Enforce Organization-Wide MCP Policies
Compare three organization-wide MCP enforcement models across Claude Code, Cursor, and VS Code. Choose the right enforcement method for your coding assistant and organization.
JFrog enables you to enforce organization-wide MCP usage policies across your coding assistants. Rather than relying on developers to select approved servers, you define which MCP servers are available and lock that policy at the organization, team, or machine level — depending on your IDE and governance model.
Without enforcement, developers pull unverified MCP servers from public repositories, bypassing your organization's security and compliance controls. With organization-wide enforcement, you prevent shadow AI by ensuring only approved, vetted MCP servers are available to your coding agents.
Three Enforcement Models
JFrog supports three distinct enforcement models, each suited to a different coding assistant. All three prevent unapproved MCP usage — but they differ in scope, deployment method, and developer experience.
Cloud-based policy applied organization-wide via the Claude.ai admin console.
Team-level policy applied via the Cursor team dashboard.
Local hook deployed machine-wide via your MDM tool (Jamf, Intune, Kandji).
Compare All Three Models
| Aspect | Claude Code | Cursor | VS Code |
|---|---|---|---|
| Enforcement Model | Managed Settings | Team MCP Configuration | Agent Guard Hook |
| Scope | Organization-wide | Team-level | Organization-wide (via MDM) |
| Where Policy Is Defined | Claude.ai admin console | Cursor team dashboard | Pushed to developer via MDM |
CRITICAL — VS Code Developer Reload
After the Agent Guard hook is installed via MDM, the developer must manually reload VS Code (Command Palette → Developer: Reload Window) for the hook to take effect. Without this step, unapproved MCP servers remain accessible.
Choose Your Enforcement Model
Select your coding assistant to get step-by-step enforcement instructions:
- Claude Code: Enforce with Managed Settings — Apply org-wide policy via Claude.ai admin console.
- Cursor: Enforce with Team MCP Configuration — Apply team-level policy via Cursor team dashboard.
- VS Code: Enforce with Agent Guard Hook — Deploy hooks via MDM (Jamf, Intune, or Kandji).
Frequently Asked Questions
Can I enforce MCP policies for multiple coding assistants at the same time?
Yes. If your organization uses multiple IDEs (Claude Code + Cursor, or VS Code + Claude Code), you can apply the appropriate enforcement model for each. Developers using different tools will have policies enforced according to their tool's model.
What is MDM, and why is it required for VS Code?
MDM (Mobile Device Management) is software that IT teams use to manage and deploy configurations to developer machines at scale. Examples include Jamf Pro (macOS), Microsoft Intune (Windows), and Kandji (macOS).
VS Code enforcement uses a local hook that must be installed on each developer machine. MDM automates this deployment at scale. Claude Code and Cursor enforcement operate entirely in the cloud and do not require MDM.
What if I use VS Code but don't have MDM infrastructure?
Agent Guard Hook enforcement requires MDM to deploy the hook at scale. If you don't have MDM, you have two options:
- Evaluate and deploy MDM — Jamf Pro, Microsoft Intune, or Kandji are common choices. Deploying MDM is a broader security initiative that benefits multiple teams.
- Use a different IDE — If MDM is not feasible, consider Claude Code (managed settings) or Cursor (team config) where governance does not require MDM infrastructure.
Related Topics
- Use the MCP Registry with Agent Guard
- Get Started with the JFrog MCP Registry
- Configure Tool Policies