{"version":"2.1.239","anchor":"administrators-can-forbid-server-delivered-mcp-servers-with-","canonical_anchor":"administrators-can-forbid-server-delivered-mcp-servers-with-","heading":"Administrators can forbid server-delivered MCP servers with disableSideloadFlags","tier":"use","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239\/e\/administrators-can-forbid-server-delivered-mcp-servers-with-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239","markdown":"### Administrators can forbid server-delivered MCP servers with `disableSideloadFlags`\n\nAdmins can set disableSideloadFlags to block --mcp-config and refuse MCP servers pushed in from outside your config.\n\n**What**\n\nA managed setting can now refuse MCP servers pushed in from outside your own config. When `disableSideloadFlags` is set, the CLI warns that `--mcp-config` is forbidden on the machine and drops server-delivered MCP servers with a stated reason instead of loading them.\n\n**Details**\n\n- The reason string is \"disableSideloadFlags policy\", alongside the existing safe-mode and hermetic-mode refusal reasons.\n- Dropped servers are reported as \"Ignored: managed setting disableSideloadFlags forbids server-delivered MCP servers on this machine\".\n- Off unless an administrator sets the policy in managed settings.\n\n**Evidence**\n\n`disableSideloadFlags policy`\n\n- Area: MCP\n- Names: `disableSideloadFlags`, `--mcp-config`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}