Databricks MCP Server: Setup and Unity Catalog Governance

Databricks runs its own MCP servers, so you don't have to host one. For plain-English business questions, connect your agent to the Genie One MCP, which is generally available. For SQL you've already written, use the Databricks SQL MCP, which is still in beta. Both check Unity Catalog permissions.

Connecting is the easy part now. The hard part is getting two agents to give the same answer to the same question. That depends on where your metric definitions live, and no MCP server decides it for you.

Which official Databricks MCP server should your AI agents use?

Databricks calls these "Databricks-provided MCPs". Each one lives in the system.ai schema, sits behind Unity Gateway and has the same address shape: https://<workspace-hostname>/ai-gateway/mcp-services/<mcp-name>. Here's every way to put an agent on Databricks over MCP, as of October 18, 2026:

Server	Use it when	Watch out for	Billed as
Genie One MCP (system.ai.genie_one_mcp), generally available	People or agents ask business questions in plain English across the workspace	Answers are asynchronous: the agent polls, and results come back truncated until it asks for the full rows	Genie
Databricks SQL MCP (system.ai.dbsql), beta	The agent runs a SQL query someone already wrote	Reads and writes by default	Databricks SQL
Legacy workspace endpoints (/api/2.0/mcp/sql, /ai-search, /functions)	You already have an integration built on them	They skip Unity Gateway: no gateway tracing, no MCP-level grants or policies	Databricks SQL, serverless compute or AI Search
Custom server on Databricks Apps	You need tools of your own, hosted in your workspace	OAuth only; personal access tokens are rejected	Its Databricks App
External server registered in Unity Gateway	Your server, or a vendor's, runs somewhere else	It has to speak Streamable HTTP, and you need CREATE SERVICE on the schema	Wherever it runs

There's also a Genie Agent MCP for questions "scoped to a single curated Genie Agent", the one your team set up with its own tables, instructions and examples. The other system.ai entries don't query your data: web_search, sandbox, and connectors for Slack, GitHub, Atlassian, Google Drive, Google Calendar, Gmail and Microsoft 365.

::: @figure {Where a Databricks agent's answer comes from.}

If you set one up before September 2026

Databricks announced managed MCP servers for Genie, AI Search and Unity Catalog functions in June 2025. In late September 2026 it made the Genie One MCP generally available as system.ai.genie_one_mcp in Unity Gateway.

Two things follow. The old Genie endpoint, https://<workspace-hostname>/api/2.0/mcp/genie, shuts off on October 31, 2026, so anything pointed at it needs the new address. The legacy SQL, AI Search and functions endpoints still work, but Databricks says new Genie One and SQL connections should use the system.ai MCPs.

How to give AI agents governed access to Databricks over MCP

1. Decide who the agent signs in as. A person in Claude Code or Cursor signs in with OAuth as themselves. An agent that runs unattended signs in as a service principal with OAuth machine-to-machine. Personal access tokens are for local testing.
2. Get an OAuth app. Databricks MCP endpoints don't support dynamic client registration, so an account admin creates the app under Settings > App connections with the ai-gateway scope, and clients also ask for offline_access. Changes can take up to 30 minutes to apply.
3. Turn on the beta if you need SQL. The SQL MCP needs the Unity Gateway beta, which an account admin enables on the account console Previews page. Genie One doesn't need it.

Claude Code

Databricks' ug CLI sets this up for you: ug claude configures Claude Code, and ug mcp add --agents claude --names <catalog>.<schema>.<service> adds an MCP. To do it by hand, run Databricks' command, which uses Claude Code's built-in OAuth client:

# Databricks, "Connect Claude Code", docs updated Oct 7, 2026
claude mcp add --transport http --scope user \
  --client-id claude-code --callback-port 3118 \
  databricks-tools \
  "https://<workspace-hostname>/ai-gateway/mcp-services/<catalog>.<schema>.<service-name>"

Then type /mcp in Claude Code and sign in with your Databricks account. More on wiring warehouses into Claude in our step-by-step MCP guide.

Cursor

ug mcp add --agents cursor writes the entry for you. For a quick test with a personal access token, merge Databricks' example (its Cursor setup page, updated October 7, 2026) into ~/.cursor/mcp.json:

{
  "mcpServers": {
    "dbsql": {
      "url": "https://<workspace-hostname>/ai-gateway/mcp-services/system.ai.dbsql",
      "headers": {
        "Authorization": "Bearer <databricks-pat>"
      }
    }
  }
}

Ask the agent to run SELECT 1 AS result. If it comes back, the connection works.

ChatGPT and Claude connectors

Hosted clients call your workspace from the provider's own IP ranges. If your workspace uses IP access lists, allow those ranges too, not just the IP you browse from.

Databricks MCP access controls: Unity Catalog permissions, read-only and policy enforcement

Genie One checks Unity Catalog permissions on every request. With on-behalf-of-user sign-in, which Databricks recommends, an agent can't read a table its user can't. Attribute-based GRANT policies for MCP services have been generally available since August 31, 2026.

Check the unattended setup first: a service principal, signed in with nobody watching. Two things to check before it goes live.

• On the SQL MCP, it can write. The Databricks SQL MCP "permits reads and writes by default". An analytics bot with write access is a bad week waiting to happen, so set disallow_writes to true in the built-in system.ai.dbsql_policy policy before any agent connects.
• On Genie One, it's billed. Genie's free usage covers people, not service principals, so an unattended agent's questions are billed.

If you want per-user permissions for agents outside Databricks too, we wrote up OAuth for MCP with per-user data permissions.

Business metrics over MCP: why two agents get two answers

An MCP server carries a question to your data. It doesn't know what "active customer" means. Something else has to.

On Databricks, that something is Genie. Genie One answers from Genie Ontology, which Databricks calls "your governed semantic layer" and says is more accurate than "an agent writing SQL directly against raw tables". Ontology is in Public Preview. It combines Unity Catalog semantics, such as your metric views, with context Genie infers from your dashboards, SQL queries and Genie Agents, then ranks each piece by where it came from, how often it's used and how fresh it is. The inferred part is Genie's read of your definitions, ranked by use, not a definition someone signed off on. The SQL MCP has even less: the definition is whatever SQL the agent typed.

Someone still has to write the definitions down. Databricks' own team said it plainly about one example Genie setup: "Genie couldn't answer any of our 13 benchmark questions correctly. Not because the AI wasn't powerful enough, but because it lacked any relevant context." The MCP layer adds none of that context. We read the source of Databricks Labs' open-source MCP server, and its nine Genie tools pass a question along and read the answer back. None of them takes SQL you write.

And the questions don't all come from Databricks. The same revenue number gets asked for from Slack, from Claude, from a notebook and from an agent someone built last week. As Daniel Merighi on our team put it: "With AI assisted code, you can have 5 answers all be correct. With data there is only one." You want that one answer written down once, where you can review a change before it ships.

That's how we built Querio. It connects to Databricks, and your metrics, business rules and the notes on what each table means live in a git repo you own, reviewed like code. Querio, Slack, Claude, the CLI and any agent over MCP read that same layer, which is what makes answers testable. Enver, co-founder of Growdash, says: "We prompt through the MCP every week and diff the answers against golden answers. It's faster, cheaper, and I can actually do evals compared to the BigQuery MCP." Querio's MCP plan is free for 100 queries a month on one data source, with pay-per-use after that. If you're still choosing where definitions should live, our comparison of Cube, Transform and MetricFlow covers the code-first options.

FAQ

How much does the Databricks MCP server cost?

You pay for what runs behind it, as the table above shows. On Genie One, AI usage by people is free until January 31, 2027, but the SQL warehouse compute behind each answer is billed separately. Each user also has a standing allowance of 150 DBUs a month, which Databricks values at $10.50 in US East.

Is there an open-source Databricks MCP server?

Databricks Labs published one on GitHub, databrickslabs/mcp, but its README now says the Unity Catalog server "is deprecated" and points to the hosted servers instead. To run your own code, host it as a custom MCP server on Databricks Apps.

Does the Databricks MCP server work on Azure Databricks?

Yes. Microsoft's Azure Databricks docs list the same system.ai MCPs: the Genie One MCP is generally available, and the SQL, sandbox and web search MCPs need the Unity Gateway beta.