Skip to main content

Restrict GitHub Copilot to the Willow Gateway

GitHub Copilot Business and Enterprise let admins publish an MCP registry and enforce a Registry only allowlist policy. When enforced, Copilot blocks every MCP server at runtime whose install URL is not in the registry.

Willow serves a GitHub-compatible MCP registry out of the box from the connect service. Point Copilot at it and set the policy to Registry only, and your developers' Copilot can reach MCP servers only through your Willow gateway — everything else is blocked.

This is a distinct enforcement layer from AI Discovery. AI Discovery uses the Willow Scan Agent to find and govern MCP servers already configured on developer machines; this control uses GitHub's own client-side allowlist to stop unsanctioned servers from running in Copilot in the first place. The two complement each other.

Public preview

GitHub's MCP registry URL and allowlist are in public preview and subject to change. Enforcement is confirmed for VS Code Stable and Copilot CLI. Visual Studio currently supports discovery only (no enforcement yet); JetBrains, Eclipse, and Xcode are pre-release. Confirm which surfaces your Copilot users run.

How it works​

Willow's connect service exposes the registry endpoints GitHub Copilot expects:

GET  https://<connect-domain>/registry/v0.1/servers
GET  https://<connect-domain>/registry/v0.1/servers/{name}/versions/{version}

The registry returns entries whose remotes[].url point at your Willow run gateway (https://<run-domain>/mcp). So when Copilot enforces Registry only, the only MCP endpoint that passes validation is your Willow gateway — remote enforcement validates the exact URL.

  • SaaS / hybrid — connect is {org}.withwillow.ai, so the registry base is https://{org}.withwillow.ai/registry.
  • On-prem — connect is willow-dashboard.<domain> and run is willow.<domain> (see On-Prem Deployment). The registry base is https://willow-dashboard.<domain>/registry.

Prerequisites​

  • GitHub Copilot Business or Copilot Enterprise (the registry URL and allowlist policy are not available on Copilot Individual).
  • Enterprise owner or organization owner access on GitHub.
  • Your Willow connect domain, reachable by developers' IDEs. GitHub Copilot fetches the registry client-side, so it must be reachable from the developer's machine (inside your network for on-prem or air-gapped setups — it does not need public internet access).

Step 1 — Confirm the run gateway is wired into connect​

The registry entries only work if connect knows your run gateway URL. connect resolves it in this order:

  1. The org's default external gateway in Gateway Settings
  2. The org's gateway url setting
  3. The RUN_URL environment variable (used for single-tenant on-prem deployments)
  4. The connect request base URL

For on-prem, make sure the connect deployment has RUN_URL set to your run gateway (for example https://willow.<domain>), or that Gateway Settings point at it. If neither is set, registry entries emit a broken /mcp URL and Copilot will reject them.

Verify the registry returns your run domain:

curl https://<connect-domain>/registry/v0.1/servers

Each entry's remotes[].url should read https://<run-domain>/mcp.

Step 2 — Set the MCP Registry URL and policy in GitHub​

Enter the registry base URL only — https://<connect-domain>/registry. GitHub Copilot appends /v0.1/servers automatically, so do not include that suffix.

For an enterprise​

  1. Navigate to your enterprise, then click AI controls at the top of the page.
  2. In the sidebar, click MCP.
  3. Ensure MCP servers in Copilot is set to Enabled everywhere.
  4. In MCP Registry URL, enter https://<connect-domain>/registry, then click Save.
  5. In Restrict MCP access to registry servers, select Registry only.

For an organization​

  1. In the upper-right corner of GitHub, click your profile picture, then Organizations, and select your org.
  2. Go to Settings → Copilot → Policies.
  3. In Features, ensure MCP servers in Copilot is Enabled.
  4. In MCP Registry URL, enter https://<connect-domain>/registry, then click Save.
  5. In Restrict MCP access to registry servers, select Registry only.
Policy precedence

Enterprise policies override organization policies, and Registry only always wins over Allow all when both apply to a user. If a user holds multiple Copilot seats, GitHub resolves to a single active policy and registry.

Step 3 — Have developers connect through Willow​

Developers connect Copilot to the Willow gateway URL from the registry entry. See Connect VS Code to Willow for the VS Code + Copilot flow. The URL they configure must match the registry entry exactly for the allowlist to permit it.

Step 4 — Verify enforcement​

  • In VS Code, have a developer add any non-Willow MCP server. Copilot should block it at runtime with a policy message naming the enforcing organization or enterprise.
  • Confirm the Willow server still connects: Command Palette → MCP: List Servers, then check the tools appear in Copilot Chat's tools panel.
  • If a server is unexpectedly blocked, check the Copilot logs — they record which registry was checked and the result.

Limitations​

  • Public preview — behavior and UI may change.
  • Remote vs. local servers — enforcement validates the full URL for remote servers (strict), but only the server name/ID for local (stdio) servers, which can be bypassed by editing local config files. For strict security, keep only remote servers in the registry — which is exactly what Willow's registry emits.
  • Surface support — enforcement is live in VS Code Stable and Copilot CLI; other IDEs are discovery-only or pre-release. For the highest assurance on unsupported surfaces, consider disabling MCP servers in Copilot until enforcement ships.
On this page