Databricks AI Bridge libraryCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The Databricks AI Bridge library provides a shared layer of APIs to interact with Databricks AI features, such as Databricks AI/BI Genie and Vector Search. Use these packages to help author agents with Agent Framework on Databricks.
Integration Packages
If you are using LangChain/LangGraph or the OpenAI SDK, we provide these integration packages for seamless integration of Databricks AI features.
databricks-langchain- For LangChain/LangGraph usersdatabricks-openai- For OpenAI SDK users
Installation
If you're using LangChain/LangGraph or OpenAI:
pip install databricks-langchain pip install databricks-openai
For frameworks without dedicated integration packages:
pip install databricks-ai-bridge
Install from source
With https:
# For LangChain/LangGraph users (recommended): pip install git+https://[email protected]/databricks/databricks-ai-bridge.git#subdirectory=integrations/langchain # For OpenAI users (recommended): pip install git+https://[email protected]/databricks/databricks-ai-bridge.git#subdirectory=integrations/openai # Generic installation (only if needed): pip install git+https://[email protected]/databricks/databricks-ai-bridge.git
20cd63ac9ab6OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add langchainjs --env AGENTBRICKS_E2E_APP_TOKEN=${AGENTBRICKS_E2E_APP_TOKEN} --env CLIENT_SECRET=${CLIENT_SECRET} --env DATABRICKS_CLIENT_SECRET=${DATABRICKS_CLIENT_SECRET} --env DATABRICKS_TOKEN=${DATABRICKS_TOKEN} -- npx -y @databricks/[email protected]{
"mcpServers": {
"langchainjs": {
"command": "npx",
"args": [
"-y",
"@databricks/[email protected]"
],
"env": {
"AGENTBRICKS_E2E_APP_TOKEN": "${AGENTBRICKS_E2E_APP_TOKEN}",
"CLIENT_SECRET": "${CLIENT_SECRET}",
"DATABRICKS_CLIENT_SECRET": "${DATABRICKS_CLIENT_SECRET}",
"DATABRICKS_TOKEN": "${DATABRICKS_TOKEN}"
}
}
}
}Exposed tools (14)
12 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
calculate | read | Perform a calculation |
calculator | read | Perform mathematical calculations. Use this for any math operations. |
get_datetime | read | Get the current date and time in a specific timezone |
get_orders | write | Get the order history for a customer. Requires the customer ID. |
get_time | read | Get the current time |
get_weather | read | Get the current weather |
lookup_customer | read | Look up a customer by their email address. Returns customer ID, name, and membership tier. |
my_tool | read | My tool |
noop | read | Does nothing |
process_refund | write | Process a refund for an order. The refund amount depends on the customer |
search | read | Search for information on a topic. Returns relevant results. |
tool_a | read | Tool A |
tool_b | read | Tool B |
tool_c | read | Tool C |
Trust audit
CAUTIONgrade F · trust 58/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
mod = importlib.import_module(f"{__name__}.{module.name}")mod = importlib.import_module(f"{__name__}.{module.name}")return getattr(importlib.import_module(module), name)
return getattr(importlib.import_module(module), name)
return getattr(importlib.import_module(f"{__name__}.{module}"), name)base_url = f"http://127.0.0.1:{port}""MLFLOW_TRACKING_URI": f"http://127.0.0.1:{port}",is_local = app_url.startswith(("http://localhost", "http://127.0.0.1"))is_local = app_url.startswith(("http://localhost", "http://127.0.0.1"))mock_credential.token = "autoscaling-oauth-token"
mock_credential.token = "endpoint-oauth-token"
.eslintrc.cjs
exec(compile(generated, str(mcps), "exec"), namespace)
exec(compile(rendered, "sandbox_mcp.py", "exec"), namespace)
exec(compile(mcps.read_text(), str(mcps), "exec"), namespace)
run: bash ../../.github/scripts/run_agentbricks_tests.sh unit "${{ matrix.uv-resolution }}"run: bash ../../.github/scripts/run_agentbricks_tests.sh framework
run: bash ../../.github/scripts/run_agentbricks_tests.sh functional
sys.path.insert(0, os.path.abspath("../../src/databricks_ai_bridge"))sys.path.insert(0, os.path.abspath("../../databricks_mcp/src/databricks_mcp"))monkeypatch.setenv("DATABRICKS_APP_URL", "http://127.0.0.1:8000")return self.serde.loads_typed((serialized["type"], base64.b64decode(serialized["data"])))
zod
@ai-sdk/provider, @ai-sdk/provider-utils, @databricks/ai-sdk-provider, @databricks/sdk-experimental, @langchain/core, @langchain/mcp-adapters, ai, zod
uv.lock
Gates applied: no_behavioural_pass.
20cd63ac9ab6full audit observations/trust-audit/mcp-server/databricks__databricks-ai-bridge.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 20cd63ac9ab6 | CAUTION | F | 58 | first audit |
Questions
What tools does @databricks/ai-sdk-provider expose?
14 in total: 12 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @databricks/ai-sdk-provider safe to connect to an agent?
With care. The audit graded it F (58/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @databricks/ai-sdk-provider need?
It reads AGENTBRICKS_E2E_APP_TOKEN, CLIENT_SECRET, DATABRICKS_CLIENT_SECRET, DATABRICKS_TOKEN, LAKEBASE_LIMITED_SP_CLIENT_SECRET, LAKEBASE_NO_ROLE_SP_CLIENT_SECRET, OBO_TEST_CLIENT_SECRET and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @databricks/ai-sdk-provider run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @databricks/langchainjs at 0.1.1-test.0.
How current is this page?
The grade is for one exact copy of the source (20cd63ac9ab6), read on 2026-10-12. The repository is watched and re-audited when it changes.