// SCAN REPORT

Databricks Permissions MCP Server

32 tools. 19 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 30 Jun 2026

19 can modify or destroy data

13 read-only

32 tools total

Community server · catalogue entry verified 30/06/2026

How to control Databricks Permissions MCP Server ↓

TOOL MAP

What Databricks Permissions MCP Server exposes to your agents

Read (13) Write / Execute (15) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Databricks Permissions MCP Server tools

Destructive · High delete_credential Deleting credentials is a destructive action that cannot be undone. Destructive · High delete_git_credential This tool permanently removes Git credentials, which cannot be undone. Destructive · High delete_service_principal This tool permanently removes a service principal from Databricks, an action that cannot be undone. Destructive · High delete_storage_credential Deleting a storage credential is an irreversible action that destroys access configuration.

19 of Databricks Permissions MCP Server's 32 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Databricks Permissions MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Databricks Permissions MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_credential": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "create_credential": {
    "limits": [
      {
        "counter": "create_credential_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_cluster_permissions": {
    "limits": [
      {
        "counter": "get_cluster_permissions_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Databricks Permissions MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON DATABRICKS PERMISSIONS →

Instant setup, no code required.

FULL CATALOGUE

All 32 Databricks Permissions MCP Server tools

DESTRUCTIVE 4 tools

Destructive delete_credential Delete a credential with parameter: name (required) Destructive delete_git_credential Delete a Git credential with parameter: credential_id (required) Destructive delete_service_principal Delete a service principal with parameter: id (required) Destructive delete_storage_credential Delete a storage credential with parameter: name (required)

WRITE 15 tools

Write create_credential Create a credential in Unity Catalog with parameters: name (required), credential_type (required), credential_ Write create_git_credential Create a Git credential with parameters: git_provider (required), git_username (required), personal_access_tok Write create_service_principal Create a service principal with parameters: display_name (required), application_id (required), allow_cluster_ Write create_storage_credential Create a storage credential in Unity Catalog with parameters: name (required), aws_iam_role (optional), azure_ Write set_cluster_permissions Set permissions for a cluster with parameters: cluster_id (required), access_control_list (required) Write set_job_permissions Set permissions for a job with parameters: job_id (required), access_control_list (required) Write set_permissions Set permissions for a Databricks object with parameters: object_type (required), object_id (required), access_ Write set_warehouse_permissions Set permissions for a SQL warehouse with parameters: warehouse_id (required), access_control_list (required) Write set_workspace_object_permissions Set permissions for a workspace object with parameters: object_id (required), access_control_list (required) Write update_credential Update a credential with parameters: name (required), new_name (optional), credential_info (optional), comment Write update_git_credential Update a Git credential with parameters: credential_id (required), git_provider (optional), git_username (opti Write update_permissions Update permissions for a Databricks object with parameters: object_type (required), object_id (required), acce Write update_service_principal Update a service principal with parameters: id (required), display_name (optional), allow_cluster_create (opti Write update_share_permissions Update permissions for a share with parameters: name (required), changes (required) Write update_storage_credential Update a storage credential with parameters: name (required), new_name (optional), aws_iam_role (optional), az

READ 13 tools

Read get_cluster_permissions Get permissions for a cluster with parameter: cluster_id (required) Read get_job_permissions Get permissions for a job with parameter: job_id (required) Read get_permission_levels Get available permission levels for a Databricks object type with parameter: object_type (required) Read get_permissions Get permissions for a Databricks object with parameters: object_type (required, e.g., Read get_service_principal Get details of a service principal with parameter: id (required) Read get_share_permissions Get permissions for a share with parameter: name (required) Read get_storage_credential Get details of a storage credential with parameter: name (required) Read get_warehouse_permissions Get permissions for a SQL warehouse with parameter: warehouse_id (required) Read get_workspace_object_permissions Get permissions for a workspace object (notebook, directory) with parameter: object_id (required) Read list_credentials List credentials in Unity Catalog with parameter: credential_type (optional) Read list_git_credentials List all Git credentials Read list_service_principals List service principals with parameters: page_size (optional), page_token (optional) Read list_storage_credentials List storage credentials in Unity Catalog

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Databricks Permissions MCP Server

Can an AI agent delete data through the Databricks Permissions MCP Server MCP server? +

Yes. The Databricks Permissions MCP Server server exposes 4 destructive tools including delete_credential, delete_git_credential, delete_service_principal. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Databricks Permissions MCP Server? +

The Databricks Permissions MCP Server server has 15 write tools including create_credential, create_git_credential, create_service_principal. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Databricks Permissions MCP Server.

How many tools does the Databricks Permissions MCP Server MCP server expose? +

32 tools across 3 categories: Destructive, Read, Write. 13 are read-only. 19 can modify, create, or delete data.

How do I enforce a policy on Databricks Permissions MCP Server? +

Register the Databricks Permissions MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Databricks Permissions MCP Server tool call.

Deterministic rules across all 32 Databricks Permissions MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON DATABRICKS PERMISSIONS →

Instant setup, no code required.

32 Databricks Permissions MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.