ModelsAtlas
Explore
Atlas / MCP servers / databrickslabs / Databricks Agent Tools

Databricks Agent ToolsSAFE

mcp/databrickslabs/databricks-agent-tools
MCP server by databrickslabs · Audited 2026-10-07
⚑ Report / re-scanSource ↗
Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
9 5r · 4w · 0d
Transport
stdio · streamable-http
License
NOASSERTION
Stars
99
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Table of Contents =================

  • Databricks MCP servers
  • Table of Contents
  • Overview
  • Unity Catalog Server
  • Databricks Managed MCP servers
  • Overview
  • Usage (locally via stdio transport)
  • Supported tools
  • Deploying UC MCP server on Databricks Apps
  • Using databricks bundle CLI
  • Using databricks apps CLI
  • Connecting to the UC MCP server deployed on Databricks Apps
  • Developer Tools Server
  • Deploying a custom MCP server on Databricks Apps
  • Support
  • Contributing

Databricks Managed MCP servers

Databricks provides ready-to-use MCP servers that let agents query data and access tools in Unity Catalog. Permissions are always enforced, so agents and users can only access the tools and data they’re allowed to. For more info see the Databricks docs AWS|Azure|GCP.

Overview

An experimental collection of MCP servers to help AI agents fetch enterprise data from Databricks, automate common developer actions on Databricks, etc:

  • ![status: Deprecated](https://img.shields.io/badge/status-Beta-yellow?s
Read from source at commit 7a86423c055aOBSERVED · 2026-10-07
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add databricks-labs-mcp -- uvx databricks-labs-mcp
claude-desktop
{
  "mcpServers": {
    "databricks-labs-mcp": {
      "command": "uvx",
      "args": [
        "databricks-labs-mcp"
      ]
    }
  }
}
03

Exposed tools (9)

5 read · 4 write · 0 destructive.

ToolRiskDescription
addwriteAdd two numbers
genie_create_messagewriteCreate a message in a conversation.
genie_execute_querywriteExecute SQL query from a message attachment.
genie_generate_downloadreadGenerate download link for full query result.
genie_get_messagereadGet a message from a conversation.
genie_get_query_resultreadGet SQL query result from a message attachment.
genie_get_spacereadGet details of a Genie space.
genie_poll_until_completereadPoll a message until its status is COMPLETED or timeout.
genie_start_conversationwriteStart a new conversation in a Genie space.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (1)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
examples/custom-server/requirements.txt
uv
Why it matters. 1 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 7a86423c055afull audit observations/trust-audit/mcp-server/databrickslabs__databricks-agent-tools.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-077a86423c055aSAFEB89first audit
06

Questions

What tools does Databricks Agent Tools expose?

9 in total: 5 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Databricks Agent Tools safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Databricks Agent Tools need?

No credential environment variables were found in its source, so it appears to need none.

How does Databricks Agent Tools run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as databricks-labs-mcp.

How current is this page?

The grade is for one exact copy of the source (7a86423c055a), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement