Evaluation record · mcp-server-databricks

MCP Databricks Managed Servers

vManaged MCP servers (Genie Agent, AI Search, SQL, UC Functions GA; Genie One Beta)

Databricks (Official)

MCPdatabaselakehousedata-warehousevector-search

Strong

About This MCP

Databricks managed MCP servers: workspace-hosted endpoints under https://<workspace>/api/2.0/mcp/ for Genie natural-language data queries, AI Search (formerly vector-search; the legacy /api/2.0/mcp/vector-search prefix still works), Databricks SQL execution, and Unity Catalog functions as tools. OAuth with per-server scopes; Unity Catalog enforces permissions on every tool call and traffic is monitorable via the AI Gateway. Zero infrastructure — Databricks hosts and manages auth.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

api reliability

Endpoint availability and GA-status review

Evidence

Databricks managed MCP servers documentation — Workspace-hosted endpoints operated by Databricks; Genie Agent, AI Search, Databricks SQL, and Unity Catalog Functions servers are GA, with Genie One in Beta

highVerified: 2026-07-09

genie nl accuracy

NL-to-data capability review; Genie space curation is the dominant accuracy factor

Evidence

Databricks managed MCP servers documentation — Genie Agent server answers natural-language questions over curated Genie spaces (read-only, asynchronous); accuracy depends on how well the Genie space is curated with instructions and trusted assets

mediumVerified: 2026-07-09

retrieval quality

Retrieval capability assessment

Evidence

Databricks unstructured retrieval tools documentation — AI Search server (GA) queries AI Search indexes (formerly Vector Search) for relevant documents; requires Databricks-managed embeddings for MCP use

mediumVerified: 2026-07-09

sql execution

SQL tool feature review

Evidence

Databricks managed MCP servers documentation — Databricks SQL server (GA) executes AI-generated SQL asynchronously with read and write capability at https://<workspace>/api/2.0/mcp/sql; UC Functions server runs predefined SQL tools

highVerified: 2026-07-09

error handling

Failure-mode and async-behavior review

Evidence

Databricks managed MCP meta parameters documentation — Meta parameters allow tuning of managed server behavior; asynchronous Genie and SQL operations require clients to handle polling and long-running call semantics

mediumVerified: 2026-07-09

🛡️Security

authentication security

Authentication mechanism review

Evidence

Databricks managed MCP servers documentation — OAuth-based authentication managed by Databricks with per-server scopes (genie, ai-search, sql, unity-catalog); no static credentials in MCP client configuration

highVerified: 2026-07-09

access control

Access control model review; per-call Unity Catalog enforcement is among the strongest governance models of evaluated MCP servers

Evidence

Databricks managed MCP servers documentation — Unity Catalog enforces permissions on every tool call across all managed servers — agents can only reach data and functions the authenticated principal is granted

highVerified: 2026-07-09

data modification control

Write-surface assessment; scored below read-only-by-default peers because SQL write capability rides on catalog grants rather than an explicit MCP opt-in

Evidence

Databricks managed MCP servers documentation — Genie servers are read-only, but the Databricks SQL server has read and write capability and UC Functions can execute arbitrary predefined logic — writes are bounded only by Unity Catalog grants, with no separate MCP-level read-only switch documented for the SQL server

highVerified: 2026-07-09

prompt injection resilience

Prompt-injection exposure analysis

Evidence

Model Context Protocol security best practices — Unity Catalog scoping limits what an injected instruction can touch, but retrieved documents and query results still reach the LLM unfiltered; no Databricks-specific result-sanitization countermeasure is documented

mediumVerified: 2026-07-09

credential management

Credential handling review

Evidence

Databricks managed MCP servers documentation — Databricks hosts the servers and manages authentication; OAuth tokens are scoped per server type, avoiding long-lived PATs or connection strings in client config

highVerified: 2026-07-09

🔒Privacy & Compliance

data residency

Data residency review

Evidence

Databricks managed MCP servers documentation — MCP endpoints are hosted on the customer's own workspace hostname in the workspace's cloud region (AWS, Azure, GCP variants documented); tool execution stays within the workspace

highVerified: 2026-07-09

compliance certifications

Platform certification review

Evidence

Databricks Trust Center — Underlying platform holds SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, and FedRAMP authorizations that apply to workspace-hosted MCP execution

highVerified: 2026-07-09

data exposure to llm

Data flow analysis

Evidence

MCP Architecture — Genie answers, retrieved documents, and SQL results returned by tools are sent to the connected LLM provider per its data terms

highVerified: 2026-07-09

governance policy enforcement

Governance enforcement review

Evidence

Databricks Unity Catalog documentation — Unity Catalog row filters, column masks, and grants apply to agent tool calls the same as any other access path, with centralized monitoring via the AI Gateway

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

Databricks managed MCP servers documentation — First-party docs across AWS/Azure/GCP cover endpoints, OAuth scopes, GA/Beta status per server, meta parameters, and client setup examples

highVerified: 2026-07-09

open source transparency

Source availability review; scored down for closed implementation despite open protocol

Evidence

Announcing managed MCP servers blog — Managed MCP servers are a proprietary hosted service; server implementation is not open source, though the MCP protocol itself is open

highVerified: 2026-07-09

audit logging

Audit trail assessment

Evidence

Databricks managed MCP servers documentation — Agent traffic is centrally monitorable via the Unity/AI Gateway, and SQL and Genie activity appears in standard workspace audit logs and query history

highVerified: 2026-07-09

community activity

Community engagement analysis

Evidence

Databricks Community — Managed MCP Servers — Active first-party engagement through Databricks community articles, blog posts, and the databricks-mcp library examples; no public issue tracker for the managed servers themselves

mediumVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment

Evidence

Databricks managed MCP servers documentation — Zero setup: Databricks hosts the servers and manages authentication — clients add the workspace URL for the desired server (e.g. /api/2.0/mcp/genie/{space_id}) and complete the OAuth flow

highVerified: 2026-07-09

scalability

Scalability review

Evidence

Databricks SQL warehouses documentation — SQL and Genie tool calls execute on serverless/SQL warehouse compute that scales elastically; asynchronous execution decouples MCP calls from long-running queries

highVerified: 2026-07-09

cost efficiency

Cost analysis for agent-driven workloads

Evidence

Databricks pricing — No separate charge for the MCP endpoints, but agent-driven Genie, AI Search, and SQL calls consume DBUs; unbounded exploratory agent traffic can accumulate compute cost

mediumVerified: 2026-07-09

integration ecosystem

Ecosystem integration review

Evidence

Databricks MCP overview — Works with Claude, Cursor, and any MCP client; integrates with Mosaic AI Agent Framework, Agent Bricks, and supports custom MCP servers on Databricks Apps alongside the managed ones

highVerified: 2026-07-09

managed operations

Operational burden assessment

Evidence

Announcing managed MCP servers blog — Databricks operates, patches, and secures the MCP endpoints; customers manage only Unity Catalog grants and Genie space curation

highVerified: 2026-07-09

Strengths

+Unity Catalog permission enforcement on every tool call — governance identical to any other access path
+Zero infrastructure: Databricks hosts the endpoints and manages OAuth with per-server scopes
+Full data-agent surface: Genie NL queries, AI Search retrieval, SQL execution, and UC function tools
+Genie Agent, AI Search, SQL, and UC Functions servers are GA with multi-cloud docs (AWS, Azure, GCP)
+Centralized agent-traffic monitoring via the AI Gateway plus standard workspace audit logs
+Backward-compatible endpoint evolution (legacy vector-search prefix still works after AI Search rename)

Limitations

!Databricks SQL server has read and write capability bounded only by Unity Catalog grants — no MCP-level read-only switch documented
!Tool results (documents, Genie answers, SQL output) are exposed to the connected LLM provider
!Closed-source managed implementation; behavior cannot be independently audited
!Genie One server is still Beta; Genie answer quality depends heavily on space curation
!AI Search via MCP requires Databricks-managed embeddings
!Asynchronous Genie/SQL semantics add client-side complexity for long-running calls
!Agent-driven compute (DBUs) can accumulate cost without warehouse guardrails

Metadata

license: Proprietary (managed service)

supported platforms

0: Any MCP client (remote streamable HTTP); Databricks on AWS, Azure, GCP

programming languages

0: N/A (managed service)

mcp version: 1.0

docs: https://docs.databricks.com/aws/en/generative-ai/mcp/managed-mcp

remote endpoint: https://<workspace-hostname>/api/2.0/mcp/{genie|genie/{space_id}|ai-search/{catalog}/{schema}/{index}|sql|functions/{catalog}/{schema}/{function}} (legacy vector-search prefix still supported)

api dependency: Genie, AI Search (formerly Vector Search), Databricks SQL, Unity Catalog Functions

authentication: OAuth managed by Databricks with per-server scopes (genie, ai-search, sql, unity-catalog)

security controls

0: Unity Catalog per-call permission enforcement

1: row filters and column masks

2: AI Gateway monitoring

3: read-only Genie servers

server status: Genie Agent, AI Search, Databricks SQL, UC Functions: GA; Genie One: Beta

first release: 2025-06-18 (announcement); GA rollout through late 2025/early 2026

maintained by: Databricks

Use Case Ratings

code generation

Useful for generating SQL and UC function calls against governed schemas

customer support

AI Search retrieval over support corpora with catalog-scoped access works well

content creation

Indirect fit; retrieval-augmented drafting from governed document indexes

data analysis

Core use case: Genie NL queries and SQL execution over lakehouse data

research assistant

Strong document retrieval plus structured query access in one governed surface

legal compliance

Unity Catalog lineage, grants, and audit logs support compliance review workflows

healthcare

HIPAA-capable platform, but tool results still flow to the LLM provider

financial analysis

Governed lakehouse analytics with column masking and per-call enforcement

education

Good for teaching governed analytics; workspace prerequisites raise the entry bar

creative writing

Minimal applicability beyond data-grounded reference lookups

Similar MCPs

MCP Snowflake Server

Snowflake (Official)

MCP PostgreSQL Server

Anthropic (Archived)

MCP Elasticsearch Server

Elastic

MCP MongoDB Server

MongoDB (Official)