Connect
Optimize
Secure
Databricks MCP Server
for AI Agents
Production-ready Databricks MCP server with 26 extensible actions — plus built-in authentication, security, and optimized execution.
Databricks MCP Server
Built by 
StackOne
StackOne 
Coverage
26 Agent Actions
Create, read, update, and delete across Databricks — and extend your agent's capabilities with custom actions.
Authentication
Agent Tool Authentication
Per-user OAuth in one call. Your Databricks MCP server gets session-scoped tokens with zero credentials stored on your infra.
Agent Auth →
Security
Agent Protection
Every Databricks tool response scanned for prompt injection in milliseconds — 88.7% accuracy, all running on CPU.
Prompt Injection Defense →
Performance
Max Agent Context. Min Cost.
Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Databricks call.
Tools Discovery →What is the Databricks MCP Server?
A Databricks MCP server lets AI agents read and write Databricks data through the Model Context Protocol — Anthropic's open standard for connecting LLMs to external tools. StackOne's Databricks MCP server ships with 26 pre-built actions, fully extensible via the Connector Builder — plus managed authentication, prompt injection defense, and optimized agent context. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.
All Databricks MCP Tools and Actions
Every action from Databricks's API, ready for your agent. Create, read, update, and delete — scoped to exactly what you need.
Groups
- Create Group
Create a new group in the Databricks account
- List Groups
Get all groups in the Databricks account
- Get Group
Retrieve a specific group by ID
- Update Group
Update an existing group's attributes
- Delete Group
Remove a group from the Databricks account
Group Members
- Add Group Member
Add a user or service principal to a group
- Remove Group Member
Remove a user or service principal from a group
Current IAM Credentials (Databricks /Me)s
- Get Current IAM Credentials (Databricks /Me)
Return the authenticated identity and auth type for the current Databricks connection via the SCIM /Me endpoint. Maps to the StackOne IAM unified credentials schema. auth_type is "oauth" for OAuth connections, "api_key" for SCIM Token connections.
IAM Groups (Databricks Account SCIM)s
- List IAM Groups (Databricks Account SCIM)
List all groups in the connected Databricks account via the Account SCIM API, mapped to the StackOne IAM unified group schema. Returns group id, display name, and type ("group"). Uses index-based SCIM 2.0 pagination (100 per page).
IAM Group (Databricks Account SCIM)s
- Get IAM Group (Databricks Account SCIM)
Retrieve a single Databricks account group by its SCIM group ID, mapped to the StackOne IAM unified group schema. Optionally pass expand=["users"] to inline the group's members. Returns group id, display name, type, and timestamps.
IAM Organizations (Databricks Account)s
- List IAM Organizations (Databricks Account)
Return the Databricks account as a single IAM organization record. Each connection targets exactly one Databricks account (identified by the Account ID configured during connection setup). Returns one record with the account ID as id/remote_id.
IAM Organization (Databricks Account)s
- Get IAM Organization (Databricks Account)
Retrieve the Databricks account as a single IAM organization. Each connection targets exactly one account — pass the id returned by unified_list_organizations.
IAM Roles (synthesized From Databricks Account Roles)s
- List IAM Roles (synthesized From Databricks Account Roles)
Return the two stable account-level IAM roles (account_admin / user) synthesized from Databricks SCIM roles[].value field on user records. The role set is static and closed, matching role IDs embedded in IamUser.roles[] on this connector.
IAM Role (synthesized Databricks Account Role)s
- Get IAM Role (synthesized Databricks Account Role)
Retrieve a single synthesized Databricks IAM role by its stable key. Only "account_admin" and "user" are valid — the role namespace is closed because Databricks has no general-purpose roles API.
IAM Users (Databricks Account SCIM)s
- List IAM Users (Databricks Account SCIM)
List all users in the connected Databricks account via the Account SCIM API, mapped to the StackOne IAM unified user schema. Returns identity, status (enabled/disabled), email, name, and group membership. Uses index-based SCIM 2.0 pagination (100 per page).
IAM User (Databricks Account SCIM)s
- Get IAM User (Databricks Account SCIM)
Retrieve a single Databricks account user by their SCIM user ID, mapped to the StackOne IAM unified user schema. Optionally pass expand=["groups"] to inline the user's group memberships. Returns identity, status, email, name, and synthesized roles.
Service Principals
- Create Service Principal
Create a new service principal in the Databricks account
- List Service Principals
Get all service principals in the Databricks account
- Get Service Principal
Retrieve a specific service principal by ID
- Update Service Principal
Update an existing service principal's attributes
- Delete Service Principal
Remove a service principal from the Databricks account
Users
- Create User
Create a new user in the Databricks account
- List Users
Get all users in the Databricks account
- Get User
Retrieve a specific user by ID
- Update User
Update an existing user's attributes
- Delete User
Remove a user from the Databricks account
Set Up Your Databricks MCP Server in Minutes
One endpoint. Any framework. Your agent is talking to Databricks in under 10 lines of code.
MCP Clients
Agent Frameworks
JSON{
"mcpServers": {
"stackone": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://api.stackone.com/mcp?x-account-id=<account_id>",
"--header",
"Authorization: Basic <YOUR_BASE64_TOKEN>"
]
}
}
}Databricks MCP Server Resources
MCP Code Mode: Keeping Tool Responses Out of Agent Context
Anthropic's code_execution processes data already in context. Custom MCP code mode keeps raw tool responses in a sandbox. 14K tokens vs 500.
11 min
Comparing BM25, TF-IDF, and Hybrid Search for MCP Tool Discovery
Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.
10 min
Indirect Prompt Injection Defense for MCP Tools: A Technical Guide
MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.
12 min
Databricks MCP Server FAQ
Databricks MCP server vs direct API integration — what's the difference?
A Databricks MCP server and direct API integration serve different use cases. Direct API integration is for software-to-software — backend code calling Databricks. A Databricks MCP server is for AI agents — MCP clients like Claude and Cursor, plus framework agents built with OpenAI, LangChain, or Vercel AI — discovering and calling Databricks at runtime. StackOne provides both.
How does Databricks authentication work for AI agents?
Databricks authentication for AI agents works through a StackOne Connect Session. Create one via the dashboard or the SDK — you get an auth link and ready-to-paste config for Claude Desktop, Cursor, and other MCP clients. Your user authenticates their own Databricks account; StackOne handles token exchange, storage, and refresh. Credentials never reach the LLM, and each user is isolated via
origin_owner_id.Are Databricks MCP tools vulnerable to prompt injection?
Yes — Databricks MCP tools can be vulnerable to indirect prompt injection. Any tool that reads user-written content — documents, messages, tickets, records, or free-text fields — is a potential vector. StackOne Defender scans every tool response before it enters the agent's context — regex patterns in ~1ms, then a MiniLM classifier in ~4ms. 88.7% accuracy, CPU-only.
What is the context bloat of a Databricks agent and how do I avoid it?
Context bloat happens when Databricks tool schemas and API responses eat your Databricks agent's memory, preventing it from reasoning effectively. A single Databricks query can return a massive JSON response, and connecting multiple tools compounds the problem. Tools Discovery and Code Mode reduce context bloat — loading only relevant tools per query and keeping raw responses out of the agent's context.
Can I limit which actions my Databricks agent can access?
Yes — you can limit which actions your Databricks agent can access directly from the StackOne dashboard. Toggle actions on or off, or restrict them to specific accounts, with no code changes to your agent. Session tokens can be scoped to exact actions so if one leaks, exposure stays contained.
Can I create custom agent actions for my Databricks MCP server?
Yes — you can create custom agent actions for your Databricks MCP server using Connector Builder. It's an integration agent your coding assistant (Claude Code, Cursor, or Copilot) can invoke to research Databricks's API, generate production-ready connector YAML, test against the live API, and validate before you ship.
When should I NOT use a Databricks MCP server?
Skip a Databricks MCP server if your integration is purely software-to-software — direct Databricks API integration is simpler when no AI agent is involved. For deterministic, compliance-critical operations (financial transactions, regulatory reporting), direct API gives you predictable behavior without agent-driven decision-making. MCP shines when AI agents need to dynamically discover and call Databricks actions at runtime.
What AI frameworks and AI clients does the StackOne Databricks MCP server support?
The StackOne Databricks MCP server supports both. MCP clients (paste-and-go apps): Claude Desktop, Claude Code, Cursor, VS Code, Goose. Agent frameworks (code SDKs you build with): OpenAI Agents SDK, Anthropic, Vercel AI, Google ADK, CrewAI, Pydantic AI, LangChain, LangGraph, Azure AI Foundry.
Put your AI agents to work
All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.