docs/enterprise-solutions/configuration/infrastructure-configuration/control-other-cline-features/mcp-server-controls.mdx
Cline no longer exposes an MCP Marketplace browse/install surface in the SDK-backed VS Code extension. For Enterprise administrators, the legacy remote configuration field names are still supported for compatibility and now govern MCP server access: local server availability, local server allowlisting, organization-managed remote MCP servers, and blocking personal remote MCP servers.
Enterprise administrators have four configuration options to govern MCP server usage across their organization:
| Setting | Purpose |
|---|---|
mcpMarketplaceEnabled | Allow or block locally configured MCP servers |
allowedMCPServers | Restrict locally configured MCP servers to approved server IDs |
remoteMCPServers | Push pre-configured remote MCP servers to all users |
blockPersonalRemoteMCPServers | Prevent users from adding their own remote MCP servers |
These settings are applied through your organization's remote configuration and take effect immediately for all team members.
To block locally configured MCP servers for your organization, set mcpMarketplaceEnabled to false:
{
"mcpMarketplaceEnabled": false
}
When mcpMarketplaceEnabled is set to false:
When mcpMarketplaceEnabled is set to true or omitted:
allowedMCPServersRather than blocking all local MCP servers, you can restrict local server usage to a curated list of approved servers using the allowedMCPServers setting. This is the recommended approach for most enterprises: it lets developers benefit from MCP while ensuring only vetted local servers are available.
Add an allowedMCPServers array to your remote configuration. Each entry requires an id field that matches the local MCP server name used in the user's MCP configuration:
{
"allowedMCPServers": [
{ "id": "filesystem" },
{ "id": "github" },
{ "id": "internal-code-search" }
]
}
When allowedMCPServers is configured with one or more entries:
idWhen allowedMCPServers is omitted, undefined, or an empty array ([]):
The id for each allowed server must match the server name in the user's mcpServers configuration. For example:
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/project"]
}
}
}
Use remoteMCPServers to push hosted MCP servers directly to all users. This is ideal for internal MCP servers or third-party servers that need specific configuration.
{
"remoteMCPServers": [
{
"name": "Internal Code Search",
"url": "https://mcp.internal.yourcompany.com/code-search",
"alwaysEnabled": true,
"headers": {
"Authorization": "Bearer ${AUTH_TOKEN}"
}
},
{
"name": "Documentation Server",
"url": "https://mcp.internal.yourcompany.com/docs",
"alwaysEnabled": false
}
]
}
Each remote MCP server entry supports the following fields:
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Display name for the server |
url | string | Yes | The URL endpoint of the MCP server |
alwaysEnabled | boolean | No | When true, users cannot disable this server |
headers | object | No | Custom HTTP headers for authentication |
When alwaysEnabled is set to true:
To prevent users from adding their own remote MCP servers, set blockPersonalRemoteMCPServers to true:
{
"blockPersonalRemoteMCPServers": true
}
When blockPersonalRemoteMCPServers is true:
remoteMCPServers configuration are availableWhen blockPersonalRemoteMCPServers is false or omitted:
For organizations that need strict control over all MCP server access:
{
"mcpMarketplaceEnabled": true,
"allowedMCPServers": [
{ "id": "filesystem" },
{ "id": "github" }
],
"remoteMCPServers": [
{
"name": "Internal API Gateway",
"url": "https://mcp.internal.yourcompany.com/gateway",
"alwaysEnabled": true,
"headers": {
"X-Api-Key": "org-managed-key"
}
}
],
"blockPersonalRemoteMCPServers": true
}
This configuration:
For organizations that want flexibility with internal server access:
{
"remoteMCPServers": [
{
"name": "Company Knowledge Base",
"url": "https://mcp.yourcompany.com/kb",
"alwaysEnabled": true
}
]
}
This configuration:
For organizations that want to fully manage the MCP experience:
{
"mcpMarketplaceEnabled": false,
"remoteMCPServers": [
{
"name": "Approved Code Assistant",
"url": "https://mcp.internal.yourcompany.com/code-assist",
"alwaysEnabled": true
},
{
"name": "Internal Docs Search",
"url": "https://mcp.internal.yourcompany.com/docs",
"alwaysEnabled": true
}
],
"blockPersonalRemoteMCPServers": true
}
This configuration:
Most organizations should use the allowlist (allowedMCPServers) rather than blocking local MCP servers entirely. This gives developers access to useful tools while ensuring security review of each server.
alwaysEnabledblockPersonalRemoteMCPServers: true)blockPersonalRemoteMCPServers: true)For help configuring MCP server policies: