Databricks MCP: connect Claude to Databricks with Unity Catalog in charge

On Databricks there's no server to host. The managed MCP servers live in the system.ai schema, each one a Unity Catalog securable, so the same grants and policies that govern your tables govern who can call them (Databricks docs, checked 22 October 2026). Claude reaches them through Unity Gateway at:

https://<workspace-hostname>/ai-gateway/mcp-services/<mcp-name>

The ones that matter for analysis:

There are also system.ai servers for Slack, GitHub, Atlassian, Google Drive, Gmail and Microsoft 365, and older workspace endpoints (/api/2.0/mcp/sql and friends). Avoid the legacy ones for new set-ups: Databricks says they don't support MCP-level grants, policies or guardrails, and their calls don't appear in Unity Gateway tracing.

Databricks doesn't list individual tool names on the page. That is less of a gap than it sounds, because the control that matters is the Unity Catalog grant, not the tool name.

Which to give Claude? For business users, Genie: definitions live in Genie's curated set-up, not in each chat. For analysts, dbsql, with the caveat in the table's last column.

You need an account admin for step 1. The steps follow Databricks' Claude set-up guide, its managed MCP page and Anthropic's custom connector help article.

1. Create an OAuth app connection. In the account console, Settings > App connections > Add connection. For a public client, leave "Generate a client secret" unchecked. Select the ai-gateway scope and add both redirect URLs: https://claude.ai/api/mcp/auth_callback and https://claude.com/api/mcp/auth_callback. Copy the client ID. Databricks warns changes can take up to 30 minutes to apply.
2. Enable what you need. An account admin must enable the Unity Gateway beta for dbsql, sandbox and web_search. Genie One is GA.
3. Grant access in Unity Catalog to the MCP server and to the data behind it (next section).
4. Add the connector in Claude. On Pro or Max, Customize > Connectors > Add custom connector; on Team or Enterprise, an Owner adds it in Organization settings > Connectors and members connect individually. Enter https://<workspace-hostname>/ai-gateway/mcp-services/system.ai.dbsql (or the Genie name), choose "Use your own OAuth client", paste the client ID and click Add.
5. Sign in and test. For dbsql, Databricks suggests SELECT 1 AS result; then ask a question you already know the answer to.

If your workspace restricts inbound IPs, allow Claude's outbound IP ranges, since Claude connects from Anthropic's cloud. For local testing, Databricks also documents a personal access token route for Claude Desktop through mcp-remote; keep that for testing, and keep the token out of source control.

A note on Claude's own directory: if you find a Databricks listing there, check how it signs in. A third-party write-up (InterWorks, June 2026) reports that a directory connector failed because Databricks doesn't support automatic client registration, and that the custom-connector route above worked.

The most important line on Databricks' page is easy to skim past: dbsql runs SQL "using the caller's Unity Catalog and warehouse permissions". There's no separate read-only switch in the docs. If the person connecting can DROP TABLE, so can a query Claude writes for them.

So the read-only control is Unity Catalog. What we'd set up:

• A group for Claude users with USE CATALOG, USE SCHEMA and SELECT on curated gold or reporting schemas, and nothing that allows MODIFY, CREATE or ownership.
• A small SQL warehouse for that group, so cost and concurrency have a ceiling.
• Grant the MCP server itself only to that group. Each system.ai server is a Unity Catalog securable, and Databricks says admins can also apply policies to individual calls.
• Genie for everyone else. A Genie space exposes questions over a curated set of tables, which is a narrower surface than a SQL warehouse.
• Keep external-service servers separate. Databricks notes system.ai.github reaches only public repositories until an organisation admin installs its connector app. Think before connecting more.

Two Claude-side settings matter too. Approve SQL tool calls one at a time rather than "Allow always". And remember Anthropic's warning that in Research mode Claude "can invoke tools from your connectors automatically without further approval"; for anyone whose Databricks permissions include writes, switch the SQL tool off before starting Research.

These work against dbsql or a Genie space (examples illustrative; use your own catalog names).

Explore before asking:

Using the Databricks connector, list the schemas you can see in the main catalog
and the tables in main.gold. For the subscriptions table, describe the grain, the
date columns and any status fields. Don't run analysis yet.

Ask with the definition stated:

What was net revenue retention for the cohort that started in Q1 2026, measured
at 12 months? State your formula first (including whether expansion and
contraction are counted), then show the SQL, the rows returned and the result.

Compare Genie with SQL:

Ask Genie: "What was monthly recurring revenue in September 2026?" Then compute the
same figure with SQL on main.gold.subscriptions. If they differ, explain which
filters or definitions cause the difference.

Catch silent writes:

Before running any SQL, tell me whether it's a SELECT. If a statement would create,
modify or drop anything, stop and show it to me instead of running it.

The last one is a request, not a control. The Unity Catalog grants are the control; this just makes surprises visible sooner.

Databricks' servers are first-party and permission-checked. The documented MCP failures still apply, because they were about what an agent could reach in a session.

• 1 April 2025: tool poisoning. Invariant Labs showed hidden instructions in one server's tool description making a model read files and pass them on, plus descriptions that change after approval and one server "shadowing" another's tools.
• 26 May 2025: GitHub MCP. A malicious public issue led an agent in Claude Desktop, with "Always Allow" on, to leak private-repository data into a public pull request (Invariant Labs).
• 8 July 2025: Supabase MCP. Hidden instructions in a support ticket led an agent, connected with an over-privileged key, to read an integration-tokens table and post it into the ticket (General Analysis). Read-only wouldn't have helped; it was a read.

On Databricks this has a specific shape. The same Unity Gateway serves system.ai.slack, gmail and github alongside dbsql. Connecting a server that reads untrusted text and can post, in the same session as one that reads your gold tables, recreates the conditions of all three incidents. Keep them in separate connectors, and grant the SQL server to a group that can't see secrets or personal data it doesn't need.

Connecting Claude to Databricks fixes stale data. It doesn't fix ambiguous questions, and those cause most wrong numbers.

Net revenue retention can include or exclude expansion from new products, and can be measured on a cohort or a trailing 12 months. Churn can be logo or revenue: 33% and 50% on the same three customers in ChartMogul's example. Monthly active users can be a calendar month or a rolling 30 days (Google Analytics uses rolling). Each reading gives valid SQL and a confident answer.

The research says the same. The best agent in the original Spider 2.0 paper solved 21.3% of real enterprise text-to-SQL tasks against 91.2% on the academic Spider 1.0 (Lei et al., November 2024). Tuned agents now score far higher, but an expert audit found that a majority of items on Spider 2.0-Snow (62.8%) and BIRD Mini-Dev (52.8%) had annotation errors, often from ambiguous questions (Jin et al., January 2026). If the answer key can't agree on what a question means, your chat won't either. More in text-to-SQL.

That's the case for Genie over raw SQL for business users: definitions are curated once and reused. It's also the case for a semantic layer upstream (see semantic layers for AI and dbt MCP). The honest counterpoint: curation takes effort and covers only what's been modelled, so analysts will still need dbsql.

Before the number goes anywhere:

1. Expand the tool call. Genie or SQL? If SQL, read the joins and filters.
2. Check grain. One row per customer, per subscription or per event? Count distinct keys.
3. Check dates. Column, time zone, end date, calendar or rolling.
4. Re-run the SQL in the Databricks SQL editor and compare.
5. Ask Claude: "Which figures came from a query result, and which did you calculate or assume?"

For anything that's going into a decision, Count turns this into a record. Connect Count's MCP server to Claude alongside Databricks and ask it to audit the answer: it returns a link to a canvas where each claim is labelled (Citation, Assumption, Model knowledge or Hallucination) with a reasoning chain showing the queries and calculations it rests on. An NRR figure that silently excluded expansion appears as an Assumption you can see. The canvas connects to Databricks too, so you can open the query, change the definition and re-run it.

Does Databricks have an official MCP server?

How do I connect Claude to Databricks?

Is the Databricks MCP server read-only?

What's the difference between Genie and DBSQL over MCP?