Try JFrog
Guides
Contact SupportTry JFrog
  1. MCP REGISTRY
  2. Enforce Organization-Wide MCP Policies

VS Code: Enforce Governed MCP Usage

Deploy the ChatAllowedMcpServers allowlist, the GitHub Copilot allowedMcpServers managed setting, and the Claude3PIntegration and Codex3PIntegration delegation locks via MDM so VS Code, including delegated Copilot sessions, runs only JFrog Agent Guard.

JFrog enables you to enforce organization-wide Model Context Protocol (MCP) usage policies in VS Code. You push a managed policy to developer machines that permits only the JFrog Agent Guard MCP proxy to install and run. Every other MCP server a developer adds is blocked, both when it is added and each time it starts, and the setting can't be overridden by the user. All approved MCP traffic flows through Agent Guard.

Enforcement is applied in two layers:

  • VS Code layer — ChatAllowedMcpServers: Governs the built-in Local agent. Requires VS Code 1.133 or later.
  • GitHub Copilot layer — allowedMcpServers: A GitHub Copilot enterprise managed setting enforced by the on-machine Copilot runtime. It covers the delegated (agent-host) Copilot session, Copilot CLI, and the Copilot app. It does not govern the Copilot cloud agent, which is controlled server-side.

Both layers use the same allowlist, so you configure it once and it applies everywhere. Each entry is either a serverCommand (the Agent Guard launch command) or a serverUrl (the JFrog MCP, allowed directly by its exact URL https://<JPD_URL>/mcp).

Claude and Codex delegated sessions have no equivalent runtime allowlist, so the deployment artifacts disable them outright by setting Claude3PIntegration and Codex3PIntegration to false.

❗️

Important

Copilot delegation stays available, but is restricted to Agent Guard by the Copilot allowlist. A delegated Copilot session can still only run the JFrog Agent Guard proxy.

Claude and Codex delegation are disabled. Developers cannot delegate chat to Claude or Codex while the policy is in effect. You can opt out per platform, as described in Frequently Asked Questions.

This is one of three organization-wide MCP enforcement models. For a comparison of Claude Code, Cursor, and VS Code enforcement, see Enforce Organization-Wide MCP Policies.

⚠️

Governance is only guaranteed in VS Code version 1.131.

Prerequisites

  • JFrog AI Catalog entitlement with MCP Registry enabled.
  • JFrog Platform administrator access.
  • VS Code 1.133 or later (Stable or Insiders) on all developer machines. Earlier versions ignore these policies silently (no enforcement, no warning), so verify or gate the installed VS Code version as part of your rollout.
  • For the GitHub Copilot layer: GitHub Copilot Business or Enterprise with MCP enabled, and two GitHub organization or enterprise Copilot policies set (in GitHub, independent of the VS Code client version): MCP servers in Copilot enabled, and Restrict MCP access to registry servers set to Allow all, so that the custom-registry mode does not conflict with this managed-settings allowlist. If your organization does not use Copilot, you can skip this layer. For more information, see Frequently Asked Questions.
  • Node.js 18 or later on the PATH on every developer machine (Agent Guard runs via npx).
  • Mobile Device Management (MDM) tool with VS Code policy support: Jamf Pro, Kandji, or Mosyle (macOS), or Microsoft Intune or Group Policy (Windows). If you don't have MDM, see Frequently Asked Questions.
  • At least one MCP server allowed in your JFrog AI Catalog project (required for Agent Guard). The JFrog MCP that ships with the IDE plugin is the only MCP that does not need Catalog approval.

This topic covers the following tasks:

Enforce MCP Usage in VS Code

Enforcing MCP usage in VS Code requires two actions: deploy the policy to all developer machines via MDM, then inform developers of the restart requirement. There is no separate lock step. The policies are delivered as enterprise policies, so VS Code marks the settings as managed by your organization and developers cannot change or disable them.

The policy is delivered as a single raw MDM artifact per platform: a configuration profile on macOS, or a registry script on Windows. One artifact writes both layers (the VS Code allowlist and the GitHub Copilot allowlist) plus the delegation locks. Both are idempotent and safe to re-apply. You must tell the policy which Agent Guard invocations to allow as part of every rollout. A policy that allows nothing would block every MCP server, including Agent Guard.

For the full allowlist reference, see the bundled README that ships alongside each artifact.

To enforce MCP usage in VS Code:

  1. Deploy the policy to all developer machines via your MDM tool:

    1. Download the configuration profile:

      https://releases.jfrog.io/artifactory/coding-agents-generic/vscode-mcp-enforcement/[RELEASE]/com.jfrog.vscode-mcp-enforcement.mobileconfig

    2. Before you push the profile, edit the allowlist so it includes the Agent Guard invocations your organization uses. The profile ships with two placeholder entries: a serverCommand pinned to --server {SERVER_ID}, and a serverUrl set to https://{JPD_URL}/mcp for the JFrog MCP.
      Replace {SERVER_ID} with your real server ID (or IDs) and {JPD_URL} with your JFrog Platform host, add more entries for additional servers, or drop an entry you don't need (for example the --server/placeholder pair to allow the unpinned base command, or the serverUrl object if you don't allow the JFrog MCP directly). Keep the three allowlist arrays identical across the two VS Code payloads and the Copilot payload.

      To pin a specific version of the artifact, replace [RELEASE] with the version number.

    3. Push the configuration profile through your MDM (Jamf, Intune, Kandji, Mosyle, or equivalent) to all developer machines. The profile carries three payloads (com.microsoft.VSCode, com.microsoft.VSCodeInsiders, and com.github.copilot), so one install covers both VS Code editions and the Copilot layer. The VS Code payloads set ChatAllowedMcpServers and the delegation locks Claude3PIntegration and Codex3PIntegration (false); the Copilot payload sets allowedMcpServers to the same allowlist. The profile is machine-wide (system scope), so it applies to every user on the machine.
      Removing the profile reverts the policy.

      If you deliver the Copilot allowlist a different way (for example, through GitHub's server-managed settings in a .github-private repository), remove the com.github.copilot payload from the profile before pushing it, to avoid two intersecting allowlists.

      To allow Claude and Codex delegation (opt out), set Claude3PIntegration and Codex3PIntegration to <true/> in both VS Code payloads, then re-push. Deleting the keys is not enough, because VS Code's defaults leave Codex delegation disabled.

  2. Inform developers that they must fully quit and relaunch VS Code after the policy is deployed.

    ⚠️

    Warning

    VS Code reads enterprise policies only at startup. Reload window is not enough. Without a full quit and relaunch, the allowlist does not take effect.

    Ask developers to:

    1. Fully quit VS Code (Quit, not only close the window).
    2. Relaunch VS Code.
    3. Confirm that the allowlist is active as described in step 3.

  3. On a developer machine, verify enforcement: open Settings (Cmd+, on macOS or Ctrl+, on Windows) and search chat.mcp.allowedServers. It should appear read-only with a Managed by your organization badge. Any MCP server that is not the JFrog Agent Guard proxy shows a blocked by policy state and never connects.
    To verify the delegated path, delegate a chat to Copilot and try a server that is not allowed. The Copilot agent-host log records Cannot start unknown MCP server and the server never starts.

Remove the MCP Allowlist Policy

Use this procedure during incident response or when you need to withdraw the enterprise allowlist.

To remove the MCP allowlist policy:

  • Retract the configuration profile through your MDM. Removing the profile reverts ChatAllowedMcpServers, both delegation locks (Claude3PIntegration and Codex3PIntegration), and the Copilot allowedMcpServers value.

Frequently Asked Questions

This section provides answers to frequently asked questions.

plusFAQs
Q: What happens if a developer doesn't restart VS Code after the policy is deployed?

A: The policy is not yet in effect for that developer. Previously configured MCP servers may remain accessible. VS Code loads the policy on the next full restart. Confirm in Settings that chat.mcp.allowedServers shows Managed by your organization. For the developer restart steps, see Enforce MCP Usage in VS Code.

Q: Does the policy disable GitHub Copilot chat delegation?

A: No. Copilot delegation stays available, but it is governed by the GitHub Copilot allowedMcpServers managed setting, so a delegated Copilot session can only run the JFrog Agent Guard proxy, the same as the Local agent. Only Claude and Codex delegation are disabled.

Q: Does this policy cover the Copilot cloud agent?

A: No. This policy governs only on-machine runtimes (the Local agent and on-machine Copilot, Claude, and Codex delegation). The Copilot cloud agent ("Delegate to cloud") runs server-side on GitHub, so it cannot launch MCP servers on the developer's machine, but the MDM policy does not reach it. Govern it on the GitHub side (enterprise owner): block it entirely (Enterprise → AI controls → Agents → Copilot Cloud Agent → Block).

Q: What do I need on the GitHub side for the Copilot layer to work?

A: GitHub Copilot Business or Enterprise with MCP enabled, plus two organization or enterprise Copilot policies: MCP servers in Copilot enabled, and Restrict MCP access to registry servers set to Allow all. If that second policy is not set to Allow all, it can conflict with this managed-settings allowlist. These policies are set in GitHub, independent of the VS Code client version.

Q: We don't use GitHub Copilot. Can I deploy only the VS Code layer?

A: Yes. On Windows, pass -SkipCopilotManagedSettings. On macOS, remove the com.github.copilot payload from the profile before pushing it. The VS Code allowlist and the Claude and Codex delegation locks still apply.

Q: How do I allow Claude and Codex delegation again?

A: On macOS, set Claude3PIntegration and Codex3PIntegration to <true/> in both VS Code payloads, then re-push the profile. On Windows, pass -EnableAgentHostDelegation (or set $ConfigEnableAgentHostDelegation = $true in the OPERATOR CONFIG block for MDM tools that run the script with no arguments), then re-deploy. Force-enable the values rather than deleting the keys, because VS Code's defaults leave Codex delegation disabled. Delegated Claude and Codex sessions bypass the MCP allowlist, so opt out only if your organization accepts that risk. Note that when editing the script, you must keep it UTF-8 with BOM and ASCII-only (see the note above in the Windows (PowerShell) section)."

Q: Can I run the Windows script multiple times without breaking anything?

A: Yes. It is idempotent and atomic. It snapshots the current state, overwrites all managed values with the same content, and verifies them; on any failure it restores the previous state. Safe to re-run through MDM for updates or healing.

Q: What if I don't have MDM infrastructure?

A: Deploying the policy at scale requires MDM. If you don't have it, either evaluate and deploy MDM (Jamf Pro, Kandji, or Mosyle on macOS, or Microsoft Intune or Group Policy on Windows) as a broader security initiative, or use a different IDE where governance does not require MDM, such as Claude Code (managed settings) or Cursor (team config). The GitHub Copilot layer can alternatively be delivered through GitHub server-managed settings, without MDM.

Q: How do I know if my organization has MDM?

A: Ask your IT or security team: "Do we use Jamf, Intune, Kandji, Mosyle, or similar device management tools?" If yes, you already have the infrastructure to deploy this policy.

Q: What if I have multiple JFrog Platform deployments (JPD)?

A: Edit the allowlist so it includes one Agent Guard entry per JPD server ID that developers pin with --server <SERVER_ID>. On Windows, pass those IDs with -ServerIds (comma-separated). On macOS, add the matching entries in the configuration profile before you push it. Enable the MCP Registry for each JPD. For deployment steps, see Enforce MCP Usage in VS Code.

Related Topics

Updated 2 days ago

Did this page help you?