Review MCP servers

Your organization can provide Model Context Protocol (MCP) servers that give your agents access to additional tools and data sources, such as internal APIs or knowledge bases. Administrators configure these servers in JetBrains Central Console, and JetBrains Central CLI delivers them to your machine and adds them to your agents. You don't need to set up anything in the agents yourself.

Each MCP server your organization provides reaches you as an MCP policy. With JetBrains Central CLI, you can:

See which MCP servers your organization provides and whether each one is allowed on your machine.
Allow or deny individual servers.
Choose whether new MCP servers are added to your agents automatically or wait for your review.

Your choices apply only to your machine. Denying an MCP server removes it from your agents, but doesn't change the server for anyone else in your organization. Your administrator doesn't see which servers you allow or deny.

MCP servers that you configured in your agents yourself are not affected: JetBrains Central CLI only adds the servers your organization provides.

MCP servers are added to an agent when you connect the agent or run it once through JetBrains Central CLI. Copilot currently doesn't support MCP servers.

See your organization's MCP servers

To see which MCP servers your organization provides and which of them are added to your agents, run:

central policies

For each server, the command shows its name, ID, and status, followed by its connection details, such as the server URL and HTTP headers:

            MCP policies
            Issue tracker  0f6c2e8a-1b3d-4c5e-9f7a-2d8b6e4c1a90  allowed
                url: https://mcp.example.com/issues
                headers:
                  (none)

            Review these policies, then run 'central policies allow <id>' or 'central policies deny <id>'.
        

The status tells you whether the server is added to your agents:

allowed: The server is added to your agents.
pending: The server is waiting for your review and is not added to your agents yet. Servers become pending only when you turn off automatic approval.
denied: You denied the server, so it is not added to your agents.

To change the status, use the server ID or name with the allow and deny commands.

JetBrains Central CLI checks your organization's MCP servers about once an hour. A server that your administrator has just added or changed can take up to an hour to appear in the list. To get the latest servers now, run:

central agents refresh

Allow or deny a server

If you don't want your agents to use a server that your organization provides, deny it. JetBrains Central CLI removes the server from your agents:

central policies deny <id>

To add a denied server back to your agents, or to add a pending server, allow it:

central policies allow <id>

In place of <id>, use the full server ID or the exact server name shown by central policies. Names are case-sensitive, and if several servers have the same name, use the ID. If the name contains spaces, enclose it in quotes:

central policies deny "Issue tracker"

A denied server stays denied until you allow it again, even when automatic approval is on.

Whether a running agent picks up the change depends on the agent. Claude Agent and Codex, for example, use the updated list of servers only after you restart them.

Allow all pending servers

When you turn off automatic approval, new servers wait as pending. To allow all pending servers at once, run:

central policies allow -a

This command allows only pending servers. Servers that you denied stay denied.

Turn off automatic approval

By default, automatic approval is on: JetBrains Central CLI adds new servers to your agents and applies changes to existing servers without asking you, so you don't need to do anything. You can still deny any server.

If you prefer to review servers before your agents use them, turn off automatic approval:

central config set approve-all-policies off

With automatic approval off:

A new server waits as pending until you allow it.
If an administrator changes the command, arguments, or environment variables of a command server, or the URL or headers of a remote server, the server becomes pending again until you allow it.
The server keeps its ID, and until you allow the change, your agents use its previous settings.
Other changes to a server, such as a new name, are applied without asking you.

To see whether automatic approval is on, run central config and check the Approve all MCP policies line. To turn automatic approval back on, run:

central config set approve-all-policies on

When you turn automatic approval back on, all pending servers are allowed automatically. Servers that you denied stay denied.

16 October 2026