MCP Governance

The Admin Console for MCP server governance in Tabnine

Admin-Enforced MCP Server Whitelisting

Admins have the ability to limit what kind of MCP servers are permitted in the organization.

Beneath the // MCP Governance // title of the page, Admins will be able to see a menu of control options will appear that include:

• Allow all – No restrictions

• Allow only remote – Only StreamableHTTP/SSE transports will be permitted

• Allow-list only – Only MCP servers in the allow list can be used

• Block all – Admins can disallow any MCP servers

Adding an MCP Server

Under MCP Governance, you have the option to catalog MCP servers for use in an Allow List.

Simply go to the blue + Add MCP button in the upper righthand corner of the screen and select.

A window will appear where you must input the server’s information.

If it is a remote MCP server, it must include the following:

• Server location (local or remote)

• The MCP server name**

• The MCP server URL

**If the user specifies this server name in the mcp_servers.json file, then the associated configuration must be remote and have this URL.

If from a local (i.e. STDIO) server, it must also include:

• Command Regex

• args

  • ‘Exact match’ toggle (Default is "no")***

***

• "No" args in mcp_servers.json must contain those that occur in the Allow List.

• "Yes" means that those args must be used in the mcp_servers.json file.

Once you do that, hit Save.

Wildcard Patterns

The MCP Governance remote server allowlist supports wildcard patterns, allowing admins to permit entire groups of subdomains or paths with a single entry instead of listing each URL individually.

Patterns follow the same conventions as Chrome extension match patterns:

Component	Wildcard behavior
Scheme	* matches http or https only
Host	* as a standalone host matches any host. *.example.com matches example.com and all subdomains, including multi-level (e.g., foo.bar.example.com). The * must be the first or only character and must be followed by . or /.
Port	* matches any port (e.g., http://localhost:*/*). If omitted, only default ports are matched.
Path	* can appear anywhere in the path and matches any characters.

Examples

Allowlist entry	Allows	Does not allow
https://*.mcp.tabnine.com/	https://foo.mcp.tabnine.com	http://foo.mcp.tabnine.com (wrong scheme)
	https://foo.bar.mcp.tabnine.com	https://other.tabnine.com (missing mcp subdomain)
http://*.example.org/*	http://foo.example.org/bar/bla	https://foo.example.org/bar (wrong scheme)

Restrictions

Partial-label wildcards are not supported. Entries like *foo.example.com or foo*bar.example.com are rejected as invalid. In the host component, the * must be standalone or a prefix followed by a dot, and only one wildcard is permitted. Wildcards in username or password components are not supported.