)
Last updated: 16 October 2026
Why do MCP server registries matter for UK enterprises once agents can add their own tools?
A registry lists which Model Context Protocol servers your agents may discover. A gateway enforces which servers and tools they can actually call. GitHub's own documentation says Copilot's registry-only mode matches server names and IDs, so editing a configuration file can bypass it. That gap is why a registry on its own is advice, not control.
TL;DR: Key Takeaways
- GitHub marks Copilot's "Registry only" mode as public preview, says strict blocking of non-registry servers is not yet available and says editing configuration files can bypass enforcement (GitHub Docs).
- In Visual Studio, GitHub's November 2025 preview offered registry discovery only, with no allowlist enforcement, so all servers could run regardless of policy (GitHub Changelog).
- DEFRA's published AI guidance limits MCP to designated pilot projects, lists six approved servers and requires written approval for any other (DEFRA).
- The NCSC's 15 May 2026 blog advises least privilege and meaningful human oversight for agents (NCSC).
- CVE-2026-103572 (CVSS 8.8) let a path-validation bypass in Visual Studio Copilot write to protected files, including MCP configuration, and was fixed on 13 October 2026 (ToolNavs).
At a glance: MCP server registries versus gateways
Quick Answer
What should MCP server registries for UK enterprises include?
An approved catalogue of MCP servers with owners, versions, scopes and review dates, plus a runtime control point that blocks anything not on the list. Registries answer discovery and approval. Gateways answer enforcement. Plan on the basis that a client-side registry setting can be edited around, and do not let agents edit their own MCP configuration.
| Concern | Private MCP registry | MCP gateway |
|---|---|---|
| Primary job | Discover and record approved servers | Enforce which servers and tools run |
| Typical owners | Platform team and review board | Security and platform |
| Failure mode if used alone | Local configuration edited to bypass the catalogue | Catalogue drifts and the gateway allows stale tools |
| Enforcement point | Client settings and policy | Network path between agents and tools |
)
What MCP server registries are
The public MCP ecosystem has a registry specification for server discovery. Enterprises need a private, approved registry: a reviewed subset that your assistants may use. According to GitHub (2025), administrators can upload an internal registry URL in Copilot policies, hosted on Azure API Center or self-hosted to the v0.1 MCP registry specification.
The policy then has two settings. "Allow all" treats the registry as a recommended vendor list, and developers can still use any server. "Registry only" means only servers in the registry may run, and others are blocked with a policy message. Remote servers are checked by name and install URL. Local servers are checked only by name.
Why a registry alone is not enforcement
GitHub's documentation is direct about the limits. According to GitHub Docs (2026), enforcement relies only on matching server names or IDs, so editing configuration files can bypass it. Strict enforcement that blocks installing non-registry servers is not yet available, and GitHub recommends disabling MCP servers in Copilot for the highest security until it is. The Registry only setting is itself marked public preview.
That does not make registries pointless. They give you the approval record, owners and discovery. It means the enforcement has to sit somewhere an agent or a developer cannot edit from the laptop.
CVE-2026-103572 in one place
According to a ToolNavs (2026) report of Johann Rehberger's disclosure, a path-validation bypass in Visual Studio and SQL Server Management Studio Copilot let indirect prompt injection write to protected files. Those files include MCP configuration and Visual Studio settings, which can lead to arbitrary command execution. The CVSS score is 8.8. Microsoft shipped fixes on 13 October 2026, and the report says there is no confirmed exploitation in the wild.
The registry lesson is narrow. If an agent can write to the file that defines which servers run, the registry is advisory. Treat this as an illustration, and check the Microsoft advisory for the authoritative details.
Privileged MCP access outside any registry
CloudSEK reported in October 2026 that a Gentlemen ransomware affiliate used an MCP service on a local port, authenticated with a fixed bearer token, as a command channel during live intrusions (Daily Security Review). It is a criminal case, not a registry failure, but it shows what an MCP endpoint with broad execution rights and a static credential can do.
How a UK public body approaches MCP approval
DEFRA publishes AI guidance for its delivery teams. As of 16 October 2026 it says MCP is under review and that only designated pilot projects can use it. It names six approved servers: Azure, AWS, SonarQube, Atlassian, GitHub and Azure DevOps. Any other server needs written approval from the project architect and the central AI team.
The same guidance sets practical rules: never auto-approve MCP actions, use OAuth and not personal access tokens, pin versions, use least-privilege scopes and keep MCP away from sensitive and personal data. It does not describe an internal registry. Treat it as one public example of an allowlist with named approvers, not as a statement of what the UK government expects of every organisation.
Building an MCP server approval workflow
| Step | Review criteria | Re-review trigger |
|---|---|---|
| Request | Business owner, data classes, transport | New owner |
| Security review | Authentication, scopes, network egress, secrets handling | Version bump |
| Pin | Exact version or image digest | Any upstream release |
| Publish | Registry entry and gateway policy | Scope change |
| Retire | Remove from registry and gateway | CVE or misuse |
Put Agent Gateway (TrustGate) between agents and MCP servers so there is one policy and logging point, with per-agent permissions and limits. Add Agent Runtime Security (TrustGuard) to watch tool calls as they happen. See also our guides to AI gateways versus MCP gateways and the best MCP gateways.
How we compared
We used GitHub's documentation and changelog for registry behaviour, DEFRA's published guidance for a UK public-sector example and the NCSC for least-privilege direction. CloudSEK reporting reaches us through a trade-press summary, and CVE-2026-103572 through a secondary report. Registry and gateway distinctions follow operational practice, not a statute.
When to involve red teams
Once registry-only mode is on for production, ask red teams to try installing a malicious MCP server through developer laptops, CI tokens and forgotten staging clusters. Feed findings back into the approval checklist. The registry is only as strong as the weakest path that can still register or call a server outside it. Repeat the exercise annually and after any major IDE or CI platform change.
Procurement language that prevents MCP sprawl
Update vendor questionnaires to ask whether a product ships MCP servers, whether those servers are signed and versioned and whether the vendor supports private registry distribution. Prefer vendors that publish an inventory of their tools and accept contractual limits on which tools may be enabled in your tenant. Refuse standing blanket permissions for tool installation by end users in regulated environments.
For internal platform teams, add MCP server publication to the same change-management path as API publication. A new server is a new attack surface, not a casual configuration tweak.
Metrics that show the programme is working
Track four numbers monthly: the share of MCP connections that resolve through the private registry, median approval time, shadow endpoints blocked and incidents involving unapproved tools. Share the trend with the CISO and platform leads. Rising approval time without a process fix means the registry will be bypassed. Falling shadow discoveries after enforcement means the control is working.
Pair the metrics with a short narrative for audit: who owns the registry, how often reviews run and where logs live. Auditors care less about zero exceptions than about a closed loop from discovery to decision to enforcement.
Rolling out registry-only mode without blocking delivery
Start with a pilot: one platform team and two application teams. List the MCP servers they already use, run them through the approval table and publish the first private registry. Enable registry-only enforcement in the pilot, watch for breakages, then expand. Time-box exceptions and require compensating controls such as network egress deny-all plus human approval for tool additions.
Document the relationship between the registry and the gateway in your secure-development standard. The registry is the source of truth for approval state. The gateway is the enforcement point. Drift detection should alert when a runtime tool is not in the registry or when a registry entry has no gateway policy.
Security and governance: enterprise risks of open MCP discovery
Open discovery without enforcement invites prompt injection into tool choice, data leakage through over-scoped servers and tool misuse when agents add their own commands. Governance needs an approval board and a runtime control point.
NeuralTrust approaches MCP control through the Runtime Security Mesh. TrustGate sets per-agent permissions and limits, ships 200+ pre-built MCP servers and acts as a policy and logging point between agents and tools. TrustLens inventories agents and MCP connections. TrustGuard monitors runtime tool use. TrustTest red teams configurations before production. NeuralTrust deploys in your own infrastructure or on-premises, with a managed service hosted in the EU or the US. The platform holds four Gartner Hype Cycle 2026 recognitions, including AI Runtime Defense.
Which should you choose?
| Team | First step | Capability |
|---|---|---|
| Dev teams on coding assistants | Registry settings plus an approved list | Registry |
| Platform teams | Approval workflow and version pinning | Registry and gateway |
| Regulated enterprises | Deny tool installation by policy and log every server call | Gateway and runtime monitoring |
Conclusion
MCP server registries for UK enterprises turn ad hoc plugin trust into an approved list with owners and review dates. Pair them with a gateway, because GitHub's own documentation says client-side registry enforcement can be bypassed by editing configuration. Borrow the governance ideas that fit, such as named approvers and pinned versions, enforce at runtime and re-review on every version bump. That is how an allowlist becomes a control and not a wiki page.
Secure MCP Allowlists in Production with NeuralTrust
Approve servers in a registry, control them at the gateway and monitor every tool call.
)
Related Comparisons
- Top 5 MCP Gateways for UK Enterprise 2026
- 6 Best MCP Gateways for Enterprise (2026)
- AI Gateway vs MCP Gateway: Key Differences Explained
- NCSC AI Guidelines for UK Enterprises 2026
FAQs about MCP Server Registries
1. What is an MCP registry?
A catalogue of Model Context Protocol servers that clients can discover and optionally treat as an allowlist. Public registries help ecosystem discovery. Enterprises should run a private approved registry so assistants only see servers your platform team has reviewed for scope, secrets handling and owner accountability.
2. How is a registry different from a gateway?
Registries record what is approved and who owns it. Gateways enforce what can run, including tool-level allow and deny decisions. You need both: a catalogue without enforcement is advisory, and a gateway without a catalogue drifts into undocumented exceptions.
3. Can GitHub Copilot enforce a private registry?
Partly. GitHub's Registry only mode blocks servers that are not in the registry, but enforcement relies on matching server names or IDs, strict blocking is not yet available and the feature is in public preview. Visual Studio offered discovery without enforcement in the November 2025 preview. Check the current documentation for your tenant before you promise registry-only mode to an auditor.
4. Is DEFRA's approach mandatory for UK firms?
No. DEFRA's guidance is a public-sector example of an approved list with named approvers and written exceptions. It is not a standard for private companies. Regulated firms can apply the same least-privilege logic that the NCSC describes in its agentic AI guidance.
5. What did CVE-2026-103572 change?
It illustrated that an agent able to write to protected configuration files can influence which commands an IDE runs, including MCP configuration. Microsoft shipped fixes on 13 October 2026. The governance lesson is to keep agents from editing their own MCP configuration and to enforce policy outside the client.
6. How often should we re-review servers?
Re-review on every version change, scope change or relevant CVE, and on a fixed calendar cadence for high-risk tools. Track median approval time and shadow MCP discoveries monthly so the process stays faster than unofficial workarounds on developer laptops and CI runners.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specialises in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognised across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- GitHub Docs, MCP allowlist enforcement, accessed 16 October 2026.
- GitHub Docs, Restrict MCP access to registry servers, accessed 16 October 2026.
- GitHub Changelog, MCP registry and allowlist controls for VS Code Stable in public preview, 18 November 2025.
- DEFRA, MCP guidance in the AI SDLC, accessed 16 October 2026.
- NCSC, Thinking carefully before adopting agentic AI, 15 May 2026.
- ToolNavs, Copilot flaw CVE-2026-103572: one trailing dot bypasses validation, October 2026.
- Daily Security Review, Gentlemen ransomware affiliate used MCP as command channel, 7 October 2026.
)
)
)
)