// SCAN REPORT

Databricks MCP Server

262 tools. 141 can modify or destroy data without limits.

40 destructive tools with no built-in limits. Policy required.

Last updated:

141 can modify or destroy data
121 read-only
262 tools total

Community server · catalogue entry checked 02/07/2026

How to control Databricks MCP Server ↓

TOOL MAP

What Databricks MCP Server exposes to your agents

Read (121) Write / Execute (101) Destructive / Financial (40)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Databricks MCP Server tools

Destructive · High databricks_dbfs_delete DBFS delete operations permanently remove data from distributed storage without possibility of reversal. Destructive · High databricks_delete_app The 'delete' operation is categorized as Destructive because it irreversibly removes an app resource. Destructive · Critical databricks_delete_catalog The tool performs an irreversible deletion operation on a catalog, which is a top-level container in Databricks Unity Catalog that holds schemas, tables, and other assets. Destructive · High databricks_delete_connection The 'delete' operation removes a connection configuration, which is an irreversible action that cannot be undone without manual recreation.

141 of Databricks MCP Server's 262 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Databricks MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Databricks MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "databricks_dbfs_delete": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "databricks_assign_metastore": {
    "limits": [
      {
        "counter": "databricks_assign_metastore_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "databricks_command_status": {
    "limits": [
      {
        "counter": "databricks_command_status_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Databricks MCP Server — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON DATABRICKS →

Instant setup, no code required.

FULL CATALOGUE

All 262 Databricks MCP Server tools

DESTRUCTIVE 40 tools
Destructive databricks_dbfs_delete databricks_dbfs_delete Destructive databricks_delete_app databricks_delete_app Destructive databricks_delete_catalog databricks_delete_catalog Destructive databricks_delete_connection databricks_delete_connection Destructive databricks_delete_database_instance databricks_delete_database_instance Destructive databricks_delete_experiment databricks_delete_experiment Destructive databricks_delete_external_location databricks_delete_external_location Destructive databricks_delete_function databricks_delete_function Destructive databricks_delete_git_credential databricks_delete_git_credential Destructive databricks_delete_global_init_script databricks_delete_global_init_script Destructive databricks_delete_group databricks_delete_group Destructive databricks_delete_instance_pool databricks_delete_instance_pool Destructive databricks_delete_job Delete a job and all its associated runs. Destructive databricks_delete_metastore databricks_delete_metastore Destructive databricks_delete_online_table databricks_delete_online_table Destructive databricks_delete_pipeline databricks_delete_pipeline Destructive databricks_delete_quality_monitor databricks_delete_quality_monitor Destructive databricks_delete_recipient databricks_delete_recipient Destructive databricks_delete_registered_model databricks_delete_registered_model Destructive databricks_delete_run databricks_delete_run Destructive databricks_delete_schema databricks_delete_schema Destructive databricks_delete_secret databricks_delete_secret Destructive databricks_delete_secret_scope databricks_delete_secret_scope Destructive databricks_delete_service_principal databricks_delete_service_principal Destructive databricks_delete_serving_endpoint Delete a serving endpoint. Destructive databricks_delete_share databricks_delete_share Destructive databricks_delete_storage_credential databricks_delete_storage_credential Destructive databricks_delete_table databricks_delete_table Destructive databricks_delete_token Revoke (delete) a personal access token for the current user. Destructive databricks_delete_token_management databricks_delete_token_management Destructive databricks_delete_user databricks_delete_user Destructive databricks_delete_vector_search_endpoint Delete a vector search endpoint. Destructive databricks_delete_vector_search_index Delete a vector search index. Destructive databricks_delete_volume databricks_delete_volume Destructive databricks_delete_warehouse Delete a SQL warehouse. Destructive databricks_delete_workspace databricks_delete_workspace Destructive databricks_destroy_execution_context databricks_destroy_execution_context Destructive databricks_files_delete databricks_files_delete Destructive databricks_trash_dashboard databricks_trash_dashboard Destructive databricks_unpublish_dashboard databricks_unpublish_dashboard
EXECUTE 28 tools
Execute databricks_cancel_all_runs databricks_cancel_all_runs Execute databricks_cancel_quality_monitor_refresh databricks_cancel_quality_monitor_refresh Execute databricks_cancel_run databricks_cancel_run Execute databricks_cancel_statement databricks_cancel_statement Execute databricks_create_execution_context databricks_create_execution_context Execute databricks_create_global_init_script databricks_create_global_init_script Execute databricks_create_run databricks_create_run Execute databricks_deploy_app databricks_deploy_app Execute databricks_execute_command databricks_execute_command Execute databricks_execute_sql databricks_execute_sql Execute databricks_find_and_start_warehouse Find an available SQL warehouse and start it if needed. Execute databricks_genie_execute_message_query databricks_genie_execute_message_query Execute databricks_genie_start_conversation databricks_genie_start_conversation Execute databricks_query_as_markdown databricks_query_as_markdown Execute databricks_query_serving_endpoint databricks_query_serving_endpoint Execute databricks_repair_run databricks_repair_run Execute databricks_resize_cluster databricks_resize_cluster Execute databricks_restart_cluster databricks_restart_cluster Execute databricks_run_job databricks_run_job Execute databricks_run_quality_monitor_refresh databricks_run_quality_monitor_refresh Execute databricks_start_app databricks_start_app Execute databricks_start_cluster databricks_start_cluster Execute databricks_start_pipeline databricks_start_pipeline Execute databricks_start_warehouse databricks_start_warehouse Execute databricks_stop_app databricks_stop_app Execute databricks_stop_pipeline databricks_stop_pipeline Execute databricks_stop_warehouse databricks_stop_warehouse Execute databricks_validate_storage_credential databricks_validate_storage_credential
WRITE 73 tools
Write databricks_assign_metastore databricks_assign_metastore Write databricks_create_alert databricks_create_alert Write databricks_create_app databricks_create_app Write databricks_create_catalog databricks_create_catalog Write databricks_create_cluster databricks_create_cluster Write databricks_create_connection databricks_create_connection Write databricks_create_dashboard databricks_create_dashboard Write databricks_create_database_catalog databricks_create_database_catalog Write databricks_create_database_instance databricks_create_database_instance Write databricks_create_database_table databricks_create_database_table Write databricks_create_experiment databricks_create_experiment Write databricks_create_external_location databricks_create_external_location Write databricks_create_git_credential databricks_create_git_credential Write databricks_create_group databricks_create_group Write databricks_create_instance_pool databricks_create_instance_pool Write databricks_create_job databricks_create_job Write databricks_create_metastore databricks_create_metastore Write databricks_create_online_table databricks_create_online_table Write databricks_create_pipeline databricks_create_pipeline Write databricks_create_quality_monitor databricks_create_quality_monitor Write databricks_create_query databricks_create_query Write databricks_create_recipient databricks_create_recipient Write databricks_create_registered_model databricks_create_registered_model Write databricks_create_repo databricks_create_repo Write databricks_create_schema databricks_create_schema Write databricks_create_secret_scope databricks_create_secret_scope Write databricks_create_service_principal databricks_create_service_principal Write databricks_create_serving_endpoint databricks_create_serving_endpoint Write databricks_create_share databricks_create_share Write databricks_create_storage_credential databricks_create_storage_credential Write databricks_create_token databricks_create_token Write databricks_create_user databricks_create_user Write databricks_create_vector_search_endpoint databricks_create_vector_search_endpoint Write databricks_create_vector_search_index databricks_create_vector_search_index Write databricks_create_volume databricks_create_volume Write databricks_create_warehouse databricks_create_warehouse Write databricks_dbfs_mkdirs databricks_dbfs_mkdirs Write databricks_dbfs_upload databricks_dbfs_upload Write databricks_edit_cluster databricks_edit_cluster Write databricks_files_create_directory databricks_files_create_directory Write databricks_files_upload databricks_files_upload Write databricks_generate_database_credential databricks_generate_database_credential Write databricks_genie_create_message databricks_genie_create_message Write databricks_import_notebook databricks_import_notebook Write databricks_log_metric databricks_log_metric Write databricks_log_param databricks_log_param Write databricks_migrate_dashboard databricks_migrate_dashboard Write databricks_mkdirs databricks_mkdirs Write databricks_pin_cluster databricks_pin_cluster Write databricks_publish_dashboard databricks_publish_dashboard Write databricks_put_secret databricks_put_secret Write databricks_put_secret_acl databricks_put_secret_acl Write databricks_restore_experiment databricks_restore_experiment Write databricks_set_permissions databricks_set_permissions Write databricks_setup_schema databricks_setup_schema Write databricks_terminate_cluster databricks_terminate_cluster Write databricks_unpin_cluster databricks_unpin_cluster Write databricks_update_catalog databricks_update_catalog Write databricks_update_connection databricks_update_connection Write databricks_update_dashboard databricks_update_dashboard Write databricks_update_git_credential databricks_update_git_credential Write databricks_update_global_init_script databricks_update_global_init_script Write databricks_update_grants databricks_update_grants Write databricks_update_job databricks_update_job Write databricks_update_metastore databricks_update_metastore Write databricks_update_pipeline databricks_update_pipeline Write databricks_update_quality_monitor databricks_update_quality_monitor Write databricks_update_repo databricks_update_repo Write databricks_update_run databricks_update_run Write databricks_update_schema databricks_update_schema Write databricks_update_serving_endpoint databricks_update_serving_endpoint Write databricks_update_share databricks_update_share Write databricks_update_storage_credential databricks_update_storage_credential
READ 121 tools
Read databricks_command_status databricks_command_status Read databricks_current_metastore databricks_current_metastore Read databricks_dbfs_download databricks_dbfs_download Read databricks_dbfs_get_status databricks_dbfs_get_status Read databricks_dbfs_list databricks_dbfs_list Read databricks_export_notebook databricks_export_notebook Read databricks_export_run databricks_export_run Read databricks_files_download databricks_files_download Read databricks_files_get_metadata databricks_files_get_metadata Read databricks_files_list_directory databricks_files_list_directory Read databricks_genie_get_message databricks_genie_get_message Read databricks_genie_get_message_query_result databricks_genie_get_message_query_result Read databricks_get_app databricks_get_app Read databricks_get_app_deployment databricks_get_app_deployment Read databricks_get_app_environment databricks_get_app_environment Read databricks_get_catalog Get detailed information about a specific catalog. Read databricks_get_cluster databricks_get_cluster Read databricks_get_connection databricks_get_connection Read databricks_get_current_user databricks_get_current_user Read databricks_get_dashboard databricks_get_dashboard Read databricks_get_database_instance databricks_get_database_instance Read databricks_get_effective_grants databricks_get_effective_grants Read databricks_get_experiment databricks_get_experiment Read databricks_get_external_location databricks_get_external_location Read databricks_get_function databricks_get_function Read databricks_get_git_credential Get detailed information about a specific Git credential. Read databricks_get_global_init_script databricks_get_global_init_script Read databricks_get_grants databricks_get_grants Read databricks_get_group Get detailed information about a specific group. Read databricks_get_instance_pool databricks_get_instance_pool Read databricks_get_job Get detailed information about a specific job. Read databricks_get_metastore databricks_get_metastore Read databricks_get_online_table databricks_get_online_table Read databricks_get_permission_levels databricks_get_permission_levels Read databricks_get_permissions databricks_get_permissions Read databricks_get_pipeline databricks_get_pipeline Read databricks_get_provider databricks_get_provider Read databricks_get_published_dashboard databricks_get_published_dashboard Read databricks_get_quality_monitor databricks_get_quality_monitor Read databricks_get_quality_monitor_refresh databricks_get_quality_monitor_refresh Read databricks_get_recipient databricks_get_recipient Read databricks_get_registered_model databricks_get_registered_model Read databricks_get_repo Get detailed information about a specific Git repository. Read databricks_get_run databricks_get_run Read databricks_get_run_output databricks_get_run_output Read databricks_get_schema databricks_get_schema Read databricks_get_service_principal databricks_get_service_principal Read databricks_get_serving_endpoint databricks_get_serving_endpoint Read databricks_get_serving_endpoint_logs databricks_get_serving_endpoint_logs Read databricks_get_serving_endpoint_openapi databricks_get_serving_endpoint_openapi Read databricks_get_share databricks_get_share Read databricks_get_statement_status databricks_get_statement_status Read databricks_get_storage_credential databricks_get_storage_credential Read databricks_get_table databricks_get_table Read databricks_get_user databricks_get_user Read databricks_get_vector_search_endpoint Get detailed information about a vector search endpoint. Read databricks_get_vector_search_index databricks_get_vector_search_index Read databricks_get_warehouse databricks_get_warehouse Read databricks_get_workspace_status databricks_get_workspace_status Read databricks_list_alerts databricks_list_alerts Read databricks_list_app_deployments databricks_list_app_deployments Read databricks_list_apps databricks_list_apps Read databricks_list_artifacts databricks_list_artifacts Read databricks_list_catalogs List all catalogs in the Unity Catalog metastore. Read databricks_list_cluster_events databricks_list_cluster_events Read databricks_list_cluster_policies databricks_list_cluster_policies Read databricks_list_clusters databricks_list_clusters Read databricks_list_connections databricks_list_connections Read databricks_list_dashboards databricks_list_dashboards Read databricks_list_database_catalogs databricks_list_database_catalogs Read databricks_list_database_instances databricks_list_database_instances Read databricks_list_database_roles databricks_list_database_roles Read databricks_list_database_tables databricks_list_database_tables Read databricks_list_experiments databricks_list_experiments Read databricks_list_external_locations databricks_list_external_locations Read databricks_list_functions databricks_list_functions Read databricks_list_git_credentials databricks_list_git_credentials Read databricks_list_global_init_scripts databricks_list_global_init_scripts Read databricks_list_groups databricks_list_groups Read databricks_list_instance_pools databricks_list_instance_pools Read databricks_list_jobs databricks_list_jobs Read databricks_list_metastores databricks_list_metastores Read databricks_list_model_versions databricks_list_model_versions Read databricks_list_node_types databricks_list_node_types Read databricks_list_pipeline_events databricks_list_pipeline_events Read databricks_list_pipelines List DLT pipelines in the workspace. Read databricks_list_providers databricks_list_providers Read databricks_list_quality_monitor_refreshes databricks_list_quality_monitor_refreshes Read databricks_list_queries databricks_list_queries Read databricks_list_query_history databricks_list_query_history Read databricks_list_recipients databricks_list_recipients Read databricks_list_registered_models databricks_list_registered_models Read databricks_list_repos databricks_list_repos Read databricks_list_runs databricks_list_runs Read databricks_list_schemas List all schemas within a catalog. Read databricks_list_secret_acls databricks_list_secret_acls Read databricks_list_secret_scopes databricks_list_secret_scopes Read databricks_list_secrets databricks_list_secrets Read databricks_list_service_principals databricks_list_service_principals Read databricks_list_serving_endpoint_permissions List permissions on a serving endpoint. Read databricks_list_serving_endpoints List all model serving endpoints in the workspace. Read databricks_list_shares databricks_list_shares Read databricks_list_spark_versions databricks_list_spark_versions Read databricks_list_storage_credentials databricks_list_storage_credentials Read databricks_list_tables databricks_list_tables Read databricks_list_token_management databricks_list_token_management Read databricks_list_tokens databricks_list_tokens Read databricks_list_users databricks_list_users Read databricks_list_vector_search_endpoints List all vector search endpoints in the workspace. Read databricks_list_vector_search_indexes databricks_list_vector_search_indexes Read databricks_list_volumes databricks_list_volumes Read databricks_list_warehouses List all SQL warehouses in the workspace. Read databricks_list_workspace databricks_list_workspace Read databricks_metastore_summary databricks_metastore_summary Read databricks_query_vector_search_index databricks_query_vector_search_index Read databricks_search_experiments databricks_search_experiments Read databricks_search_runs databricks_search_runs Read databricks_sync_vector_search_index databricks_sync_vector_search_index Read databricks_table_preview databricks_table_preview Read databricks_tool_guide databricks_tool_guide Read databricks_workspace_status Get a comprehensive status overview of the Databricks workspace.
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
adminautomation
Nodebench 824 tools
adminautomation
Yaver 812 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Crow 587 tools
adminautomation
Fortimanager 584 tools
adminautomation
TinyFn 572 tools
adminautomation
Mcp 571 tools
adminautomation
FAQ

Questions about Databricks MCP Server

Can an AI agent delete data through the Databricks MCP Server MCP server? +

Yes. The Databricks MCP Server server exposes 40 destructive tools including databricks_dbfs_delete, databricks_delete_app, databricks_delete_catalog. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Databricks MCP Server? +

The Databricks MCP Server server has 73 write tools including databricks_assign_metastore, databricks_create_alert, databricks_create_app. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Databricks MCP Server.

How many tools does the Databricks MCP Server MCP server expose? +

262 tools across 4 categories: Destructive, Execute, Read, Write. 121 are read-only. 141 can modify, create, or delete data.

How do I enforce a policy on Databricks MCP Server? +

Register the Databricks MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Databricks MCP Server tool call.

Deterministic rules across all 262 Databricks MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON DATABRICKS →

Instant setup, no code required.

262 Databricks MCP Server tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Databricks MCP Server's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.