Enables MCP servers to be visible in the marketplace to unauthorized users while restricting actual access. Users can see server metadata and contact information to request access, but tools/prompts remain hidden.

Backend Changes

• Config: Added allow_discovery boolean field to MCPServerConfig (default: false)
• Authorization: New get_discoverable_servers() method returns metadata-only view for unauthorized users
• API: /api/config endpoint includes discoverable_servers array with limited server information

Frontend Changes

• State: ChatContext and useChatConfig propagate discoverable servers from API
• UI: MarketplacePanel renders discoverable servers with:
  • Lock icon + "No Access" badge
  • Grayed-out, non-selectable appearance
  • Server metadata (description, author, required groups)
  • "Request Access" email link (if help_email configured)
  • Hidden tools/prompts

Configuration Example

{
  "admin_tools": {
    "groups": ["admin"],
    "allow_discovery": true,
    "description": "Advanced analytics tools",
    "author": "Analytics Team", 
    "help_email": "[email protected]"
  }
}

Users lacking admin group membership see the server in the marketplace but cannot enable it. Only metadata is exposed; functionality remains protected by group authorization.

Security Model

• Opt-in: Servers hidden by default unless allow_discovery: true
• Exposed: Server name, description, author, help_email, required groups, compliance_level
• Protected: Tools, prompts, functionality, tool counts
• Authorization unchanged: Group membership still required for actual access

• Fixes Allow mcp servers config to allow discoverability #103

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.