What is MCP governance?

Summary

• MCP governance means managing who can access MCP servers and what data they can exchange. Just as Unity Catalog governs data, MCP governance controls which agents can connect to which tools and ensures every tool interaction is auditable.
• On Databricks, MCP governance is built into Unity Catalog and Unity Gateway. Servers are cataloged and versioned; permissions are role-based; and every call is logged in one control plane.
• Three mechanisms work together: a catalog that makes servers discoverable and versioned, role-based access control (RBAC) tied to user identity, and audit logs that track every interaction.
• Governance matters because agents access sensitive data and production systems. Without it, an agent could query a protected table or send data outside the organization. With it, you define which agents reach which tools and violations are caught and logged.

What is MCP governance?

MCP governance is the set of controls that decide which agents can access which tools, under which identity, and with which constraints. The Model Context Protocol lets agents call functions and query data across the organization, but without governance it becomes a security risk: an agent calling an uncontrolled external API, or accidentally querying a protected dataset. Databricks treats MCP servers as first-class assets like data, so you catalog them, permission them, audit them, and revoke access in one place. Every agent tool call flows through Unity Gateway, where identity is asserted, permissions are checked, and the interaction is logged.

How MCP governance works on Databricks

Three mechanisms make MCP governance work:
Servers are cataloged and versioned. MCP servers (managed, external, custom) are registered in Unity Catalog as connections. Managed servers like AI Search are pre-built; external servers (third-party APIs) are registered once through OAuth; custom servers (Databricks Apps) are versioned like other catalog assets. Users discover all available servers in one place.
Access is role-based. Agents inherit the identity and permissions of the user running them. If a user cannot read a table, neither can their agent. Role-based policies can restrict which agents or users reach which MCP servers.
Interactions are logged and auditable. Every agent-to-tool call passes through Unity Gateway and is logged with the user identity, tool name, operation, and outcome. Logs feed into compliance dashboards and real-time alerting.

Key capabilities to evaluate

Capability	Why it matters
Identity propagation	Agents must run on behalf of a named user, not as a generic service account, so that access is tied to the person responsible for the action.
Server cataloging	Tools must be discoverable, versioned, and shared across the organization so teams know what integrations exist.
Role-based access control (RBAC)	Permissions to tool use should follow organization roles (e.g., "data engineers can use the lakehouse tool, analysts cannot"), not per-tool logins.
Policy enforcement	Organizations should be able to define rules like "no agent can call external APIs" or "custom servers must be code-reviewed" and have them applied automatically.
Audit and compliance reporting	Every agent tool call should be logged with full context (user, tool, data, outcome) and queryable for compliance investigations and security reviews.
Rate limiting and cost control	External APIs and paid services should be protected from runaway agent spend via automatic rate limits or quotas.

How Databricks approaches MCP governance

Databricks integrates MCP governance into Unity Catalog and Unity Gateway, the platforms that already govern data and SQL:
Unity Catalog is the MCP registry. MCP servers are cataloged as connections alongside data assets, with metadata, versioning, and audit trails. When an agent calls a tool, Unity Gateway verifies that the server exists in the catalog and has not been revoked.
Unity Gateway enforces identity and policy. When an agent calls an MCP server, Unity Gateway asserts the end user's identity, checks their permissions, applies organization-wide policies, and logs the interaction. On-behalf-of access ensures agents can only reach tools and data the user can reach.
Managed servers come pre-configured. Databricks-hosted servers (Genie, AI Search, SQL, Unity Catalog functions) require no authentication setup and are automatically governed through Unity Gateway.
External APIs are registered and encrypted. Third-party APIs are registered as connections with OAuth. Credentials are stored encrypted in Unity Secrets. Databricks handles token refresh and rotation.
Every interaction is auditable. All MCP calls are logged with user identity, tool name, operation, and outcome. Logs are queryable and feed into compliance dashboards.

Getting started

• Read MCP on Databricks to understand the architecture.
• Set up Managed MCP Servers for agents to access Genie, AI Search, and SQL with built-in governance.
• Register external APIs as MCP Connections.
• Query Unity Catalog audit logs for MCP interactions and compliance reviews.

FAQs

What is the difference between MCP governance and data governance?

Data governance controls access to data assets (tables, files, dashboards). MCP governance controls access to tools and integrations (MCP servers, external APIs). Both operate through the same Unity Catalog/Unity Gateway infrastructure, so a user's data permissions carry over to what data an agent can access through a tool.

Do I need separate permissions for managed, external, and custom MCP servers?

No. All three types are governed through Unity Catalog and Unity Gateway. Managed servers require no setup. External servers require a one-time OAuth approval. Custom servers require registration. Once registered, all three are controlled the same way: role-based access, audit logs, and policy enforcement.

What happens if an agent tries to call an MCP server it is not permitted to use?

Unity Gateway blocks the call before it reaches the server and logs the attempt. The agent receives an access denied error and the event is flagged in compliance logs.

Can I audit which MCP servers a specific user or agent used?

Yes. Every MCP interaction is logged with the user identity, tool name, operation, and timestamp. You can query these logs through Unity Catalog audit APIs or export them for compliance reviews.

How do I set up governance for custom MCP servers?

Deploy the custom server as a Databricks App, register it as an MCP server in Unity Catalog, and assign it to workspaces or roles. Access is then governed through the same role-based controls as managed and external servers.