Databricks managed MCP servers, explained

If you have read what the Model Context Protocol is for, you know the pitch: build each connection between an AI model and a system once, as an MCP server, and any compatible AI can reuse it. Databricks now offers those servers as a managed service over your own data. You do not build or run them; Databricks hosts them, and Unity Catalog governs them.

Here is what that means in practice, and why the governance side is the interesting part.

What “managed” changes

Normally, exposing a system over MCP means someone writes an MCP server, hosts it, wires in credentials, and keeps it patched. That is fine for one or two systems, but it is real work, and every server is a new thing to secure.

A managed MCP server removes that step. Databricks stands the server up for you, in front of data you already hold in the platform, and applies the access controls you already set in Unity Catalog. You point an AI agent at a URL, authenticate, and the tools are there. No infrastructure to run, and no second copy of your permissions to keep in sync.

The servers you get

Databricks exposes a handful of managed servers, each covering one kind of thing an agent might need:

• Unity Catalog functions: your registered SQL functions, offered to the model as callable tools. Good for predefined, safe operations you want an agent to run.
• AI Search (vector search): semantic retrieval over a governed index, so an agent can find relevant documents. This is the same retrieval idea behind RAG in production, with the index living in Databricks.
• Databricks SQL: run SQL against your warehouse, for coding assistants and data work.
• Genie: ask questions of structured data in plain English and get real answers back.

Each is a URL under your workspace (the pattern is /api/2.0/mcp/...), and each requires the AI app to authenticate before it can call anything.

Genie, the worked example

Genie is the one worth dwelling on, because it makes the whole idea concrete for a business reader rather than an engineer.

A Genie space is Databricks’ natural-language interface to a set of tables: you ask “what was revenue by region last quarter?” and it returns the numbers, not a guess. Exposed as a managed MCP server, that same capability is available to an agent. Claude, Microsoft Copilot, or an in-house assistant can ask the Genie space a question mid-task and get grounded figures to work with.

The important detail is what happens underneath. The Genie query is read-only, and it runs with the caller’s Unity Catalog permissions. So if a support agent connects their assistant to a Genie space, the assistant can only query the tables that person is entitled to see. Nobody widened access to make the agent work; the agent simply inherited the access the human already had.

That is the “governed by default” story in a single example: the model gets real data, and the boundary around that data does not move.

Why governance people care

Give an AI agent access to real systems and the first question a serious organisation asks is: who can it reach, and how do we prove it stayed in bounds? Managed MCP servers answer that in a way bolt-on integrations usually cannot.

• Permissions travel with the call. Unity Catalog enforces access, and every tool call inherits the permissions of the user it runs on behalf of. There is no separate agent identity quietly holding broader rights than the people using it.
• Authentication is explicit. Each server is reached with a scoped credential, so access is granted per capability rather than as a blanket key.
• Lineage and audit already exist. Because the data sits in Unity Catalog, the lineage, logging and access history you rely on for people extend to agents, rather than being a new thing to build.

This is exactly the evidence an ISO 42001 or EU AI Act programme asks for: not a promise that access was controlled, but a record that shows it. When you can point at who an agent acted for, what it was allowed to touch, and what it actually did, you are most of the way to the documentation an auditor or a customer wants to see. It is also what makes governed agentic AI more than a slogan, and the foundation for governing your wider AI estate on Databricks.

Where to be careful

Two caveats worth stating plainly.

First, as of 2026 the managed MCP servers are in Public Preview. The Unity Catalog governance underneath is mature, but the MCP layer is still settling, so confirm the current status before you build something load-bearing on it.

Second, “governed by default” is a floor, not a ceiling. Unity Catalog stops an agent reaching data the caller cannot, but you still decide what the caller can reach in the first place, which tools to expose, and where a human must approve an action. As with any MCP setup, expose only what the model genuinely needs, and keep a person in the loop for anything sensitive or irreversible.

The short version

Databricks managed MCP servers let AI agents reach your Unity Catalog data, functions, vector search and Genie spaces through one interface you do not have to build, with permissions enforced on every call. Genie makes it tangible: plain-English questions over governed data, answered only within the asker’s access. For anyone trying to put agents to work without loosening control over their data, that combination of reach plus governance is the point.

We build AI agents and automation on this kind of footing, and help teams put the AI governance around it so the access is one you can actually defend. If you want to work out where Databricks and MCP fit for you, talk to us.