PIMP MY IDEBack to dispatches
October 10, 2026 / MCP / tool authority

Configured is not awake.

GitHub added a JetBrains setting that can stop MCP servers from starting automatically. That small switch exposes a larger design rule. Installation, startup, connection, and tool use are separate grants.

Keep MCP servers parked until the current task needs them. When a server starts, record its source, scope, secret route, and stop path before its tools become callable.

Startup is an authority decision

GitHub's October 10 Copilot for JetBrains release adds a setting that disables automatic MCP server startup for Copilot and Claude.[1] The release note describes one control. The useful consequence is broader. A server entry in a configuration file can stay dormant until a person or policy decides to start it.

That distinction matters because startup can launch a local process, read environment variables, open a network connection, authenticate to another service, and advertise tools. None of those actions is implied by the fact that a configuration exists.

A tool list is inventory. A running server is live authority.

Split the ignition into four records

GitHub's MCP setup guide already separates installation from trust and startup. In its Visual Studio Code flow, the user installs a server, confirms trust before starting it, then checks the configured-server list. The guide also warns that defining the same server in project and personal settings can cause conflicts.[2]

Use four records in any client. Configured names the source and command. Started records the process and launch reason. Connected records the transport and remote identity. Callable lists the tools exposed to the current agent or chat. Do not compress these states into one green dot.

Local does not mean harmless

The MCP security guide treats a compromised local server as its own risk. A local server can execute under the user's account, inherit environment access, and become a route into other resources. The guide recommends sandboxing, least-privilege access, dependency checks, and clear user consent for sensitive operations.[3]

A manual-start policy is not a sandbox. It narrows the time when authority is live. Pair it with a pinned server source, restricted filesystem and network reach, scoped credentials, and a tested stop action. For an allowlisted auto-start policy, make every exception visible and review it when the server revision or requested scope changes.

Default to cold, then justify heat

Manual startup fits rare or sensitive tools. An allowlist fits repeatable project work when the source and scope are stable. Automatic startup can fit a small set of low-risk local services, but it needs the strongest record because it removes a decision point from every new session.

The ignition rack below drafts that record. It does not inspect an installed server, start a process, verify a credential, or prove containment. Its completed state means the policy fields were selected for later review.

Interactive policy fixture

MCP cold-start ignition

Traditional purpose: a startup setting and security checklist. This version joins an ignition mode, four review interlocks, a live authority bus, and one copyable policy packet.

ConfigureStartConnectCall tools

Set the startup key

Choose the intended startup policy. Select only the sections the real review will require.

Parked
Keep the server dormantThe configuration may exist, but no process should start and no tools should become callable.
Startup policy sections
POLICY STRUCTURE OPEN0 of 4 sections selected

Authority bus

The key is parked. No review section is selected.

SERVER PARKEDThe fixture grants no runtime authority. Fill the real packet before changing the startup policy.
Sources read / October 11, 2026 UTC

Source log

Open the evidence boundary
  1. GitHub Changelog, "New controls and chat improvements in Copilot for JetBrains", published October 10 and read October 11, 2026. This supports the new setting that disables automatic MCP server startup for Copilot and Claude. It does not document the setting's implementation or prove containment.
  2. GitHub Docs, "Extending GitHub Copilot Chat with Model Context Protocol servers", read October 11, 2026. This supports the policy boundary, server configuration locations, explicit trust prompt before startup, configured-server check, and duplicate-configuration warning.
  3. Model Context Protocol, "Security Best Practices", version 2025-11-25, read October 11, 2026. This supports the local-server compromise risk and the need for narrow scope, consent, sandboxing, dependency review, and least-privilege access.
  4. Visual Studio Code 1.141 release notes, released October 7 and read October 11, 2026. It was reviewed for adjacent agent-host, session, sandbox, and worktree changes. It does not verify the JetBrains setting.

Evidence boundary: Pimp My IDE read the named release note and documentation. We did not install the JetBrains plugin, change the new setting, start an MCP server, inspect the plugin source, or run a containment test. The interactive rack only drafts a startup policy.