Which integrations are available for this server?

Read-only SQL analytics for Databricks SQL Warehouses, supporting table exploration, querying, and profiling with built-in safety guardrails. Offline read-only SQL analytics using DuckDB, with a bundled sample logistics warehouse for immediate use without external setup.

How do I use databricks-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@databricks-mcp profile the shipments table" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

databricks-mcp

by openatlaspro-AI

Overview Schema Related Servers Score Discussions

Python

Hybrid

databricks-mcp

Safe, read-only SQL analytics for AI agents — over MCP. Point an agent at a SQL warehouse and let it explore, profile, and query data without any risk of mutating it.

License: MIT Python 3.11+

What it is

databricks-mcp is a Model Context Protocol server that gives an AI agent safe, read-only analytics access to a SQL warehouse. It exposes five typed tools — list_tables, describe_table, sample_rows, run_sql, and profile_table — and routes every query through an AST-based safety guard that enforces read-only, single-statement, and row-cap guarantees.

Two backends ship in the box:

DuckDB (default) — runs fully offline against a bundled synthetic logistics warehouse (shipments, carriers, lanes). Zero setup, ~30 seconds to first query.
Databricks SQL Warehouse — connect to a real warehouse with a few environment variables.

About the name: the project is named for its Databricks backend, but it runs completely offline on DuckDB out of the box — you don't need a Databricks account to try it.

Related MCP server: django-mcp-sql

30-second quickstart

uvx databricks-mcp           # runs on the bundled DuckDB logistics sample data

That's it — the server starts on stdio with the sample warehouse loaded and waits for an MCP client.

Claude Desktop config

Add this to your Claude Desktop MCP configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "databricks-mcp": { "command": "uvx", "args": ["databricks-mcp"] }
  }
}

Restart Claude Desktop and the five tools become available to the assistant.

Connecting a real Databricks SQL Warehouse

Set the backend to databricks and provide your warehouse credentials via environment variables:

export DB_BACKEND=databricks
export DATABRICKS_SERVER_HOSTNAME=...     # e.g. dbc-xxxxxxxx-xxxx.cloud.databricks.com
export DATABRICKS_HTTP_PATH=...           # e.g. /sql/1.0/warehouses/abc123
export DATABRICKS_TOKEN=...               # a Databricks personal access token

Optionally cap the maximum rows any single query may return (default 1000):

export MAX_ROWS=500

Secrets are only ever read from the environment and are never logged.

Tools

Tool	Input	Output
`list_tables`	—	Table names and column counts.
`describe_table`	`table`	Columns, types, and row count.
`sample_rows`	`table`, `n` (default 10, max 100)	Preview rows from the table.
`run_sql`	`query`	Guarded read-only result rows (row-capped).
`profile_table`	`table`	Per-column null fraction, distinct count, and min/max.

All inputs and outputs are typed with pydantic models, so the agent receives clean JSON schemas.

Safety / guardrails

Every query passed to run_sql — and every statement the other tools generate internally — goes through safety.py, which validates against the parsed sqlglot AST rather than fragile string matching:

Parse or reject. Anything that fails to parse is rejected with a structured error.
Single statement only. Multi-statement input is rejected, blocking stacked-query injection.
Read-only only. Only SELECT and CTE (WITH) queries are allowed. Any INSERT/UPDATE/DELETE/DROP/ALTER/CREATE/GRANT/COPY/CALL/PRAGMA/ATTACH is rejected.
System-table block. References to information_schema, pg_catalog, system, and similar catalogs are denied — agents introspect schema through list_tables/describe_table instead.
Filesystem-function block. Read-only SELECTs can still call table functions like read_csv, read_parquet, read_text, and glob to read local files. The guard walks the AST and denies these, so an agent can't exfiltrate the host filesystem (e.g. SELECT * FROM read_text('/etc/passwd')).
Auto-LIMIT. A LIMIT (default 1000, configurable via MAX_ROWS) is injected when absent, so an agent can never pull unbounded data.

Identifier arguments (table) are additionally checked against the known-table list before they are ever interpolated into SQL, preventing identifier injection.

Every one of these rules is backed by a passing test — see tests/test_safety.py (read-only allowlist, multi-statement, unparseable, system-table, filesystem-function, and auto-LIMIT cases) and tests/test_duckdb_backend.py (unknown-table rejection, row-cap truncation). The README makes no guardrail claim that isn't proven by the suite.

Recorded transcript

An agent exploring the bundled logistics warehouse:

> list_tables
[
  {"name": "carriers",  "column_count": 4},
  {"name": "lanes",     "column_count": 4},
  {"name": "shipments", "column_count": 7}
]

> run_sql: SELECT c.mode,
                  count(*)                                        AS shipments,
                  round(100.0 * avg(s.delivered_on_time::INT), 1) AS on_time_pct
           FROM shipments s
           JOIN carriers c ON s.carrier_id = c.carrier_id
           GROUP BY c.mode
           ORDER BY shipments DESC

columns: ["mode", "shipments", "on_time_pct"]
rows:
  ["LTL",        1250, 88.0]
  ["Intermodal", 1250, 88.0]
  ["FTL",        1250, 88.0]
  ["Parcel",     1250, 88.0]
truncated: false

A DDL attempt is refused before it ever reaches the warehouse:

> run_sql: DROP TABLE shipments
SQLValidationError: Only read-only SELECT queries are allowed.

Development

uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"
pytest
ruff check .

The DuckDB sample data is regenerated deterministically with:

python sample_data/generate.py

License

MIT — see LICENSE.

Available Tools

5 tools

describe_tableB

Return columns, types, and row count for a table.

ParametersJSON Schema

Name	Required	Description	Default
`table`	Yes

TDQS

B3.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose behavioral traits like permissions, speed, or side effects, but it only states the output. No additional transparency beyond the basic verb.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise (8 words), front-loaded with the output. However, it may be too sparse for effective use. A balanced score of 4 reflects efficiency without being wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema, the description adequately lists what is returned, but does not specify format, order, or limitations. Adequate but with clear gaps for a complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0% for the 'table' parameter, and the tool description does not clarify the expected format (e.g., fully qualified name, case sensitivity). It adds no value over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Return' and the resource 'columns, types, and row count for a table'. It distinguishes from siblings like list_tables (lists tables) and profile_table (more stats) by specifying what it returns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives (e.g., profile_table, run_sql). The description only states functionality without context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesA

List the tables available in the warehouse with their column counts.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries the burden. It adds that column counts are included, but lacks details on scope, performance, or limitations. Adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the action, no wasted words. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and an output schema present, the description provides the essential information. Minor omission: 'warehouse' context is vague but acceptable for a simple listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so no additional explanation needed. Baseline 4 applies as schema coverage is 100% and description adds nothing beyond.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists tables with column counts, a specific verb-resource combination that distinguishes it from siblings like describe_table (single table) and run_sql (arbitrary queries).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While not explicitly stating when to use versus alternatives, the distinct purpose makes it obvious. Siblings are clearly different, so usage context is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

profile_tableA

Return per-column null fraction, distinct count, and min/max for a table.

ParametersJSON Schema

Name	Required	Description	Default
`table`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It implies a read operation (returning statistics) but does not explicitly confirm read-only behavior, required permissions, or whether it can be called on any table. The lack of detail about side effects or access control leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One concise sentence (11 words) with no filler. It front-loads the verb and key outputs, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core outputs (null fraction, distinct count, min/max) and assumes the output schema details the return structure. Given one parameter and no nested objects, it is mostly complete. Missing context: whether all columns are profiled or only specified ones, but that is implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description adds 'for a table,' clarifying that the single required parameter 'table' is the table name. While minimal, it adds enough meaning beyond the raw schema. A higher score would require explicit format details, but the param is simple enough.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns per-column statistics (null fraction, distinct count, min/max) for a table. It uses a specific verb ('Return') and resource ('per-column... for a table'), differentiating it from siblings like describe_table (schema) or run_sql (arbitrary queries).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Siblings like describe_table and sample_rows exist, but the description does not clarify scenarios (e.g., use profile_table for data quality, describe_table for column metadata). This forces the agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_sqlA

Run a read-only SELECT query. DDL/DML/multi-statement queries are rejected; a row LIMIT is enforced automatically.

ParametersJSON Schema

Name	Required	Description	Default
`query`	Yes

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses read-only nature, rejection of non-SELECT queries, and automatic LIMIT enforcement, which are key behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The first sentence states the core action, the second adds restrictions. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a single parameter, no annotations, and no output schema, the description covers essential behavior: read-only, restrictions, and automatic LIMIT. It could mention maximum LIMIT or error handling, but it's adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'query' has no schema description (0% coverage). The description adds value by specifying allowed query types and constraints, but lacks details like format or examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a read-only SELECT query, which is the core purpose. While it doesn't explicitly differentiate from sibling tools, the verb 'run' and restriction to SELECT queries imply a distinct use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use (run a SELECT query) and what is rejected (DDL/DML/multi-statement, automatic LIMIT). It provides clear constraints but doesn't contrast with siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sample_rowsB

Return up to n (max 100) preview rows from a table.

ParametersJSON Schema

Name	Required	Description	Default
`n`	No
`table`	Yes

TDQS

B3.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries the burden. It discloses the row limit (max 100) and default (10), which is helpful, but doesn't mention ordering, randomness of sampling, or any side effects (though likely none). It could be more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence. It is front-loaded with the action ('Return up to n preview rows') and includes the key constraint (max 100). Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, no output schema), the description covers the basics: what it returns, the limit, and the required table. However, it leaves ambiguity about 'preview' (first N rows vs. random sample) and lacks detail on return structure. Adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (no descriptions for params in schema). The description mentions 'n' and 'table' but adds no new details about their format, constraints (beyond max), or semantics. It fails to compensate for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool returns preview rows from a table, with a specific verb and resource. It distinguishes from siblings like 'describe_table' (schema info) or 'run_sql' (arbitrary queries), though it doesn't explicitly contrast them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for quick data previews via 'preview rows', but lacks explicit guidance on when to use this over siblings, prerequisites, or when not to use it (e.g., for full data extraction).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Disambiguation5/5

Each tool has a distinct purpose: schema description, table listing, profiling statistics, SQL querying, and row sampling. No overlaps.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern (e.g., describe_table, list_tables), making them predictable.

Tool Count5/5

With 5 tools, the set is well-scoped for table exploration and profiling without being too sparse or bloated.

Completeness5/5

The tool surface covers the core workflow of a Databricks warehouse explorer: list, describe, profile, query, and sample—no obvious gaps for read-only operations.

Maintenance

ActivityStale

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Dataassist-IO
io.github.DataAssistIO
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Search Databases
2
Contextflo
com.contextflo
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Databases Security
1
QueryBear
io.github.spencerpauly
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Databases RAG Systems
2
Airbyte Agents
io.github.airbytehq
Let AI agents query data and act across all your business apps via MCP.
Data Platforms AI & Machine Learning RAG Systems
2

Related MCP Servers

safedb-mcp
Databases Security
narekmalk
A
license
A
quality
C
maintenance
Secure MCP server for safe, read-only DB access by AI agents, with SQL guardrails, table allowlists, PII masking, and audit logs
Updated 3 months ago (2026-05-27 10:23 UTC)
6
50
7
MIT
django-mcp-sql
Databases RAG Systems
thepapermen
A
license
Not graded
quality
A
maintenance
Provides a read-only PostgreSQL SQL surface for LLM agents via MCP, with defense-in-depth security layers for safe database queries.
Updated 23 days ago (2026-08-12 09:52 UTC)
3
MIT
DB MCP Gateway
Databases RAG Systems Search
mdadul
A
license
Not graded
quality
B
maintenance
Provides read-only access to databases for MCP-compatible AI tools, allowing schema exploration and SELECT queries without exposing credentials or risking data changes.
Updated 10 days ago (2026-08-25 17:17 UTC)
83
3
MIT
spotdb
Databases Research & Data
aliengiraffe
A
license
Not graded
quality
C
maintenance
Enables AI agents and workflows to safely explore and query data in ephemeral sandboxed databases via MCP, with guardrails and snapshot capabilities.
Updated 11 hours ago (2026-09-04 00:19 UTC)
21
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/openatlaspro-AI/databricks-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server