---
title: "Allow only listed MCP servers and pin each · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list
id: AID-74
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1357
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Allow only listed MCP servers and pin each one to an exact version

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-74
- Level: Required
- Chapter: [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)
- Rule: Coding agents load only MCP servers on a list kept in managed settings. Each local server runs an exact package version, and each remote server is listed by its full address.
- Check: A CI script reads every `.mcp.json` and agent settings file in the repository. It fails on a server that is not on the managed list, and on a local server whose package has no exact version. On a staff machine, adding an unlisted server is refused.
- Risk: An account or system taken over
- Spec version: MCP 2026-07-28
- Review by: 2027-06-30
- How: A tool server runs code on the developer's machine or holds a token for another system. A new release can change what it does without anyone noticing. Keep the list where users and repositories cannot widen it, as [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md) says. Match servers by command or address, never by the name a user gives them, since anyone can call a server `github`. Write local servers with an exact version, such as `@example/mcp-db@1.4.2`, never `@latest` or a bare package name. Treat a version bump as a new dependency, as [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md) says. Give each server its own token with the rights from [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md). The same idea for agents you ship is [Allow only reviewed tools and servers](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverUrl": "https://mcp.example.com/*" },
    { "serverCommand": ["npx", "-y", "@example/mcp-db@1.4.2"] }
  ]
}
```

### JavaScript example

```js
import { readFileSync } from 'node:fs';

const EXACT_VERSION = /@\d+\.\d+\.\d+$/;
const servers = Object.entries(JSON.parse(readFileSync('.mcp.json', 'utf8')).mcpServers ?? {});
const unpinned = servers.filter(([, server]) => server.command === 'npx'
  && !server.args.some(arg => EXACT_VERSION.test(arg)));
if (unpinned.length) {
  console.error('Unpinned MCP servers:', unpinned.map(([name]) => name).join(', '));
  process.exit(1);
}
```

### Python example

```python
import json, re, sys

EXACT_VERSION = re.compile(r"@\d+\.\d+\.\d+$")
servers = json.load(open(".mcp.json")).get("mcpServers", {})
unpinned = [name for name, server in servers.items()
            if server.get("command") == "npx" and not any(EXACT_VERSION.search(a) for a in server.get("args", []))]
if unpinned:
    sys.exit(f"Unpinned MCP servers: {', '.join(unpinned)}")
```

## Sources

- [Claude Code, control MCP server access for your organization](https://code.claude.com/docs/en/managed-mcp)
- [MCP specification, tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)

## Related rules

- AID-33 [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md) in AI-assisted development
- APS-70 [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md) in Application security
- AID-26 [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md) in AI-assisted development
- AIF-73 [Connect product agents only to tools and servers on a reviewed list](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) in AI features

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md)
- Next: [Read every tool description and allow only the tools the task needs](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-tool-review.md)
- [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)