Beyond the News
Sign in
Artificial IntelligenceWeb DevelopmentAI CodingDeveloper Tools Active dossier

GitHub brings enterprise MCP and agent controls to Copilot for JetBrains

GitHub now lets Copilot Business and Enterprise administrators centrally govern MCP servers, plugins, telemetry and permissive agent modes in JetBrains IDEs, closing a control gap for teams using AI coding agents outside VS Code.

Reviewed and published by Lars Jansen Updated 4 min read
First published

Key details

  1. GitHub announced the JetBrains enterprise-managed settings on August 18, 2026.
  2. `allowedMcpServers` and `deniedMcpServers` centrally control which MCP servers Copilot for JetBrains can connect to.
  3. `enabledPlugins`, `extraKnownMarketplaces` and `strictKnownMarketplaces` govern plugins and approved plugin sources.
  4. Administrators can centrally set OpenTelemetry collector endpoint, protocol, service name, resource attributes and content-capture policy; managed values override local settings.
  5. `permissions.disableBypassPermissionsMode` can prevent the JetBrains Copilot agent from using Bypass Approvals or Autopilot.
  6. GitHub directs users to the latest version of the Copilot plugin for JetBrains to use the feature.

What builders should take away

  1. If your team uses JetBrains IDEs, inventory current MCP servers and plugin marketplaces before enforcing policy so you can distinguish approved dependencies from shadow tooling.
  2. Use `allowedMcpServers` as an explicit allowlist for production organizations rather than relying only on deny rules; pair it with a documented approval process for new tool servers.
  3. Route Copilot OpenTelemetry to the same approved collector used for other developer tooling, then verify the content-capture setting aligns with your code and data-handling policy.
  4. Disable bypass permission modes where agent actions can change production, secrets, billing or infrastructure; keep more permissive modes limited to isolated development contexts.
  5. Test managed settings on a representative JetBrains cohort before broad rollout, especially teams depending on custom plugins or internal MCP endpoints.

What changed

On August 18, 2026, GitHub added enterprise-managed settings to Copilot for JetBrains. Administrators can centrally require or disable plugins, restrict plugin marketplaces, allow or deny MCP servers, force OpenTelemetry configuration, and disable Bypass Approvals or Autopilot permission modes. Managed values override developer-local settings.

Why it matters

AI coding governance often fails at the client edge: developers can add tool servers, plugins or permissive agent modes in their IDE even when an organization has standardized elsewhere. Extending centrally enforced controls to JetBrains reduces that inconsistency and gives teams a practical way to limit unapproved MCP connections, route telemetry to approved collectors and prevent agents from bypassing approval gates.

What JetBrains admins can now enforce

GitHub Copilot for JetBrains now supports the same enterprise-managed configuration model GitHub has been extending across Copilot clients. Administrators can use `enabledPlugins`, `extraKnownMarketplaces` and `strictKnownMarketplaces` for plugin governance; `allowedMcpServers` and `deniedMcpServers` for MCP connections; centrally managed OpenTelemetry settings for collector endpoint, protocol, service name, resource attributes and content-capture policy; and `permissions.disableBypassPermissionsMode` to stop the agent using Bypass Approvals or Autopilot. GitHub says managed values take precedence over developer-local configuration.

Why this is more than an IDE feature

The practical security problem with agentic coding tools is policy drift between clients. An organization may approve an MCP server, plugin source or agent permission mode in one environment while leaving another client effectively unmanaged. JetBrains is widely used in Java, Kotlin and other enterprise-heavy stacks, so extending the controls there makes a centrally managed Copilot policy materially more complete rather than merely adding another preference screen.

How teams should roll it out

Teams should first inventory existing JetBrains plugins, marketplaces and MCP endpoints so enforcement does not unexpectedly break approved workflows. A useful baseline is an explicit MCP allowlist, approved plugin sources, centrally routed telemetry and disabled bypass modes for repositories or environments with production, infrastructure, secrets or billing access. Exceptions should be deliberate and documented rather than left to local client configuration.

What to watch next

  • Whether GitHub expands the same managed-setting coverage to every Copilot client and IDE surface.
  • Whether MCP governance grows from server-level allow/deny controls to tool-level policies and data-flow controls.
  • How enterprises handle policy exceptions for internal MCP servers and developer-specific plugin needs.

Still unclear

  • GitHub's announcement establishes the available controls but does not provide independent evidence yet on rollout friction, policy-bypass edge cases or how consistently third-party/internal MCP configurations behave under the new settings.

Sources

Direct reading behind this dossier.

2 sources
Continue reading