Enable Specific Servers Blueprint

Whitelist-only MCP server configuration for controlled and secure development environments.

When to Use This Setting

Apply this setting when you need to:

• Enforce a strict whitelist policy where only explicitly approved MCP servers can operate
• Comply with security requirements that mandate explicit authorization for all third-party integrations
• Create a minimal MCP environment with only essential servers for focused development workflows Consider alternatives when:
• You trust all servers in your .mcp.json and prefer to selectively block only known-risky ones
• Your team frequently adds new MCP servers and a whitelist approach creates too much administrative overhead

Quick Start

Configuration

Copy
name: enable-specific-servers-blueprint
type: setting
category: mcp

Example Application

Copy
claude setting:apply enable-specific-servers-blueprint

Example Output

Setting applied. Changes:
- enabledMcpjsonServers: ["memory", "github", "filesystem"]
- All servers not in whitelist are disabled

Core Concepts

Whitelist Security Model Overview

Aspect	Details
Default Deny	All MCP servers are blocked unless explicitly listed in enabledMcpjsonServers
Explicit Trust	Each enabled server has been reviewed and approved for the development environment
Minimal Surface	Reduces the attack surface by limiting the number of active external integrations
Audit Trail	The whitelist serves as documentation of approved integrations for security reviews

Whitelist Enforcement Architecture

+---------------------------+
|  .mcp.json Contains:      |
|  - memory                 |
|  - github                 |
|  - filesystem             |
|  - web-scraper            |
|  - database-admin         |
|  - code-review            |
+---------------------------+
         |
         v
+---------------------------+
|  Whitelist Filter          |
|  enabledMcpjsonServers:   |
|  ["memory", "github",    |
|   "filesystem"]           |
+---------------------------+
         |
    +----+----+
    |         |
    v         v
 ENABLED    BLOCKED
 memory     web-scraper
 github     database-admin
 filesystem code-review

Configuration

Parameter	Type	Default	Description
enabledMcpjsonServers	array	[]	Exclusive list of MCP server names allowed to operate
enabledMcpjsonServers[0]	string	"memory"	Persistent memory server for conversation context retention
enabledMcpjsonServers[1]	string	"github"	GitHub integration server for PR and issue management
enabledMcpjsonServers[2]	string	"filesystem"	File system access server for extended directory operations
description	string	N/A	Security rationale for the whitelist approach and server selection

Best Practices

1. Review each server before adding to the whitelist - Evaluate the server's permissions, network access requirements, and data handling before approving it. Document the review outcome for audit purposes.
2. Maintain separate whitelists per project type - A frontend project may only need the filesystem server, while a full-stack project may require database and API servers. Tailor the whitelist to each project's requirements.
3. Coordinate whitelist changes with the security team - In organizations with security review processes, route whitelist additions through the same approval workflow used for other third-party integrations.
4. Test the whitelist in a staging environment first - Apply the whitelist to a test project and verify that all essential workflows function correctly before rolling it out to production environments.
5. Include the whitelist in project documentation - Document which servers are enabled and why. This helps new team members understand the available tools and the reasoning behind the selection.

Common Issues

1. New MCP server not available after installation - Installing an MCP server adds it to .mcp.json but does not add it to the whitelist. You must explicitly add the server name to enabledMcpjsonServers.
2. Empty whitelist blocks all servers - If enabledMcpjsonServers is an empty array, all MCP servers are disabled. Ensure at least one server is listed if you intend to use MCP functionality.
3. Server name case sensitivity - Server names are matched exactly as specified. A whitelist entry of "GitHub" will not match a server registered as "github" in your .mcp.json file.