Allow only listed MCP servers and pin each one to an exact version

Spec version

MCP 2026-07-28

Review by

2027-06-30

How to do it

A tool server runs code on the developer's machine or holds a token for another system. A new release can change what it does without anyone noticing. Keep the list where users and repositories cannot widen it, as Enforce the team's agent settings centrally says. Match servers by command or address, never by the name a user gives them, since anyone can call a server github. Write local servers with an exact version, such as @example/mcp-db@1.4.2, never @latest or a bare package name. Treat a version bump as a new dependency, as Review every new package says. Give each server its own token with the rights from Give agents the fewest rights they need. The same idea for agents you ship is Allow only reviewed tools and servers.

Examples

JSON example

{
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverUrl": "https://mcp.example.com/*" },
    { "serverCommand": ["npx", "-y", "@example/mcp-db@1.4.2"] }
  ]
}

JavaScript example

import { readFileSync } from 'node:fs';

const EXACT_VERSION = /@\d+\.\d+\.\d+$/;
const servers = Object.entries(JSON.parse(readFileSync('.mcp.json', 'utf8')).mcpServers ?? {});
const unpinned = servers.filter(([, server]) => server.command === 'npx'
  && !server.args.some(arg => EXACT_VERSION.test(arg)));
if (unpinned.length) {
  console.error('Unpinned MCP servers:', unpinned.map(([name]) => name).join(', '));
  process.exit(1);
}

Python example

import json, re, sys

EXACT_VERSION = re.compile(r"@\d+\.\d+\.\d+$")
servers = json.load(open(".mcp.json")).get("mcpServers", {})
unpinned = [name for name, server in servers.items()
            if server.get("command") == "npx" and not any(EXACT_VERSION.search(a) for a in server.get("args", []))]
if unpinned:
    sys.exit(f"Unpinned MCP servers: {', '.join(unpinned)}")

How to check

A CI script reads every .mcp.json and agent settings file in the repository. It fails on a server that is not on the managed list, and on a local server whose package has no exact version. On a staff machine, adding an unlisted server is refused.

Sources

• Claude Code, control MCP server access for your organization
• MCP specification, tools

Related rules

• AID-33 Enforce the team's agent settings centrally in AI-assisted development
• APS-70 Review every new package in Application security
• AID-26 Give agents the fewest rights they need in AI-assisted development
• AIF-73 Connect product agents only to tools and servers on a reviewed list in AI features