databricks_list_groups

What databricks_list_groups does on Databricks MCP Server

AI agents call databricks_list_groups to retrieve information from Databricks MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why databricks_list_groups is rated Low

The 'list' operation is inherently a read action that retrieves and returns information about Databricks groups without creating, modifying, or deleting any data. This poses minimal risk as it only exposes existing metadata. Severity is low because group enumeration, while potentially information-disclosing, does not grant direct access to sensitive data or enable privilege escalation by itself.

From the tool's definition Tool name 'list_groups' indicates a retrieval operation that enumerates group entities. The 'list' prefix is a standard pattern for read-only queries that return collections of data without modification.

The rule that runs databricks_list_groups safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Databricks MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For databricks_list_groups, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "databricks_list_groups": {}
  }
}

Questions about databricks_list_groups