This profile is part of our MCP server directory, within The MCP Guide. Profiles are checked against each vendor's own documentation. Need a server built? See MCP development.
Databricks offers a set of managed MCP servers that let AI apps use data and tools in your Databricks workspace. They cover Genie for natural-language analytics, Databricks SQL, AI Search (Vector Search) and Unity Catalog functions. Databricks runs them, and access follows your existing Databricks permissions. Each one speaks the open Model Context Protocol, so standard MCP clients can connect.
Checked against: Databricks managed MCP servers docs on 28 October 2026. eSEOspace did not install or test this server.
Key Takeaways
- Databricks has two kinds of managed MCP endpoints: Unity Gateway MCPs under
system.ai, and older workspace endpoints under/api/2.0/mcp/. system.ai.genie_one_mcpis generally available, and Databricks recommends it for natural-language analytics.- The workspace endpoints are in Public Preview, and a workspace admin must turn on Managed MCP Servers.
- Workspace endpoints skip Unity Gateway, so they do not get MCP-level grants, policies or guardrails.
- Pricing follows the underlying product, such as Databricks SQL pricing for SQL calls.
At a glance
| Item | Detail |
|---|---|
| Publisher | Databricks |
| Official? | Yes |
| Hosting | Remote, in your Databricks workspace |
| Transport | HTTP (remote URL) |
| Sign-in | OAuth with per-server scopes; external services need provider sign-in |
| Read or write | Depends on the server; SQL and sandbox run with the caller's permissions |
| Price | Billed as the underlying product (see below); no separate MCP fee listed |
| Source code | Closed (managed service) |
| Status | Genie One MCP GA; workspace endpoints Public Preview; web search and sandbox need the Unity Gateway beta |
What it can do
Unity Gateway MCPs use this URL pattern:
https://<workspace-hostname>/ai-gateway/mcp-services/<mcp-name>The Databricks data and tool servers are:
system.ai.genie_one_mcp: natural-language analytics. Generally available.system.ai.dbsql: runs SQL on a SQL warehouse.system.ai.web_search: searches the public web. Needs the Unity Gateway beta.system.ai.sandbox: runs Python, SQL or shell code with no network egress. Needs the Unity Gateway beta.
Databricks also lists gateway MCPs for outside services: Slack, GitHub, Atlassian, Google Drive, Google Calendar, Gmail and Microsoft 365.
Workspace endpoints are in Public Preview:
| Server | URL path | OAuth scope |
|---|---|---|
| Genie Agent | /api/2.0/mcp/genie/{genie_space_id} | genie |
| AI Search | /api/2.0/mcp/ai-search/{catalog}/{schema}/{index_name} | ai-search |
| Databricks SQL (legacy) | /api/2.0/mcp/sql | sql |
| Unity Catalog functions | /api/2.0/mcp/functions/{catalog}/{schema}/{function_name} | unity-catalog |
The docs page does not list the individual tool names inside each server.
How to connect it
A workspace admin must first enable Managed MCP Servers. Then point your client at the right URL from the patterns above, using your workspace hostname.
Databricks links to separate setup guides for Claude Code, Codex, Cursor, other coding agents, desktop MCP clients and Python agents. The managed MCP page itself does not include a config example, so follow the guide for your client.
Security notes
The biggest choice is which endpoint type to use.
Unity Gateway MCPs are governed by Unity Catalog grants and policies, plus permissions on the underlying resources. system.ai.dbsql runs queries "using the caller's Unity Catalog and warehouse permissions." So what the AI can read or change is what the signed-in user can read or change.
Workspace endpoints use only the permissions on the underlying resources. Databricks says calls to them bypass Unity Gateway. They therefore lack MCP-level grants, policies and guardrails. Prefer the gateway route when you want central control.
Other points from the docs:
system.ai.sandboxhas no network egress, which limits data exfiltration.web_searchandsandboxare not available to users with consumer-only access.web_searchis not available in HIPAA/BAA workspaces, except in supported US regions or where cross-Geo processing is allowed.- GitHub access defaults to public repositories. Private repos and write actions need the Databricks GitHub connector app.
- Databricks says to check that each outside provider meets your compliance needs.
Because the SQL server acts as the caller, a broad user account means a broad AI. Review excessive permissions and the MCP security hub before rollout.
Pricing
Databricks ties cost to the product each server uses:
| Server | Billed as |
|---|---|
| Unity Catalog functions | Serverless general compute pricing |
| Databricks SQL | Databricks SQL pricing |
| AI Search | AI Search (Vector Search) pricing |
The page gives no billing details for Unity Gateway MCPs.
Alternatives
- Snowflake MCP Server: a managed server you define with SQL, built around Cortex Agents.
- Google BigQuery MCP Server: a remote server with read-only and full SQL tools.
- dbt MCP Server: metrics, models and lineage from dbt.
See every profile in the MCP server directory.
Next step
Pick Unity Gateway endpoints where you can, so one set of policies covers every AI client. Our MCP development team can help you map Unity Catalog grants to the agents that need them.
Frequently asked questions
Is the Databricks MCP server generally available?
Partly. Databricks marks system.ai.genie_one_mcp as generally available. The workspace endpoints are in Public Preview, and web search and sandbox need the Unity Gateway beta.
Can the Databricks SQL MCP server change data?
The docs do not say it is read-only. It runs queries with the caller's Unity Catalog and warehouse permissions, so it can do whatever that user can do. Use a role with only the access the AI needs.
What is the difference between Unity Gateway and workspace endpoints?
Unity Gateway MCPs apply Unity Catalog grants, policies and guardrails at the MCP level. Workspace endpoints bypass the gateway and rely only on permissions on the underlying resources.
How is Databricks MCP usage billed?
Each server is billed as its underlying product. SQL calls follow Databricks SQL pricing, functions follow serverless compute pricing, and AI Search follows Vector Search pricing.
