💡 MCP Server Registry and Allowlist Governance Standard

[github-actions[bot]]

Summary

Establish an org-wide MCP server allowlist standard that defines which MCP servers are approved for use in agent configurations (CLAUDE.md, copilot-instructions.md, IDE settings), how new servers are vetted, and CI enforcement via AgentShield. This addresses the growing gap between MCP adoption velocity and MCP governance maturity — a gap that multiple 2026 security incidents have exploited.

Market Signal

MCP governance is the fastest-moving security concern in the agentic tooling space:

• GitGuardian published an enterprise MCP governance framework recommending centralized MCP registries as the foundation of agent security
• DX Heroes reports MCP adoption has outpaced governance in most enterprises — "millions of SDK downloads and thousands of public servers also surfacing real security incidents"
• GitHub Copilot now supports MCP but enterprise governance controls for MCP server allowlists are still emerging
• A DevOps Journal analysis identifies the governance gap: "the tools that Copilot can call once connected to an MCP server are governed by that server's configuration, not by any company-wide policy"
• AWS Bedrock AgentCore uses Cedar-based policy rules for MCP tool restrictions, setting an enterprise governance precedent
• The Clinejection attack exploited MCP-like tool access patterns where an agent's tool access became the attack surface

User Signal

• The org's agent-standards.md already defines AgentShield Layer 1 scanning with 23 MCP Server Security rules — but these are negative rules (block bad patterns), not a positive allowlist (only these servers are approved)
• Existing discussions 💡 Agent Input Sanitization Standard (💡 Agent Input Sanitization Standard for CI Workflows #367) and 💡 Defense-in-Depth Agent Security (💡 Defense-in-Depth Agent Security Framework for CI #339) are related but don't specifically address MCP registry governance
• PR feat(copilot): add org-wide Copilot custom instruction files #328 (feat(copilot): add org-wide Copilot custom instruction files) shows the org is actively expanding agent tooling surface area
• The copilot-instructions-standard.md and copilot-setup-steps workflow demonstrate growing multi-agent configuration complexity

Technical Opportunity

AgentShield's 23 MCP security rules provide the scanning foundation. A positive allowlist can be implemented as:

// standards/mcp-allowlist.json
{
  "version": "1.0",
  "approved_servers": [
    {
      "name": "github",
      "transport": "stdio",
      "package": "@modelcontextprotocol/server-github",
      "max_version": "*",
      "rationale": "GitHub API access for agent workflows"
    }
  ],
  "review_process": "PR to this file with security review from @petry-projects/org-leads"
}

This allowlist can be consumed by a new AgentShield custom rule or a dedicated compliance-audit.sh check that validates all MCP server references in CLAUDE.md, .mcp.json, and copilot-instructions.md files against the approved list. The org's centralized standards architecture means a single allowlist file propagates governance to all repos.

Assessment

Dimension	Score	Rationale
Feasibility	high	Allowlist is a JSON file + a compliance check; no new infrastructure required
Impact	high	Prevents unauthorized MCP server adoption — the primary agent attack surface expansion vector
Urgency	med	MCP usage is growing but still limited; establishing governance now is preventive

Adversarial Review

Strongest objection: The org currently uses few MCP servers in CI — this might be solving a problem that doesn't exist yet. Maintaining an allowlist creates operational overhead for every new MCP server adoption.

Rebuttal: MCP usage is expanding rapidly — the org just added copilot-instructions.md across all repos (PR #328), and CodeRabbit now integrates via MCP for context-aware reviews. The operational overhead of an allowlist is the point: it forces intentional adoption over accidental exposure. The allowlist can start small (GitHub API, Anthropic API) and grow organically. Better to have the governance framework before the attack surface expands than after an incident. The Clinejection case study shows that agent tool access is the new attack surface — MCP servers are the formalized version of that access.

Suggested Next Step

Create standards/mcp-allowlist.json with initial approved servers and a standards/mcp-governance.md policy document defining: (1) allowlist schema and maintenance process, (2) vetting criteria for new MCP servers, (3) compliance-audit check for allowlist enforcement, (4) exception process for development/testing use.

---

Proposed by BMAD Analyst (Mary) — 2026-06-05T10:43:42Z