MCP Servers and Data Governance, How Do They Connect

Summary

• MCP servers are registered as first-class Unity Catalog securables, bringing intelligent agent tools into the same governance framework as tables, volumes, and functions.
• Access controls, tool selection, and usage auditing apply uniformly: who can invoke a service, which tools they can call, and every interaction is logged in Delta.
• Service policies enforce fine-grained rules at the tool level (e.g., block file deletion from GitHub, restrict PR merges to specific roles).
• Databricks provides both managed MCP services (pre-built connectors like Slack, Google Drive, DBSQL) and a framework for registering external MCP servers.

MCP Servers and Data Governance, How Do They Connect
MCP servers connect to data governance through Unity Catalog's securable object model. An MCP Service is a first-class Unity Catalog securable, addressed by its three-level name catalog.schema.mcp_service, that provides a Databricks-hosted tool or registers an external MCP server and governs how agents use it.

What is an MCP Service?

The Model Context Protocol (MCP) is a standard for connecting AI agents to external tools and data sources. In Databricks, MCP servers are exposed as services within Unity Catalog. This means an MCP service has the same governance properties as a table or function: it has an owner, grants define who can use it, and all invocations are audited.
Unity Catalog's approach unifies agent tool governance with data governance, bringing MCP services into the same security framework as tables, models, and volumes. A single model protects all of them.

How Governance Works

Governance Layer	How it applies to MCP Services
Access control (GRANT)	Control who can invoke a service using GRANT EXECUTE ON MCP SERVICE. Users must have the grant to use the tool.
Tool selection	Define which tools an MCP service exposes. Only exposed tools are available to agents; others are hidden.
Service policies	Enforce fine-grained rules at the tool call level. For example, block file deletion entirely, or restrict PR merging to approved engineers.
Audit logging	Every MCP invocation is captured in Delta tables within Unity Catalog, queryable with SQL.
Unified view	Agent tool usage appears alongside traditional data and model lineage in the catalog.

Databricks' MCP Approach

Databricks provides two types of MCP services:
Managed MCP Services (zero setup): Pre-built connectors developed by Databricks, including Genie, Databricks AI Search, UC Functions, and DBSQL, plus managed integrations for Slack, GitHub, Google Drive, and others. These are available within Agents and require no external infrastructure.
External MCP servers (registered as UC securables): Self-hosted or third-party MCP servers registered with Databricks using CREATE CONNECTION and CREATE SERVICE permissions. These inherit the same governance framework as managed services.
A centralized MCP Servers tab within Agents built on Unity Catalog enables teams to discover available servers, manage access through grants, simplify authentication with built-in token exchange, and audit all interactions.

Service Policies in Action

Service policies are Unity Catalog SQL functions that evaluate actor (who is calling), context (what they're calling), and action (what operation). For instance:

• A GitHub MCP policy can block file deletion entirely (deny all DELETE_FILE actions).
• A Slack policy can restrict posting to specific channels, or restrict message edits to the message author.
• A data API policy can filter which datasets an agent can query based on the user's role.

These rules are written in a simple SQL-like syntax and take effect immediately. Because they live in Unity Catalog, they're versioned, auditable, and can be updated without redeploying agents or tools.

Use Cases

Regulated industries: Enforce tool usage policies that comply with SOX, HIPAA, or PCI-DSS. Audit trails answer "what did my agent do with external systems?"
Multi-tenant SaaS: Different customers have different tool permissions. Policies enforce customer boundaries at the agent level.
Cost control: Policies can rate-limit or block expensive operations (e.g., limit Claude model calls, prevent bulk API operations).
Insider threat prevention: Policies enforce the principle of least privilege. An agent can only call tools it needs for its task, and only during working hours.

FAQs

Do I need to use Unity Catalog to govern MCP services?

Yes, on Databricks. MCP services are securables within Unity Catalog; they inherit its governance model. If you're not using Unity Catalog yet, that's a prerequisite for fine-grained MCP governance. However, external MCP servers can also be registered via HTTP connections, which have simpler but broader access control.

Can I write my own service policies?

Yes. Service policies are SQL functions that you write and manage in Unity Catalog. Databricks provides templates and best practices, but policies are flexible and extensible.

What happens if an agent violates a service policy?

The policy is evaluated before the tool call. If the policy denies the action, the call is blocked and an audit log entry is created. The agent can retry a different action, or the policy can be relaxed if needed.

How do I audit agent tool usage?

All MCP invocations are captured in Delta tables within Unity Catalog. Query them with SQL to answer questions like "which users called GitHub tools?", "what files were accessed?", or "which policies were triggered?".