Governance for AI Agents: Databricks Integrates Model Context Protocol (MCP) into Unity Catalog

Summary

Databricks has natively integrated the open-source Model Context Protocol (MCP) into Unity Catalog. This integration addresses one of the most critical hurdles for enterprise AI agent adoption: the secure, controlled, and auditable execution of tools and database queries. Through Unity Catalog, organizations can now centrally manage and monitor security policies, data access rights, and OAuth connections for AI assistants like Claude Code and agents built on frameworks like LangGraph.

What happened?

Databricks released native support for MCP servers within Unity Catalog and the Unity AI Gateway. The Model Context Protocol (MCP), initiated by Anthropic, serves as an open standard enabling AI models to securely access data sources and tools. With this integration, MCP servers can be registered directly inside Unity Catalog. The Unity AI Gateway acts as a centralized control plane (enforcement fabric) that evaluates every tool invocation against defined corporate policies in real time. Partners such as Collibra (for data catalog integrations) and HiddenLayer (for AI security) have already launched integrations.

Why it matters

Previously, security and governance policies had to be implemented individually for each AI agent and development framework. This led to a complex, error-prone integration landscape (the N×M integration problem). By shifting governance to Unity Catalog, tool access for AI agents is unified at the platform level. Organizations can now specify which agent can query which database tables or call specific external APIs, without exposing credentials directly to the agent or the end user. This protects sensitive enterprise data from unauthorized access or misuse by autonomous agents.

Evidence

The integration is documented across several official resources:

Databricks Documentation: Official guides describe the implementation of MCP services on AWS and GCP, as well as connecting external tools 2 3.
Microsoft Azure: Documentation details connecting MCPs to Azure Databricks for use with AI assistants 4.
Partner Integrations: Collibra documents connecting the Collibra MCP to Databricks 5, and HiddenLayer announced its integration into the Unity AI Gateway 8.
Developer Tools: Composio documented the integration of Claude Code with Databricks MCP servers 7.

Analysis

Integrating MCP into Unity Catalog represents a major step forward for enterprise-grade Agentic AI. Databricks categorizes MCP servers into three types to balance flexibility and control:

Managed MCP Servers: Databricks-native services (e.g., Genie Spaces, SQL queries, or Unity Catalog functions) that automatically respect existing user permissions.
External MCP Servers: Secure proxies to third-party tools such as GitHub, Jira, or Slack.
Custom MCP Servers: Custom-built servers that can be hosted as Databricks Apps. The primary advantage of this architecture is its “fail-closed” security model and comprehensive auditability. Because all tool calls pass through the Unity AI Gateway, all traces and activities are saved as tables in the lakehouse, enabling SQL-based querying to satisfy strict compliance and auditing needs.

Practical Takeaways

For organizations and developers, we recommend the following steps:

Centralize Access Control: Leverage existing Unity Catalog grants to define permissions for MCP servers and data sources at both the user and agent levels.
Secure Credentials: Use Unity Catalog’s OAuth support instead of hardcoding API keys or passwords into agent environments.
Enable Audit Logging: Monitor agent-initiated tool calls in the lakehouse to detect anomalous queries or unauthorized tool use early.
Integrate with Claude Code: Test coding assistants with Databricks MCP using integration layers like Composio to secure developer workflows.

Open Questions

How does the real-time policy evaluation of the Unity AI Gateway affect latency and performance for interactive agent tool calls?
To what extent will other cloud data platforms (like Snowflake) follow suit and introduce similar native MCP governance capabilities?