GitHub Copilot MCP registry

Add SpecStream to the private MCP registry your GitHub enterprise or organization sets for Copilot. Developers find it in VS Code, Visual Studio, JetBrains IDEs, Eclipse, Xcode and Copilot CLI, and it keeps running when the policy is Registry only.

SpecStream for GitHub Copilot MCP registryCoding agents

What you need

Copilot Business or Copilot Enterprise, and the enterprise owner or organization owner role on GitHub.
A host for the registry: a server with Docker, a PostgreSQL database and an HTTPS address. Azure API Center works too, as the section near the end shows.
A SpecStream account for each developer who uses the server. New accounts get $10 of credit on sign-up, no card. Create one.

1
1. Put SpecStream's entry in a seed file
SpecStream is published in the official MCP Registry under the server name ai.specstream/specstream. Its entry names one remote, https://api.specstream.ai/mcp over Streamable HTTP, and an optional Authorization header for clients that can't sign in.
The open source MCP Registry loads its servers from a seed file: a JSON array of server entries. This writes SpecStream's latest entry into seed.json. Add the entries of your other approved servers to the same array:
Terminal
curl -s "https://registry.modelcontextprotocol.io/v0.1/servers/ai.specstream%2Fspecstream/versions/latest" \ | jq '[.server]' > seed.json

2. Run the open source registry

The registry is the modelcontextprotocol/registry (opens in a new tab) project, and its prebuilt image is on GitHub Container Registry. The image does not bundle PostgreSQL, so point it at your database with MCP_REGISTRY_DATABASE_URL. MCP_REGISTRY_SEED_FROM loads seed.json when the registry starts.

Keep MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH at false. Anonymous publishing is meant for development, and the repository's docker-compose.yml turns it on. The repository's .env.example lists the other settings:

Terminal
docker run -d --name mcp-registry -p 8080:8080 \
  -v "$PWD/seed.json:/data/seed.json:ro" \
  -e MCP_REGISTRY_DATABASE_URL="postgres://USER:PASSWORD@DB_HOST:5432/mcp-registry" \
  -e MCP_REGISTRY_SEED_FROM=/data/seed.json \
  -e MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false \
  -e MCP_REGISTRY_JWT_PRIVATE_KEY="$(openssl rand -hex 32)" \
  ghcr.io/modelcontextprotocol/registry:latest

curl -s "http://localhost:8080/v0.1/servers?search=specstream"

3. Serve it over HTTPS with the CORS headers

Copilot fetches the registry across origins, so every /v0.1/servers route must send three CORS headers. This Caddyfile serves the registry on your HTTPS address and sets the headers on every /v0.1/ reply, in place of any the registry sent:

Caddyfile
mcp-registry.example.com {
    header /v0.1/* {
        defer
        Access-Control-Allow-Origin "*"
        Access-Control-Allow-Methods "GET, OPTIONS"
        Access-Control-Allow-Headers "Authorization, Content-Type"
    }
    reverse_proxy localhost:8080
}

4. Check the three routes Copilot reads

Copilot reads GET /v0.1/servers, GET /v0.1/servers/{serverName}/versions/latest and GET /v0.1/servers/{serverName}/versions/{version}. The server name holds a slash, so it travels as ai.specstream%2Fspecstream. Each reply should show 200 and the three headers:

Terminal
curl -si "https://mcp-registry.example.com/v0.1/servers/ai.specstream%2Fspecstream/versions/latest" \
  | grep -i -E '^HTTP|^access-control'

5
5. Point Copilot at the registry
For an enterprise: open the enterprise on GitHub, click AI controls at the top of the page, then MCP in the sidebar. Set MCP servers in Copilot to Enabled everywhere. In the MCP Registry URL section, enter https://mcp-registry.example.com and click Save.
For an organization: open the organization's Settings, and in the sidebar under Code, planning, and automation click Copilot, then Policies. In the Features section, set MCP servers in Copilot to Enabled. Enter the address in MCP Registry URL (optional) and click Save.
Enter the base address with nothing after it. Copilot adds the /v0.1 path itself, and a suffix such as /v0.1/servers breaks the registry. Then pick Allow all or Registry only under Restrict MCP access to registry servers. The policy applies to developers at once, and an enterprise policy overrides an organization's.
6
6. Install SpecStream and sign in
Developers on a supported client see your registry's servers in its MCP server list, SpecStream among them. They install it from there. The first time it starts, they sign in to SpecStream, or create an account, and approve the access. No key goes in the registry. Requests run on that developer's account, with its balance and spending limits.
In Copilot Chat agent mode, a developer asks in plain words and names SpecStream:
In Copilot Chat
Use SpecStream to find the pricing page of each vendor in vendors.csv, and add each plan's name and monthly price to the file.

Where the registry works

GitHub lists these clients for registry display and for Registry only enforcement. Copilot in the cloud supports neither. For Eclipse, JetBrains and Xcode, the features are in the prerelease versions of Copilot.

Client	Registry only enforced from
VS Code	1.109.3
Visual Studio	18.4.0
JetBrains IDEs	1.5.64
Eclipse	4.38
Xcode	0.47.0
Copilot CLI	1.0.11

Registry only matches the server ID

With Registry only, a client runs a server only when its ID matches an entry in your registry. For SpecStream the ID is ai.specstream/specstream. A developer who added SpecStream by hand under another name installs it again from the registry list. Registry only also turns off Copilot connectors. GitHub notes that a developer can get around an ID match by editing configuration files.

Enforce with an allowlist

GitHub marks the registry policy as public preview. The control it names as generally available is an allowlist in your enterprise's managed-settings.json, matched by server address. Most enterprises keep that file in a .github-private repository. SpecStream's entry is its address: add { "serverUrl": "https://api.specstream.ai/mcp" } to the allowedMcpServers array.

Using both

Once allowedMcpServers exists, every server that matches no entry is blocked, so list your other servers in the same array.
A server whose address holds an unresolved variable, such as ${VARIABLE}, is blocked. SpecStream's address holds none: sign in goes through the browser, and a key goes in a header.
With an allowlist in place, GitHub recommends setting Restrict MCP access to registry servers to Allow all. The registry then lists the approved servers for developers to find, and the allowlist decides what runs.

With Azure API Center instead

Azure API Center serves a registry with CORS already set. Register SpecStream as an MCP server with the runtime URL https://api.specstream.ai/mcp, as Microsoft's guide Register and discover remote MCP servers (opens in a new tab) shows. Then allow anonymous access in the API center's visibility settings so Copilot can read it. The MCP Registry URL is then https://SERVICE-NAME.data.REGION.azure-apicenter.ms/workspaces/WORKSPACE-NAME.

What the server gives your developers

Search API through search_web: an answer from the live web with the pages it was read on, at $5 per 1,000 searches of up to 10 results.
Extract API through read_pages: the main text of up to 20 pages a call, at $0.80 per 1,000 pages. A page with no text is not charged.
Deep Search through compile, quote_capacity_work and authorize_capacity_work: a request in plain words returns every match as structured rows, at 5¢, 15¢ or $1 a row. The most it can cost is quoted first, and nothing runs until the developer approves it.
Source URL and read time on every value.

Keys for shared agents

A service that can't sign in, such as a build agent, uses an API key instead. In SpecStream, open API keys, click New key, choose Call the APIs and set a Total spending limit. The client sends the key as Authorization: Bearer <key> to https://api.specstream.ai/mcp. Keep it in the client's own secret store, never in the registry.

Cost

Listing SpecStream in your registry costs nothing on our side. Reading and pricing a Deep Search request are free. Searches and pages come out of each developer's balance as they run, and Deep Search never costs more than the maximum the developer approved. Balance, quotes, and billing has the details, and the MCP server guide lists every tool.

Remove it

Take SpecStream's entry out of your registry and its line out of allowedMcpServers. A developer who removes the server from a client stops its calls, and a shared key is revoked under API keys in the SpecStream workspace. Saved results stay in the workspace. Questions go to [email protected].

SpecStream for GitHub Copilot MCP registry covers what it does in GitHub Copilot MCP registry on one page. Every other tool has its guide in Connect your tools. You see the most a request can cost before it starts, and the matches are paid from your balance. Billing has the details. For help, email [email protected].