How do I govern MCP servers and tools?

Summary

• Model Context Protocol (MCP) servers extend AI agents with custom tools and integrations, but they introduce security risks: unvetted code execution, data exfiltration, and unauthorized API access.
• Unity Gateway registers MCP servers as governed resources, controlling which users can invoke them, which data they can access, and how they're audited.
• You can restrict specific MCP servers to specific users or projects, require approval before first use, and see full audit trails of what data and APIs each tool touched.
• Role-based policies and deny rules in Unity Gateway prevent agents from invoking unapproved or risky MCP servers, even if a user attempts to load them.

How do I govern MCP servers and tools?

Model Context Protocol (MCP) servers are custom integrations that extend AI agents with tools and data sources. An MCP server might fetch data from an internal API, call a third-party SaaS platform, execute code in a sandbox, or access a company database. While this extensibility is valuable, it creates governance challenges: rogue or misconfigured MCP servers can expose sensitive data, execute untrusted code, or bypass security controls. Unity Gateway governs MCP servers just as it governs models and data, putting access control and audit trails around every tool invocation.

What is Model Context Protocol (MCP)?

Model Context Protocol is an open standard that lets developers attach tools and integrations to AI agents. An MCP server runs locally or remotely and exposes functions that an AI agent can call. Examples include an MCP server that queries your data warehouse, calls a billing API, reads from a document repository, or executes code in a container.
MCP servers can be hosted by Databricks, created by your team, or provided by third parties. The protocol is framework-agnostic; agents built with LangGraph, CrewAI, or custom code can all use the same MCP server.

Key capabilities to evaluate

Capability	Why it matters
Server registration and allowlisting	Maintain a central list of approved MCP servers; unapproved servers can't be invoked, even if a user has the code.
User and project-level access	Restrict which users or projects can invoke each MCP server. A sensitive internal API tool might be accessible only to finance teams.
Approval workflows	Require manager approval before a user can invoke a new MCP server, especially high-risk ones (code execution, data access).
Usage audit trails	Log every invocation: who called the tool, when, what parameters they passed, and what data was returned.
Data lineage tracking	Trace which MCP server calls accessed which datasets, linking tool usage back to data assets in Unity Catalog.
Deny policies	Explicitly prevent certain users, roles, or projects from invoking specific tools, regardless of other grants.
Server health monitoring	Detect MCP servers that are down, returning errors, or consuming excessive resources, and alert operators.

How Databricks approaches MCP governance

Unity Gateway provides a unified governance layer for MCP servers. The workflow is:

1. Register the MCP server. You define the server in Unity Gateway, specifying its endpoint, authentication method, and metadata (name, description, risk level). Gateway becomes the single point of control.
2. Define access policies. Using role-based or attribute-based access control, specify who can invoke the server. For example, "only data analysts and data engineers can call the internal warehouse query tool."
3. Set approval thresholds. High-risk servers (those with access to sensitive APIs or code execution) require approval before first invocation by each user. Lower-risk tools (read-only data fetching) might not.
4. Monitor and audit. Every tool invocation is logged: user, timestamp, MCP server name, parameters, and response metadata. Audit logs are queryable in your Databricks workspace.
5. Enforce deny policies. You can block entire user groups, projects, or roles from invoking certain tools, even if they have general agent access.
6. Manage tool lifecycle. When an MCP server is deprecated or compromised, you can disable it in Unity Gateway. Existing agent code referencing it will fail safely with a clear error.

For more details, see Unity Gateway documentation on MCP server registration and governance.

Use cases

Internal API governance: A data platform team runs an MCP server that queries the internal analytics warehouse. Using Unity Gateway, they restrict it to data analysts and require approval for first use. When a user approves an agent to use the tool, audit logs show which queries ran and what data was returned.
Third-party tool risk management: A company evaluates a third-party MCP server for Slack integration. Before rolling it out, they register it in Unity Gateway with a deny policy on the finance and legal teams' roles. Once deployed, only approved teams can invoke it, and all usage is logged.
Code execution sandboxing: An MCP server that executes Python code in a container is registered in Unity Gateway with high-risk tagging. Only data scientists can invoke it, and each invocation requires approval. This prevents untrusted users from running arbitrary code.
Multi-environment tool isolation: A company has MCP servers for development, staging, and production. Unity Gateway routes each agent to the correct environment based on the agent's context. Production agents can't accidentally invoke development tools.

FAQs

Can I restrict an MCP server to a specific project or team?

Yes. Use attribute-based access control on team or project tags. For example, a marketing analytics MCP server can be tagged team: marketing and restricted via a policy. Only users in the marketing team can invoke it.

What happens if an MCP server goes down?

Unity Gateway detects the failure and returns an error to the agent. The agent can handle the error gracefully (retrying, alerting the user, or invoking a fallback). Audit logs record the failure, helping you investigate.

How do I prevent agents from invoking unapproved MCP servers?

Unity Gateway maintains an allowlist of approved servers. Agents can only invoke servers on that list. If an agent attempts to load an unregistered server, the request is denied. You can also use deny policies to block specific high-risk servers by name.

Can I use LangGraph or CrewAI frameworks with MCP servers governed by Unity Gateway?

Yes. Both frameworks support MCP servers. When running a LangGraph or CrewAI agent on Databricks (via Model Serving or Notebooks), you can configure it to use MCP servers registered in Unity Gateway. Governance applies automatically.