AI Tool Profile
strictKnownMarketplaces: Copilot Plugin Governance, Limits, and QA
The strictKnownMarketplaces enterprise-managed setting restricts plugin installation in supported GitHub Copilot clients to explicitly configured marketplace source objects; an empty array locks installation down.
Before you buy
Best for: Enterprise platform and security teams governing Copilot CLI and Visual Studio Code plugin sources through centrally managed settings.
Price: Included setting on eligible enterprise-managed plans
Included: A centrally managed allowlist for supported Copilot plugin marketplaces.
Main limits: It is a governance setting, not a separate security product. An empty allowlist blocks installation; client and policy support must be verified.
What Kingy showed: Related coverage: strictKnownMarketplaces for Copilot CLI and VS Code Launch Analysis: Pricing, Use Cases, and Risks. This review does not treat that article as a new test of this exact model, plan or current release.
Buying details checked 2026-10-23 with region and currency stated above. Historical demonstrations and the broader fact ledger keep their own dates.
Check official plans · See the demonstration and disclosure · Compare these workflows
Coverage describes this profile, not a product score or a current price guarantee.
Kingy AI Product Facts
strictKnownMarketplaces
Current statusUnknown
- Company
- Not yet reviewed
- Primary job
- Not yet reviewed
- Audience
- Not yet reviewed
- Evidence
- Source-backed; coverage expanding
- Latest source check
- October 23, 2026
See all tracked product factsPricing, platforms, dependencies, data claims, regions, and timeline
Sources and checks
- Coverage
- 1 of 87 tracked fields currently verified
- Sources
- 1
Source-check dates apply to the tracked facts. Editorial updates elsewhere on this page may have a different date.
Plans and pricing units
Not yet structured in this Kingy record.
Where it runs
- Availability
- Not yet reviewed
Stack and integrations
- Model / provider dependencies
- Not yet reviewed
- Integrations
- Not yet reviewed
Data and regions
- Vendor data-use claim
- Not yet reviewed
- Vendor retention claim
- Not yet reviewed
- Regions
- Not yet reviewed
Launch and latest material update
- Launch
- Not yet reviewed
- Latest material update
- Not yet reviewed
Review history
- strictKnownMarketplaces: Copilot Plugin Governance, Limits, and QA — Product Facts updated
Kingy published an approved change to this Product Facts record.
View published revision
Who should consider it
Enterprise platform and security teams governing Copilot CLI and Visual Studio Code plugin sources through centrally managed settings. The strictKnownMarketplaces enterprise-managed setting restricts plugin installation in supported GitHub Copilot clients to explicitly configured marketplace source objects; an empty array locks installation down.
Plan, price and billing scope
Included setting on eligible enterprise-managed plans. A centrally managed allowlist for supported Copilot plugin marketplaces. Prices use the currency and billing term stated here. Where a numeric rate, region or current entitlement could not be verified, it remains explicit; no checkout was completed.
Limits that affect the decision
It is a governance setting, not a separate security product. An empty allowlist blocks installation; client and policy support must be verified.
What the existing evidence shows
Related coverage: strictKnownMarketplaces for Copilot CLI and VS Code Launch Analysis: Pricing, Use Cases, and Risks. This review does not treat that article as a new test of this exact model, plan or current release. Product coverage; original publication date and evidence scope retained. Read the related article.
Sources and buying-review date
Buying review completed October 23, 2026. This is a source-based buying assessment. No paid product test, new generation, checkout or performance benchmark was performed. Vendor descriptions and historical examples remain distinct from independently measured results. The date does not renew the broader canonical fact ledger.
- Official source: docs.github.com
- Official source: github.blog
- Official source: docs.github.com
- Official source: docs.github.com
- Official source: docs.github.com
- Official source: docs.github.com
- Related Kingy coverage
Check the official offer · Compare related options
Earlier profile, sources and dates
This older record retains its original scope. Current buying qualifications above take precedence where terms have changed.
Kingy verdict: strictKnownMarketplaces is a narrow but valuable enterprise control: it limits plugin installation in supported Copilot clients to explicitly configured marketplaces. It is not package verification, malware scanning or a guarantee that every allowed plugin is safe. Its value depends on precise source definitions, managed-setting delivery and a tested emergency-change process.
What the setting controls
GitHub announced public-preview support for Visual Studio Code and GitHub Copilot CLI on June 25, 2026. Administrators add strictKnownMarketplaces to enterprise-managed settings. Supported clients then restrict plugin installation to marketplaces that match the configured source objects. GitHub’s current reference says an empty array means complete lockdown.
The reference documents source types including GitHub repositories, Git URLs, URLs, npm packages, files, directories, host patterns and path patterns. Broad URL, host or path patterns can weaken the intended boundary. Treat every pattern as code: review it, test positive and negative cases and record who approved it.
Precedence and deployment
GitHub documents managed-setting precedence from MDM-managed settings to server-managed settings, file-based settings and then user-level settings. The CLI reference lists platform-specific managed locations and rejects unsafe file-based configurations in some POSIX cases. A policy written correctly but delivered to the wrong location is not an enforced control.
extraKnownMarketplaces adds sources, while strictKnownMarketplaces limits installation to the known set. enabledPlugins can require or block specific plugin keys. Test these controls together because a marketplace restriction alone does not express which plugin versions or capabilities should be enabled.
Source identity and lifecycle risk
A GitHub repository entry is more specific than a host pattern, but even a specific repository can change owners, default branches and contents. URL and path patterns create additional ambiguity around redirects, encoding and nested paths. Define the narrowest practical source, prefer immutable revisions where the plugin system supports them and monitor changes to every approved marketplace. The review record should connect a business owner, source definition, permitted clients, expected plugins and expiry date so a temporary exception does not become permanent infrastructure.
What it does not prove
An approved marketplace can later change, a repository can transfer ownership, a tag can move and a package can add risky behavior. Source restriction should sit alongside pinned revisions where available, change review, plugin permission analysis, provenance checks, network controls and runtime monitoring. Empty-list lockdown also needs a tested recovery path so administrators do not bypass governance during an incident.
The feature is enterprise management, not a separately priced security product. Access follows the applicable GitHub enterprise and Copilot entitlements. Verify preview availability in the exact client versions and deployment method before treating it as a procurement control.
How Kingy would evaluate it
Build a matrix of approved and unapproved GitHub, Git, URL, npm, file and directory sources. Test exact entries, sibling repositories, redirects, mixed case, path traversal, symlinks, moved tags and host-pattern near misses in both supported clients. Repeat with MDM, server and file settings to confirm precedence and update timing.
Then remove a previously allowed marketplace, deploy an empty list and simulate an urgent exception. Confirm installed-plugin behavior, logs, user messaging and rollback. Kingy reviewed the launch post, managed-settings reference, CLI configuration reference, enterprise plugin standards and pricing documentation; we did not deploy the preview or attempt a bypass.
Primary sources
The Kingy Brief
Get The Kingy Brief.
AI changes, original tests and one practical thing to try. Fridays at 09:00 Vancouver time.
Free · Double opt-in · Unsubscribe anytime
Sign up for The Kingy Brief on Beehiiv.
Signup help and newsletter schedule
Signup form provided by Beehiiv. After submitting, check your inbox for "Confirm your subscription to The Kingy Brief" and open its confirmation link. Check Spam or Promotions if you cannot find it.
Fridays at 09:00 Vancouver time: source-checked AI changes, original tests and one practical thing to try. We skip a week when there is not enough verified material. Free. Unsubscribe anytime.
Alternatives
Tool Links
Related Kingy Links
Launch History
strictKnownMarketplaces for Copilot CLI and VS Code
GitHub launched public-preview strictKnownMarketplaces support in enterprise-managed settings for Copilot CLI and Visual Studio Code, restricting plugin installation to explicitly configured marketplace sources.
strictKnownMarketplaces for Copilot CLI and VS Code provides a useful fail-closed plugin-source boundary, including complete lockdown with an empty list. The public preview does…