Databricks shipped managed MCP servers in public preview in early 2026, giving AI agents a governed door into the lakehouse. Instead of an agent guessing at table names, it queries through Genie, Vector Search and Unity Catalog functions — with Unity Catalog's permissions enforced underneath. Here's how the pieces fit and how to wire one up.
What the server actually exposes
A Databricks MCP server is an interface onto your lakehouse data, Unity Catalog metadata and AI services. In practice that means three high-value tool families. Genie spaces turn natural-language questions into governed SQL over a curated set of tables, so "what was weekly revenue last quarter?" returns a real, permission-checked answer. Vector Search indexes let an agent do semantic retrieval over your own documents for RAG. And Unity Catalog functions expose registered SQL and Python functions as callable tools. The throughline is governance: every call runs under Unity Catalog's access model, so the agent inherits the connecting principal's grants and nothing more.
The three deployment options
Databricks gives you three ways to run it, trading control for convenience. Managed servers are hosted by Databricks and are the fastest path — point your client at a workspace endpoint and authenticate. Custom servers on Databricks Apps let you build and host your own server inside the platform when you need bespoke tools. A self-hosted server gives maximum control over infrastructure and auth at the cost of operating it yourself. For most teams the managed option is the right starting point; reach for the others only when a specific governance need forces it.
Connecting it
Managed Databricks MCP servers are remote, OAuth-protected endpoints. Add the workspace MCP URL to a client that supports remote connectors (Claude, Cursor, VS Code), complete the OAuth flow, and the available Genie spaces and indexes appear as tools. If your client is stdio-only you can bridge with mcp-remote, but a native OAuth connector is cleaner. See MCP config file location.
Verify
Ask a Genie-backed question you know the answer to: "How many orders did we process last week?" A correct number confirms the space is reachable and your Unity Catalog grants allow the read. If it returns nothing or an access error, that's almost always a missing grant on the underlying tables — fix it in Unity Catalog, not in the server.
Security
Lakehouse data is sensitive and Genie can run real SQL, so lean on the governance Databricks gives you: connect with a least-privilege principal, scope Genie spaces to exactly the tables a use case needs, and start read-only before exposing anything that writes. Unity Catalog is doing the enforcement — keep its grants tight rather than loosening them to make a demo work. See MCP security best practices and MCP permission scoping patterns.
Going further
Databricks sits alongside other warehouse servers — compare them in MCP for BigQuery vs Snowflake and see the Snowflake and BigQuery profiles. Wire it into a data-analyst loadout or browse the data-analysis category.