Guide
GitHub Copilot for JetBrains Enterprise Governance: MCP Allowlists, Plugins, and OpenTelemetry
On August 18, 2026, GitHub added enterprise-managed settings to GitHub Copilot for JetBrains. Administrators can now centrally govern plugin enablement, approved plugin marketplaces, MCP server access, OpenTelemetry collection, and permission modes such as Bypass Approvals or Autopilot. This is more significant than a normal IDE update. Once coding agents can edit files, execute commands, invoke MCP tools, and interact with enterprise systems, local developer settings become part of the organization’s security boundary.
# GitHub Copilot for JetBrains Enterprise Governance: MCP Allowlists, Plugins, and OpenTelemetry
## Article Summary
On August 18, 2026, GitHub added enterprise-managed settings to GitHub Copilot for JetBrains. Administrators can now centrally govern plugin enablement, approved plugin marketplaces, MCP server access, OpenTelemetry collection, and permission modes such as Bypass Approvals or Autopilot. This is more significant than a normal IDE update. Once coding agents can edit files, execute commands, invoke MCP tools, and interact with enterprise systems, local developer settings become part of the organization’s security boundary.
---
Traditional autocomplete has a relatively narrow risk surface. Agent mode can read repositories, edit files, run commands, connect to MCP, and invoke enterprise systems. At scale, unmanaged local settings quickly become impossible to govern.
The new JetBrains controls address four important layers:
1. plugin governance;
2. MCP server allowlists;
3. managed OpenTelemetry;
4. organization-controlled permission modes.
Together they cover extension provenance, tool access, observability, and execution authority.
## Plugin governance
Administrators can centrally control settings such as:
```text
enabledPlugins
extraKnownMarketplaces
strictKnownMarketplaces
```
These settings can require or block specific plugins, add approved marketplaces, and restrict installations to trusted sources.
This matters because modern agent plugins may contain skills, MCP configuration, commands, or hooks. They are not simply visual editor extensions.
A useful enterprise tiering model is:
```text
Tier 0: centrally approved
Tier 1: internally reviewed
Tier 2: experimental by request
Tier 3: prohibited
```
This balances innovation with control.
## MCP server allowlists
GitHub now allows central control over allowed and denied MCP servers.
That is important because MCP may expose tools such as:
```text
query_database
read_jira
create_ticket
deploy
send_email
```
Organizations should maintain a registry that records server ownership, URL, environment, risk level, data classification, tools, allowed roles, authentication, and review date.
IDE configuration should be one enforcement layer, not the entire governance system.
## Server approval is not tool approval
An approved MCP server might expose both `read_logs` and `delete_data`.
Runtime authorization should still evaluate:
```text
user
→ role
→ server
→ tool
→ arguments
→ approval
```
An allowlisted server must not imply unlimited runtime permission.
## Managed OpenTelemetry
Administrators can centrally configure collector endpoints, protocols, service names, resource attributes, and content-capture policy. Managed settings take precedence over local developer preferences.
This creates a foundation for enterprise agent observability.
Useful measurements include:
- agent sessions;
- models;
- tool calls;
- errors;
- timeouts;
- latency;
- adoption by team and repository;
- blocked policy events.
## Avoid full content capture by default
Telemetry itself can become a data risk. Full content may include prompts, filenames, tool arguments, model output, or sensitive source code.
A strong default is metadata-only telemetry. Use temporary content capture only for controlled debugging, and prohibit it entirely for highly sensitive repositories when necessary.
## Permission modes matter
Administrators can prevent agents from using Bypass Approvals or Autopilot.
The critical risk is not simply that an agent can run a command. It is whether a consequential command can run without meaningful human confirmation.
Conservative defaults are appropriate for authentication, finance, infrastructure, production, security tooling, and data platforms.
More permissive modes may be acceptable in isolated sandboxes and documentation projects without production secrets.
## Use different policies for different teams
A practical structure is:
### Default policy
Approved plugins, approved MCP, bypass disabled, metadata telemetry.
### Restricted policy
No external MCP, no autopilot, stronger auditing, stricter tool policy.
### Experimental policy
More models and plugins, isolated sandboxing, richer traces, named test users.
One policy rarely fits every engineering risk profile.
## Combine IDE and repository policy
Repositories should still define:
```text
AGENTS.md
CODEOWNERS
branch protection
required tests
security checks
```
This keeps governance available even if developers switch IDEs, CLIs, or agent products.
## Defense in depth
A mature control stack looks like:
```text
enterprise identity
→ IDE managed settings
→ plugin policy
→ MCP allowlist
→ repository rules
→ runtime tool policy
→ CI and PR review
→ production approval
```
No single setting should carry the full security burden.
## Secret management
Do not store production credentials directly in `mcp.json` or plugin configuration.
Prefer:
```text
IDE
→ enterprise auth broker
→ short-lived token
→ MCP server
```
Tokens should be scoped, revocable, audience-restricted, and bound to real user identities.
## Internal plugin marketplace
An internal marketplace should scan manifests, skills, MCP definitions, hooks, shell behavior, network destinations, licenses, publishers, hashes, and versions.
A reasonable release path is:
```text
Git tag
→ CI scan
→ security approval
→ internal marketplace
```
## Observability dashboards
Build dashboards around adoption, reliability, security, and engineering outcomes.
Do not use generated lines of code as the main productivity metric. Useful outcomes include accepted pull requests, tests added, successful tasks, review time, and production defects.
## A four-week rollout
Week 1: managed settings, read-only MCP, bypass disabled, metadata telemetry.
Week 2: internal plugin registry and a 10–20 developer pilot.
Week 3: approved internal MCP and dashboards.
Week 4: expand to a department and refine policies from real failures and security events.
## Conclusion
The JetBrains update marks a broader transition: AI coding is moving from a personal developer tool toward a centrally governed execution environment.
The important controls are plugins, marketplaces, MCP, telemetry, and permission modes.
The right enterprise strategy is neither full prohibition nor unrestricted autonomy. It is governed experimentation with centrally controlled provenance, permissions, observability, and high-risk execution.
For more GitHub Copilot, MCP, coding-agent, and enterprise-governance analysis, visit **Zyentor Picks**: https://www.zyentorpicks.com/.