MCP server name entries ignored after VS Code update

### Description ### Summary After updating to VS Code 1.144.0 (stable) and current Insiders, MCP servers that were allowed via `serverName` entries in Copilot enterprise-managed settings (`allowedMcpServers`) are now blocked with: > This Model Context Protocol server is not in the list of servers allowed by your organization. The server names match the `serverName` entries exactly (case-sensitive). The same policy worked before the update. ### Environment - VS Code: 1.144.0 (stable) and Insiders About> - OS: Windows - Policy delivery: file-based, `C:\Program Files\GitHubCopilot\managed-settings.json` ### Policy ```json { "allowedMcpServers": [ { "serverCommand": ["python", "-m", "koppla.server"] }, { "serverCommand": ["npx", "-y", "@progress/kendo-react-mcp@latest"] }, { "serverUrl": "https://mcp.context7.com/mcp" }, { "serverName": "kendo-react-mcp" }, { "serverName": "DBCode" }, { "serverName": "NuGet" }, { "serverName": "excel-mcp" }, { "serverName": "powerpoint-mcp" } ] } ``` ### Steps to reproduce 1. Deploy the policy above. 2. Install an extension that registers an MCP server via `registerMcpServerDefinitionProvider`, e.g. `sbroenne.excel-mcp` (registers stdio server label `excel-mcp`). 3. Run **MCP: List Servers** and start `excel-mcp`. ### Expected `excel-mcp` starts, because `{ "serverName": "excel-mcp" }` is in the allowlist. GitHub's reference documents `serverName` as applicable to **"Any server"**: https://docs.github.com/en/copilot/reference/enterprise-administrators/enterprise-managed-settings#allowedmcpservers ### Actual Blocked with "not in the list of servers allowed by your organization". Same result for `powerpoint-mcp`, `NuGet` (C# Dev Kit), `DBCode` and `kendo-react-mcp` (agent plugin). Servers matched by `serverCommand` / `serverUrl` (koppla, context7) still work. ### Cause (from source) `checkMcpServerAllowed` in `src/vs/platform/mcp/common/allowedMcpServers.ts` now filters the allowlist to transport-specific matchers when any exist, so `serverName` entries are ignored for a stdio server whenever the allowlist contains any `serverCommand` entry (and likewise for URL servers when any `serverUrl` entry exists): ```ts const transportMatchers = identity.url !== undefined ? allowlist?.filter(matcher => isString(matcher.serverUrl)) : identity.command !== undefined ? allowlist?.filter(matcher => Array.isArray(matcher.serverCommand)) : undefined; if (allowlist !== undefined && !isMcpServerMatched(transportMatchers?.length ? transportMatchers : allowlist, identity)) { return McpServerAllowResult.NotAllowed; } ``` ### Why this is a problem - It is a breaking change for existing policies, and it isn't in the 1.144 release notes or the docs. - For extension-provided servers, `serverCommand` is not a practical alternative: the command is an absolute, per-user path that includes the extension version, e.g. `C:\Users\ \.vscode-insiders\extensions\sbroenne.excel-mcp-2.6.1-win32-x64\bin\Sbroenne.ExcelMcp.McpServer.exe`. It changes on every extension update, and `serverCommand` doesn't support wildcards. - Admins who mix matcher types lose the ability to allow extension-provided servers. ### Requests 1. Document this precedence rule (release notes and the GitHub `allowedMcpServers` reference), or restore `serverName` as an independent matcher. 2. Provide a supported way to allow extension-provided MCP servers that survives extension updates, e.g. match by extension ID plus provider ID, or support wildcards in `serverCommand`. 3. Show the more specific error message ("A name entry matches, but this allowlist contains command entries…") in the MCP server list, so admins can diagnose this. ### Issue Details Item|Value ---|--- Issue Category|Bug Target|Visual Studio Code - Insiders Repository|Microsoft/vscode VS Code Version|Code - Insiders 1.145.0-insider (206844b5537c1b7582f6e81b41e1c5402c7e7fbc, 2026-10-29T04:39:53Z) OS Version|Windows_NT x64 10.0.26100 ### Additional Issue Data [issue-data.md](https://github.com/user-attachments/files/34146097/issue-data.md)