github-actions Bot commented Apr 13, 2026 •

edited

Loading