What: Enterprise administrators can now restrict which MCP servers users are allowed to enable through allowlist and blocklist configurations.
How to use:
# Configuration stored in userSettings.json:
{
"allowedMcpServers": [{"serverName": "approved-server"}],
"deniedMcpServers": [{"serverName": "blocked-server"}]
}
# When users try to add blocked servers:
# Error: MCP server 'blocked-server' is not allowed by enterprise policyDetails:
- Allowlist: Only servers in the list can be enabled (empty allowlist blocks all servers)
- Blocklist: Explicitly blocked servers cannot be enabled regardless of allowlist
- Priority order: blocklist > allowlist > default (allow all)
- Enforcement applies when adding servers and when loading existing configurations
- Applies to all scopes: enterprise, user, project, local, and plugin
- Loaded servers automatically filtered by policy before being returned
- Evidence:
eR0()at line 280589,y7B()at line 280584,Ni()at line 280640,YP()at line 280843