GitHub Copilot allowlist

The testedmcp team publishes a managed-settings.json fragment you can merge into the allowedMcpServers list for a GitHub Copilot enterprise. We regenerate this file on every build of the site, from the pinned install lines in our public data and the same ranked set we use on our ranking pages. This build: 2026-11-11. This file has 197 entries (153 exact-command, 44 URL). 6 listed below need a local path and are not in the file. 5 ranked listings have no pin or recorded URL; they are also listed below and are not in the file.

Download managed-settings.json 197 entries, built 2026-11-11

How a Copilot admin uses this list

GitHub Copilot enterprise settings accept a managed-settings.json file whose allowedMcpServers key is a list of matchers. Each entry must contain exactly one matcher:

• serverCommand matches a local stdio server by the exact command and each argument, with no wildcards. The client compares the argv the user would run, not a display string.
• serverUrl matches a remote HTTP or SSE server by URL (GitHub allows wildcards on subdomains or path prefixes). A URL matcher does not pin a package version, and we cannot pin a version for these entries.

GitHub also documents a serverName matcher (a user-assigned label). The docs say to prefer serverCommand or serverUrl when you need to match the server itself. Our file uses only those two.

Where the file goes: most enterprises keep managed-settings.json in a .github-private repository. You can also install it on users' machines with mobile device management. Merge our allowedMcpServers list into your existing file; do not drop your own deny rules or other keys. How it is applied: built-in default servers still run; a match in deniedMcpServers blocks a server; if allowedMcpServers is present, a server that matches none of the entries is blocked. Deny rules take precedence. If the file is not valid JSON, the client treats the policy as an empty allowlist and blocks every server other than the built-in defaults. That is why this download contains only the official allowedMcpServers key. Details are in GitHub's docs:

• Enterprise managed settings (schema and matchers)
• Configure an enterprise allowlist (file location and evaluation order)
• MCP management concepts (managed settings and registries)

What we checked

For each exact-command entry, we installed that exact pinned version and completed an MCP handshake in our testing on the test date shown for that listing.

Remote entries are matched by the URL we recorded. We cannot pin their version. Their test date is the date of our testing of that listing.

This file records those checks. It is not a quality rating, and we do not promise how a server will behave in your environment. Newer versions may differ and were not in our testing.

The file, regenerated on every build

The download at /copilot-allowlist/managed-settings.json is written by the site build, not copied from a static draft. This build: 2026-11-11. Entry count: 197 (153 exact-command, 44 URL).

No pin or recorded URL, not included

5 ranked listings have no pin or recorded URL. We did not invent a matcher for them. These listings are not in the JSON.

Needs your local path, not included

6 exact-command listings need a path or connection string that only you can fill in. They are not in the JSON, because a literal <path> token would not match the argument your machine uses.

Exact-command entries (153)

URL entries (44)

These are matched by URL. We cannot pin their version.

License

The data is licensed under Creative Commons Attribution 4.0 (CC BY 4.0). You may copy, redistribute and adapt it, including commercially, if you credit testedmcp.com, for example: "Data by testedmcp.com (CC BY 4.0), tested YYYY-MM-DD", with a link to https://testedmcp.com/ where possible.

The same license line is in the sibling README.txt. It is not inside managed-settings.json, because an unknown key can make Copilot treat the file as a malformed, empty allowlist.

Built 2026-11-11 by the testedmcp team. 197 entries.