Databricks-provided MCPs

Databricks provides MCPs in the system.ai schema for data and external services. Choose an MCP below, then connect your agent. You don't need to host or register a server.

Each system.ai MCP is a Unity Catalog securable invoked through Unity Gateway. You can govern who invokes them with grants and govern individual calls with policies.

Other workspace MCP endpoints, including the Genie Agent MCP, use permissions on the underlying resources without Unity Gateway governance.

Databricks data and tools

Beta

system.ai.dbsql, system.ai.sandbox, and system.ai.web_search are in Beta. To use them, an account admin must enable the Enhanced Unity Gateway preview from the account console Previews page. Unity Gateway itself is generally available. See Manage account previews.

The Genie One MCP is generally available.

MCP	Description
system.ai.genie_one_mcp	Recommended for natural-language analytics across your workspace. Answers questions with Genie One, grounded in Genie Ontology.
system.ai.dbsql	Runs specific SQL queries for development and data engineering on a SQL warehouse, using the caller's Unity Catalog and warehouse permissions.
system.ai.web_search	Searches the public web and returns a synthesized answer with citations.
system.ai.sandbox	Runs Python, SQL, or shell code in an isolated environment.

MCP	Description
system.ai.genie_one_mcp	Recommended for natural-language analytics across your workspace. Answers questions with Genie One, grounded in Genie Ontology.
system.ai.dbsql	Runs specific SQL queries for development and data engineering on a SQL warehouse, using the caller's Unity Catalog and warehouse permissions.
system.ai.web_search	Searches the public web and returns a synthesized answer with citations.
system.ai.sandbox	Runs Python, SQL, or shell code in an isolated environment.

Choose between Genie One, Genie Agent, and Databricks SQL MCP servers

For analytics use cases, start with the Genie One MCP server. Genie resolves business terms, metric definitions, and table relationships through Genie Ontology, your governed semantic layer. This produces more accurate answers than an agent writing SQL directly against raw tables.

MCP server	Use case	Governance
Genie One MCP (system.ai.genie_one_mcp)	Ask natural-language business questions across your workspace.	Unity Gateway grants and policies, plus underlying resource permissions.
Genie Agent MCP	Ask natural-language questions scoped to one curated Genie Agent, using its tables, instructions, and examples.	Permissions on the Genie Agent and its data. Calls bypass Unity Gateway.
Databricks SQL MCP (system.ai.dbsql)	Run a specific SQL query, such as validating syntax or authoring a pipeline.	Unity Gateway grants and policies, plus underlying resource permissions.

MCP server	Use case	Governance
Genie One MCP (system.ai.genie_one_mcp)	Ask natural-language business questions across your workspace.	Unity Gateway grants and policies, plus underlying resource permissions.
Genie Agent MCP	Ask natural-language questions scoped to one curated Genie Agent, using its tables, instructions, and examples.	Permissions on the Genie Agent and its data. Calls bypass Unity Gateway.
Databricks SQL MCP (system.ai.dbsql)	Run a specific SQL query, such as validating syntax or authoring a pipeline.	Unity Gateway grants and policies, plus underlying resource permissions.

External services

The following Databricks-provided MCPs connect agents to external applications. Each user signs in to the provider with their own account the first time a tool needs it.

MCP	Connects to
system.ai.slack	Slack MCP server
system.ai.github	GitHub MCP server. Reads public repositories by default. See Enable GitHub write access and private repository access.
system.ai.atlassian	Jira and Confluence through the Atlassian Rovo MCP server
system.ai.asana	Tasks, projects, portfolios, users, and teams through the Asana MCP server
system.ai.google_drive	Google Drive, Docs, Sheets, and Slides APIs
system.ai.google_calendar	Google Calendar API
system.ai.gmail	Gmail API
system.ai.microsoft_365	SharePoint, OneDrive, Teams, Outlook, and Calendar through Microsoft Graph

MCP	Connects to
system.ai.slack	Slack MCP server
system.ai.github	GitHub MCP server. Reads public repositories by default. See Enable GitHub write access and private repository access.
system.ai.atlassian	Jira and Confluence through the Atlassian Rovo MCP server
system.ai.asana	Tasks, projects, portfolios, users, and teams through the Asana MCP server
system.ai.google_drive	Google Drive, Docs, Sheets, and Slides APIs
system.ai.google_calendar	Google Calendar API
system.ai.gmail	Gmail API
system.ai.microsoft_365	SharePoint, OneDrive, Teams, Outlook, and Calendar through Microsoft Graph

For the permissions each MCP requests, see Managed OAuth providers. Verify that the provider and your intended use meet your organization's compliance requirements.

If a tool asks you to sign in, open the login link returned by the MCP, authorize access to your provider account, and retry the call. If your organization requires approval, share the app name from the consent screen and the steps in Get admin approval for external services with your administrator. To sign in before your first call, sign in again, or sign out, see Manage provider sign-in.

Connect your agent

Open Unity Gateway in your workspace and select MCPs. Copy the MCP name, such as system.ai.github, and follow your setup guide:

• Claude Code, Codex, Cursor, and other coding agents
• Python agents

For clients that require a server URL, use:

Text

https://<workspace-hostname>/ai-gateway/mcp-services/<mcp-name>

Replace <workspace-hostname> with your workspace hostname and <mcp-name> with the MCP name, such as system.ai.dbsql.

For sign-in, permissions, and connection errors, see MCP authentication.

Get admin approval for external services

Two groups of administrators control whether users can sign in to a connector and what the connection can do:

• Provider administrators: Your organization's Slack, Google Workspace, Microsoft Entra ID, or GitHub administrators decide whether users can authorize the app and which permissions it gets, such as OAuth scopes or access to GitHub repositories. They are often not your Databricks admins.
• Databricks admins: Users with the MANAGE privilege on a connector's MCP decide which tools are available and who can call them. See Govern an MCP.

If a provider blocks sign-in or limits what a connector can access, share the steps for that provider with its administrator. After the administrator approves the app, sign out of the connector and sign in again to get the approved permissions. See Manage provider sign-in.

Approve the Databricks Genie app in Slack

If your Slack workspace requires app approval, the Slack sign-in screen warns that the app is likely blocked. Slack can also drop permissions that an administrator hasn't approved. For example, sign-in succeeds, but the connector can't send messages.

A Slack Workspace Owner or app manager must approve the Databricks Genie app:

1. In Slack, click Admin in the sidebar.
2. Select Apps and workflows to open the Slack Marketplace.
3. Click Browse, then search for and select Databricks Genie.
4. Review the requested permissions and click Approve. The Send messages on a user's behalf permission (chat:write) lets users send messages through the connector.

If a user already requested the app, the Workspace Owner or app manager can approve the pending request instead. See Manage app approval for your workspace.

When Databricks adds a permission to the connector, Slack asks for approval again. Until the new permission is approved, sign-in fails or Slack drops the new permission.

When you sign in again, check the actions that Databricks Genie can take on the Slack sign-in screen. The list should include sending messages. If the connector still can't send messages, ask a metastore admin or another user with MANAGE on system.ai.slack to check its tools:

1. In Unity Gateway, select MCPs and open system.ai.slack.
2. On Overview, click Edit tools.
3. Confirm that the tools that send messages are selected, then click Save changes.

See Choose available tools.

Allow the connectors in Google Workspace

If Google sign-in shows an access blocked error or says that your administrator's policy blocks the app, your Google Workspace administrator restricts which third-party apps can access Google data. The Google Drive, Gmail, and Google Calendar connectors use the same Google OAuth app, so one configuration covers all three.

A Google Workspace administrator with the Service Settings administrator privilege must configure the app:

1. In the Google Admin console, go to Security > Access and data control > API controls.
2. Click Manage App Access.
3. For Configured apps, click Configure new app.
4. Enter the client ID 645306276512-s5jbhbhff6irpdq1fpt2f21pcrf4agqs.apps.googleusercontent.com, click Search, and click the app in the search results.
5. For Scope, leave the top organizational unit selected to configure access for all users, or click Select org units to choose specific organizational units. Click Continue.
6. For Access to Google data, select Trusted. To allow only the scopes that the connectors request, select Specific Google data instead and add the scopes listed in Managed OAuth providers. Click Continue.
7. Review the settings and click Finish.

The app appears in the Configured apps list with the access level you selected. See Control which apps access Google Workspace data.

Approve Microsoft 365 permissions

The Microsoft 365 connector requests its Microsoft Graph permissions for SharePoint, OneDrive, Teams, Outlook, Calendar, and online meetings in a single consent. Users and administrators can't consent to only some of them, such as only the Outlook mail permissions. For the full list, see Microsoft 365 scopes.

Permissions that end in .All typically require administrator consent. If your organization requires administrator approval, share the app name from the consent screen with your Microsoft Entra ID administrator.

To limit what the connector can do, a metastore admin or another user with MANAGE on system.ai.microsoft_365 can remove its write tools. See Choose available tools. Removing tools controls which tools the connector can call. It doesn't change the permissions that the consent screen requests.

Enable GitHub write access and private repository access

By default, the GitHub connector (system.ai.github) can read only public repositories. To access private repositories, or to make changes such as committing files or creating issues and pull requests, the repository owner or a GitHub organization administrator must:

1. Install the Databricks GitHub connector app and grant it access to the required repositories.

   For AWS GovCloud, use the databricks-gh-connector-gov-cloud app instead.

2. If the organization uses an IP allowlist, add the Databricks serverless outbound IPs for your workspace's cloud and region.

After the app is installed, users can work with the granted repositories through the connector, within their own GitHub permissions.

Limitations

• system.ai.web_search is not available in workspaces with HIPAA/BAA compliance enabled. It is available in supported US regions or in workspaces that allow cross-Geo processing.

• system.ai.sandbox does not have network egress.
• system.ai.web_search and system.ai.sandbox aren't available to users with only the consumer access entitlement.

Endpoints not governed by Unity Gateway

These workspace MCP endpoints use permissions on the underlying resources, such as Genie Agents, tables, functions, indexes, and SQL warehouses.

Calls bypass Unity Gateway, so they don't appear in its tracing tables or support MCP-level grants, policies, or guardrails. For new integrations, Databricks recommends the system.ai MCPs in Databricks data and tools and External services when they support your use case.

These endpoints are in Public Preview. Use the Genie Agent endpoint to query a single curated agent, and the AI Search or functions endpoint when your client requires MCP access to those resources.

For these URLs, a workspace administrator must enable Managed MCP Servers on the workspace Previews page.

Use the full server URL below in your MCP client. When using OAuth, request the listed scope.

Server	Server URL	OAuth scope
Genie Agent	https://<workspace-hostname>/api/2.0/mcp/genie/{genie_space_id}	genie
AI Search	https://<workspace-hostname>/api/2.0/mcp/ai-search/{catalog}/{schema}/{index_name}	ai-search
Databricks SQL	https://<workspace-hostname>/api/2.0/mcp/sql	sql
Unity Catalog functions	https://<workspace-hostname>/api/2.0/mcp/functions/{catalog}/{schema}/{function_name}	unity-catalog

Server	Server URL	OAuth scope
Genie Agent	https://<workspace-hostname>/api/2.0/mcp/genie/{genie_space_id}	genie
AI Search	https://<workspace-hostname>/api/2.0/mcp/ai-search/{catalog}/{schema}/{index_name}	ai-search
Databricks SQL	https://<workspace-hostname>/api/2.0/mcp/sql	sql
Unity Catalog functions	https://<workspace-hostname>/api/2.0/mcp/functions/{catalog}/{schema}/{function_name}	unity-catalog

Replace the placeholders with values from your workspace:

• Workspace hostname: Open your workspace and copy the hostname from the browser address bar, without https://, the path, or query parameters. See Find your workspace URL.
• Catalog, schema, and index or function name: Open Catalog and find the index or function. Use the parts of its full name in the URL. For example, main.tools.lookup_customer becomes main/tools/lookup_customer.
• Genie space ID: Open the Genie Agent and copy the space ID from its Settings tab.

Use Unity Gateway MCP servers

These MCP servers work with coding agents, desktop MCP clients, and Python agents. Use the Unity Gateway server URL and the ai-gateway OAuth scope. Review the MCP's access requirements before switching.

Workspace MCP or tool	Unity Gateway MCP	What it does
Databricks SQL MCP (/api/2.0/mcp/sql)	Databricks SQL MCP (system.ai.dbsql)	Runs SQL through Unity Gateway.
Code interpreter (system.ai.python_exec) through the functions MCP	system.ai.sandbox (Unity Gateway Beta)	Runs Python, SQL, or shell code through MCP.

Workspace MCP or tool	Unity Gateway MCP	What it does
Databricks SQL MCP (/api/2.0/mcp/sql)	Databricks SQL MCP (system.ai.dbsql)	Runs SQL through Unity Gateway.
Code interpreter (system.ai.python_exec) through the functions MCP	system.ai.sandbox (Unity Gateway Beta)	Runs Python, SQL, or shell code through MCP.

Call resources directly from Python agents

For Python agents, Databricks recommends these libraries to call resources directly without MCP. These libraries don't route calls through Unity Gateway.

Resource	Python library	Implementation guide
AI Search indexes	AI Bridge retriever tools	Query AI Search indexes.
Unity Catalog functions	UCFunctionToolkit	Call registered functions.
Genie Agent	AI Bridge tools	Query a Genie Agent.

Resource	Python library	Implementation guide
AI Search indexes	AI Bridge retriever tools	Query AI Search indexes.
Unity Catalog functions	UCFunctionToolkit	Call registered functions.
Genie Agent	AI Bridge tools	Query a Genie Agent.

Workspace endpoint pricing

• Unity Catalog functions use serverless general compute pricing.
• Databricks SQL uses Databricks SQL pricing.
• AI Search indexes use AI Search pricing.