How do I control access to MCP servers?

Summary

• Register an MCP server in Unity Gateway as an MCP service, a Unity Catalog securable. Callers need EXECUTE on it, plus USE CATALOG and USE SCHEMA on its parents.
• Tool selection decides which of a server's tools are exposed. Unselected tools do not appear in tools/list, and calls to them are rejected.
• Rate limits cap tool calls in queries per minute, and calls over the limit return HTTP 429.
• Service policies, which are in Beta, can allow, deny, or ask for approval on a tool call, and they can also check its result.
• Usage is recorded in system.ai_gateway.usage, and MCP changes and invocations can be reviewed in the audit log.

How do I control access to MCP servers?

Control access in layers. Unity Catalog grants decide who can call an MCP service, tool selection decides which tools it exposes, rate limits cap volume, service policies check the content of each call, and system tables record what happened. Unity Gateway is the control plane that applies these controls to models, MCP servers, and skills. Callers authenticate with a Databricks credential, either a personal access token or an OAuth token, and the usage table records which one in auth_mode.

What are the access control layers?

Layer	What it controls	How you set it
Grants	Who can call the MCP service	EXECUTE on the service, USE CATALOG and USE SCHEMA on its parents, and workspace assignment
Tool selection	Which tools the service exposes	Select tools manually, by exact name, or by prefix such as get_*
Service policies (Beta)	What a call or result may contain	Allow, deny, or ask for approval on a call, and check its result
Rate limits	How many calls	Queries per minute (QPM) for the service, per user, or for custom users and groups
Network and client access	Connectivity and which clients can connect	Outbound network rules, private endpoints, OAuth client settings, IP access lists
Monitoring	What happened	system.ai_gateway.usage and the audit log

How do I give a team access?

Grant EXECUTE on the MCP service to a user, group, or service principal, and make sure they also have USE CATALOG and USE SCHEMA on its parents. With the Databricks CLI:

databricks grants update mcp_service main.default.my_mcp \
  --json '{"changes": [{"principal": "data-team", "add": ["EXECUTE"]}]}'

Do not hand out USE CONNECTION to end users. The docs reserve it for MCP authors and administrators, because it permits direct use of the underlying connection outside the MCP's tool selection and policies.
Databricks-provided MCPs in system.ai can inherit a default EXECUTE grant. To restrict them, review those broad grants and use GRANT policies with governed tags. A tag condition does not remove existing access: "A direct or inherited grant can still allow access to an untagged service." A custom MCP server hosted as a Databricks App uses app permissions instead, and callers need CAN USE on the app.

How do I limit which tools an agent can call?

Registered MCPs expose all of a server's tools by default. At registration, choose Select manually, or Advanced to enter exact names or prefixes. Leave "Automatically include tools added to this server in the future" off if new tools must be reviewed first. Exclusion patterns such as !delete_* are not supported. Calls to an unselected tool return "Tool not allowed by MCP service configuration." To change the selection later, update config.include_tool_selectors; an empty list exposes all tools.
Service policies add checks on content. They are in Beta, and an account admin must turn on the Unity Gateway beta from the account console Previews page. A policy runs before the tool (ON CALL) and can also run on the result (ON RESULT). It returns allow, deny, or ask, and ask pauses the call for user approval before the tool runs. You need MANAGE on the MCP to attach one. Built-in Sensitive Data Detection can block calls that contain personally identifiable information, and a custom SQL function can deny one tool for one agent. Policies fail closed, so any error results in a deny, and they do not replace grants.

How do I cap and monitor usage?

Open the MCP in Unity Gateway and set a rate limit on its Overview tab. MCP limits apply to tools/call requests and use QPM. By default no rate limits are configured. Calls over a limit return HTTP 429, and clients should retry with exponential backoff.
To see who called which tool, query the usage table. By default you need both the account admin and metastore admin roles, and admins can manage access to system tables.

SELECT requester, mcp_metadata.tool_name AS tool_name, status_code, COUNT(*) AS calls
FROM system.ai_gateway.usage
WHERE service_type = 'MCP_SERVICE'
GROUP BY requester, mcp_metadata.tool_name, status_code
ORDER BY calls DESC;

FAQs

Can I block one tool for one agent?

Yes, with a custom service policy (Beta). The docs example denies push_files when the acting agent carries a specific OAuth client ID. The tool still appears in tools/list. To remove a tool for every caller, use tool selection.

Do service policies replace grants?

No. A principal must first have the Unity Catalog privileges to call the service. Policies then evaluate the content of each interaction.

Which of these features are generally available?

Unity Gateway and Unity Catalog asset governance are generally available. Service policies are in Beta and require the Unity Gateway preview.