Skip to main content

Non-registry servers policy

Use this policy to control whether Stacklok clients can run MCP servers outside the configured registry.

Pair this guide with a Registry policy so clients have a single approved registry to pull from.

Configure the non-registry servers directive​

Add the non_registry_servers directive to your enterprise configuration. The value field controls whether non-registry servers are allowed (true) or blocked (false); pick an enforcement level to match.

values.yaml
enterpriseConfig:
  non_registry_servers:
    # false = only registry servers are allowed (recommended for most orgs)
    # true  = any server is allowed
    value: false
    # "enforced" blocks local overrides; "default" lets users override locally
    enforcement: 'enforced'

The combined behavior of the value and enforcement fields:

EnforcementValueClient behavior
enforcedfalseClients cannot run servers outside the registry.
enforcedtrueClients can run any server, even outside the registry.
defaultfalseClients default to registry-only but may override locally.
defaulttrueClients default to allowing any server and may override locally.

Use enforced with value: false to require clients to use the registry. Use default to let client operators override the setting for local testing.

After updating your configuration, apply the change.

Variations​

Advisory block​

Suggest registry-only servers as the org default while allowing developers to run non-registry servers locally when needed:

values.yaml
enterpriseConfig:
  non_registry_servers:
    value: false
    enforcement: 'default'

Explicitly allow any server​

For sandbox or developer environments where you want to formally permit all servers, set value: true. The enforced level prevents the policy from being tightened locally:

values.yaml
enterpriseConfig:
  non_registry_servers:
    value: true
    enforcement: 'enforced'

Next steps​