How to allowlist MCP servers for your organization in every coding agent

the short answer

Set an allowlist in each agent’s admin configuration: Claude Code allowManagedMcpServersOnly with allowedMcpServers, Codex [mcp_servers.<name>] identity in requirements.toml, Cursor’s team MCP allowlist, Copilot’s managed allowedMcpServers plus its MCP policy, and Gemini CLI mcp.allowed with system mcpServers definitions. Identify servers by URL or command, not name. Allowlists decide which servers connect; a tool-call policy decides what an allowed server may do.

Claude Code: allowManagedMcpServersOnly: true + allowedMcpServers (serverUrl, serverCommand)
Codex: [mcp_servers.<name>] identity = { command = ... } or { url = ... }
Cursor: Team dashboard MCP Configuration (Enterprise)
Copilot: Managed allowedMcpServers; “MCP servers in Copilot” policy
Gemini CLI: mcp.allowed plus system mcpServers definitions

Why Teams Lock MCP Down

An MCP server is code with access to your agent’s context and often to credentials. A Cursor forum thread put it plainly: “The fact that anyone can add any MCP server presents a pretty large security issue for us.” An allowlist is the first control most security teams ask for.

Claude Code

An empty allowedMcpServers blocks every server users add. Once the list has any serverCommand entry, stdio servers must match one, and once it has any serverUrl entry, remote servers must match one; a serverName entry no longer admits that kind of server. Built-in servers and organization-delivered managed servers are exempt from the allowlist. deniedMcpServers beats the allowlist and also applies to managed servers, so a broad deny such as { "serverUrl": "*" } would block the remote servers you just allowed.

{
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverCommand": ["npx", "-y", "@company/mcp-internal"] },
    { "serverUrl": "https://mcp.company.example.com/*" }
  ]
}

Codex

A server must match both name and identity. An empty mcp_servers table disables all MCP servers. The structured command identity form can also pin the executable and its arguments.

[mcp_servers.github]
identity = { command = "github-mcp-server" }

[mcp_servers.internal]
identity = { url = "https://mcp.company.example.com/mcp" }

Cursor, Copilot and Gemini CLI

Agent	How
Cursor	Team dashboard → MCP Configuration (Enterprise), matching the full command string or URL with `*` wildcards; `mcpAllowlist` in `permissions.json` only controls which tools auto-run
GitHub Copilot	Enable the “MCP servers in Copilot” policy, then `allowedMcpServers` in enterprise managed settings with `serverUrl` or `serverCommand` (names are user-chosen); lists from several sources intersect, and first-party servers like GitHub’s are exempt
Gemini CLI	In system `settings.json`, define each approved server in `mcpServers` and list its name in `mcp.allowed`, so a user cannot redefine it; per-server `includeTools` and `excludeTools` narrow its tools

What an Allowlist Does Not Do

It does not limit what an allowed server’s tools do. A sanctioned database MCP server can still run DROP TABLE if the agent asks it to.
Gate MCP tool calls with the same policies as shell calls. Claude Code, Codex, Cursor and Copilot CLI send MCP tool calls through their pre-tool hooks, which is where Failproof evaluates them.

FAQ

Can I allow a server but block one of its tools?

In Claude Code, add mcp__<server>__<tool> to permissions.deny. In Gemini CLI, use excludeTools. Across agents, use a pre-tool policy keyed on the tool name.

How do I find which MCP servers are in use today?

Claude Code OTel emits mcp_server_connection events, with server names only when OTEL_LOG_TOOL_DETAILS=1. Failproof sessions show MCP tool calls per machine.

Should I run an internal MCP registry?

Useful at scale, but each agent reads it differently today. An allowlist per agent is the reliable baseline.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.