GitHub announced on June 25, 2026 that enterprise-managed settings now support strictKnownMarketplaces in VS Code and GitHub Copilot CLI. The public preview lets enterprises control which marketplaces users can install plugins from.
The setup adds strictKnownMarketplaces to the enterprise-managed settings.json. For users licensed through Copilot Business or Copilot Enterprise, Copilot automatically pulls and applies those settings, allowing plugins only from explicitly defined marketplaces. GitHub frames this as client governance before tool execution.
The context is that AI coding agents are moving beyond code generation. They can call tools, connect plugins, operate in the CLI, and run local workflows. The more capable the agent becomes, the more important governance becomes. If users can freely install unknown plugins, companies lose control over data flow, tool behavior, and supply-chain risk.
The value of strictKnownMarketplaces is that it places a control point before a tool is installed, not after an agent has already called an untrusted tool. For large organizations, that kind of pre-execution restriction is practical. AI agent workflows often cross editors, CLIs, repositories, and third-party tools. Each plugin entry point adds another boundary to approve and audit.
This also shows that AI agent security is not only about prompt injection or model output. Enterprises also need to manage which files agents can read, which tools they can call, which plugins can be installed, how credentials are handled, and how execution is logged. Plugin marketplace policy is one part of that responsibility chain.
For development teams, this does not have to reduce speed. A clear marketplace allowlist can make teams more comfortable using Copilot CLI, VS Code plugins, and agent workflows. Developers know which tools are approved, while administrators reduce the risk of unauthorized tools entering the engineering environment.
GitHub's update extends the earlier enterprise-managed plugin direction for Copilot CLI and VS Code. It shows Copilot gradually adding enterprise controls around agent surfaces, not only personal assistant features. As AI enters higher-permission local and cloud workflows, governance becomes part of the adoption threshold.
The main point is that enterprise AI coding needs an operational security model. Letting agents work does not mean letting them connect to every tool. The more mature pattern is to define trusted marketplaces, plugin standards, permission boundaries, and audit processes first, then let AI agents improve engineering throughput inside those controls.
