How do I control which MCP tools AI agents can access?

Summary

• Register MCP servers as governed assets. External Model Context Protocol (MCP) servers are registered as Unity Catalog securables with three-level names (catalog.schema.mcp_service), so tools are governed like any other catalog asset.
• Grant-based access. Every MCP call flows through the Unity AI Gateway, which verifies the caller has EXECUTE permission on the MCP service before the call proceeds.
• Expose only the tools you choose. Tool selectors restrict an MCP service to a specific subset of tools at registration time, so an agent only ever sees the tools you deliberately exposed.
• Allow, deny, or require approval. Service policies (Beta) evaluate every tool call before it runs and can allow it, deny it, or require user approval based on tool name, arguments, caller identity, and request context.
• On-behalf-of authorization and full audit. Agents act with the invoking user's permissions, and every tool call is logged with tool name, arguments, result, and user identity in Databricks system tables.

How do I control which MCP tools AI agents can access?

As AI agents connect to tools through the Model Context Protocol (MCP), teams need to control which tools each agent can reach and what it is allowed to do with them. On Databricks, MCP tool access is governed through Unity Catalog for asset governance and the Unity AI Gateway for traffic control and policy enforcement, so tools are permissioned, scoped, and audited like any other governed asset.

Why Databricks Unity AI Gateway for governing MCP tool access

• MCP servers as governed Unity Catalog assets. External MCP servers are registered as Unity Catalog securables with three-level names (catalog.schema.mcp_service), making them discoverable and governable. Access is grant-based: every MCP call flows through the Unity AI Gateway, which verifies the caller has EXECUTE permission on the MCP service in Unity Catalog before the call proceeds.
• Expose only the tools you choose. When you register an MCP service, tool selectors (for example, include_tool_selectors such as get_* or list_*) restrict the service to a specific subset of tools, so an agent only ever sees the tools you deliberately exposed.
• Allow, deny, or require approval with service policies. Service policies (Beta) are SQL-defined functions attached to an MCP service that evaluate every tool call before it runs. They can allow the call, deny and block it, or require user approval, based on the tool name and arguments, caller identity, request context, and even response content. This lets admins restrict sensitive tools, for example limiting a destructive delete operation to administrators only.
• On-behalf-of authorization. Agents act on behalf of the invoking user rather than a shared service account, and identity flows end to end to the specific resource being accessed. If a user cannot access a table or system in Unity Catalog, neither can an agent acting on their behalf. External connections use managed OAuth with scoped permissions, and Databricks handles the OAuth lifecycle server-side so agents never see credentials.
• Full audit and observability. Every tool call is captured with its tool name, arguments, result, user identity, and whether it was allowed or denied. MCP activity lands in system tables, including system.ai_gateway.usage for call volume, errors, and latency and system.access.audit for control-plane actions, and a built-in Unity AI Gateway usage dashboard summarizes activity. Actions are logged against both the real user who triggered the request and the agent that acted on their behalf.

Getting started

• Review MCPs and agent tools in the documentation.
• Register an external MCP server through the Unity AI Gateway.
• Set up AI governance for models, tools, and MCP services.
• Read how Unity Catalog secures agent actions.
• See service policies, guardrails, observability, and cost controls in the Unity AI Gateway.

FAQs

How do I limit an agent to specific MCP tools?

Register the MCP service with tool selectors so it exposes only the tools you choose, then grant EXECUTE on that service in Unity Catalog to control which agents and users can call it.

Can I require approval before an agent runs a sensitive tool?

Yes. Service policies (Beta) evaluate every tool call and can require user approval, or deny it outright, based on the tool name, arguments, caller identity, and request context.

How are MCP tool calls audited?

Every call is logged with tool name, arguments, result, and user identity in Databricks system tables (system.ai_gateway.usage and system.access.audit), and is visible in the built-in Unity AI Gateway usage dashboard.