Adding an MCP server in VS Code: UI, mcp.json and trust

In VS Code you can add an MCP server from the customizations editor, the Extensions view, a dev container, or a config file such as .vscode/mcp.json. Workspace servers inherit Workspace Trust, and other servers show a trust dialog on first start. On macOS and Linux you can also sandbox a server.

Ways to add a server

The VS Code documentation lists several routes:

• The Agent Customizations editor: run Chat: Open Customizations, pick MCP Servers, then Add Server. It handles a local command, an HTTP or SSE URL, a server from another app's config, or one from the gallery.
• The Extensions view: search @mcp and choose Install for your profile, or Install in Workspace to write .vscode/mcp.json.
• A dev container: put servers under the VS Code customizations section of devcontainer.json.
• Auto-discovery: turn on the discovery setting to reuse configs from Claude Desktop, Copilot CLI, Cursor or Windsurf.
• The command line: the code command has an option to add an MCP server from a JSON definition.

Which file does what

• .mcp.json in workspace root. Top-level key: mcpServers. Notes: Shareable across tools.
• .vscode/mcp.json. Top-level key: servers. Notes: Input variables, dev mode, sandboxing.
• User profile mcp.json. Top-level key: servers. Notes: Personal, opened by MCP: Open User Configuration.

Fields include the type (stdio, http or sse), command, args and url. Use input variables or env files for API keys instead of hardcoding them.

A minimal local server from GitHub's guide looks like this.

{
  "servers": {
    "fetch": { "command": "uvx", "args": ["mcp-server-fetch"] }
  }
}

Trust

Servers defined in the workspace files inherit Workspace Trust. In a trusted workspace they start without a separate prompt, and in Restricted Mode they do not start. Servers from other sources show a trust dialog the first time they start or when their config changes. If you decline, the server does not start. MCP: Reset Trust clears these choices.

This is worth a pause. Opening an untrusted repository and clicking trust can start whatever its config defines. Read the config first.

Choose which tools are on

Select Configure Tools in the chat input to switch individual tools on or off for a server. Fewer tools means a smaller attack surface and less noise for the model.

Sandboxing

Per-server sandboxing is available on macOS and Linux, not Windows. Set sandboxEnabled to true and describe rules for file system access and allowed network domains. The docs note that tool calls from sandboxed servers are auto-approved, so the sandbox rules become your real control.

Debugging

Run MCP: List Servers and choose Show Output to read errors. For autostart behaviour, the autostart setting accepts never, onlyNew or newAndOutdated, with the last as the default.

For GitHub Copilot, the MCP policy is off by default for Business and Enterprise organizations and an admin must enable it. See AI coding agent governance for team controls.

Quick check

Sources

• VS Code MCP servers
• GitHub Copilot MCP setup

Last reviewed: 19 October 2026.