How MCP lets AI agents read governed data safely, without passwords or glue code
Picture a Monday morning. A product manager asks the AI assistant in her editor, "How many orders did we ship last week?" The assistant cannot answer. It has no way to reach the warehouse.
So someone on the data team gets a ticket: "Connect the AI to our data." This is one of the most common requests data teams receive in 2026. The open standard behind most answers to it is the Model Context Protocol, or MCP.
This article explains what MCP is, how it fits with Databricks, and the rules that keep it safe.
Before MCP, every AI tool needed its own connector. One team wrote a REST API for the chat bot. Another wrote function schemas for a coding assistant. A third shared a database password in a config file.
Each connector worked for a few weeks. Then a table changed, a token expired, or nobody remembered who owned it.
The password option is worse. An agent with a raw password can read every table that user can read. Nothing records why it asked.
MCP is a shared language between AI applications and the systems that hold context. Think of it like a USB-C port. The laptop does not care who made the cable. It only cares that the cable speaks the standard.
An MCP server offers a small list of tools, such as "run this approved query" or "look up this table's description". An MCP client, like Claude, Cursor or your own agent, discovers those tools and calls them.
The important part for data engineers: the server decides what is allowed. The agent only sees the tools you choose to expose.
Databricks offers managed MCP servers for Unity Catalog functions, Genie spaces and Vector Search. You can also run your own small MCP server that calls a SQL warehouse.
Either way, the request flows through Unity Catalog. That means the permissions, row filters and column masks you already set still apply.
flowchart TD
A[AI agent: Claude, Cursor, custom] -->|MCP request| B[MCP server]
B -->|service principal or OAuth| C[Unity Catalog permissions]
C --> D[SQL warehouse]
D -->|rows within policy| B
B -->|clean answer| AThe agent never holds a database password. It holds permission to call a tool. Unity Catalog decides what that tool may read.
Here is a tiny MCP server written in Python. It exposes one tool: weekly shipped orders. The agent cannot write free SQL. It can only ask this one question.
from mcp.server.fastmcp import FastMCP
from databricks import sql
import os
server = FastMCP("bricksnotes-orders")
APPROVED_QUERY = """
SELECT
DATE_TRUNC('week', shipped_at) AS week_start,
COUNT(*) AS shipped_orders
FROM workspace.default.orders
WHERE shipped_at >= CURRENT_DATE() - INTERVAL 28 DAYS
GROUP BY week_start
ORDER BY week_start
"""
@server.tool()
def weekly_shipped_orders() -> str:
"""Shipped orders per week for the last four weeks."""
with sql.connect(
server_hostname=os.environ["DATABRICKS_HOST"],
http_path=os.environ["DATABRICKS_HTTP_PATH"],
access_token=os.environ["DATABRICKS_TOKEN"],
) as connection:
cursor = connection.cursor()
cursor.execute(APPROVED_QUERY)
rows = cursor.fetchall()
return "\n".join(f"{row.week_start}: {row.shipped_orders}" for row in rows)
if __name__ == "__main__":
server.run()Notice what is missing. There is no "run any query" tool. The question is fixed, the table is fixed, and the time window is fixed. That is a design choice, not a limitation.
Free Edition note: You can create the orders table and a SQL warehouse in Databricks Free Edition and run this server on your own laptop to learn the pattern. Managed MCP servers and service principals may require a paid Databricks workspace. The concept is explained here for understanding.
1. Give agents their own warehouse. Use a small serverless SQL warehouse with auto stop and a short query timeout. If an agent loops, it hits a wall, not your monthly bill.
2. Expose curated views, never raw tables. Point tools at gold tables, views or Unity Catalog functions with clear names and comments. The agent reads those comments to decide what to call, so good descriptions matter.
3. Log every call. Run tools as a dedicated service principal. Then Unity Catalog audit logs and query history show exactly what each agent asked, and when.
A year ago, "connect the AI to our data" sounded like a side task. Now it is core data engineering work.
The skills are familiar ones: clean tables, clear contracts, good permissions and honest documentation. MCP just gives them a new customer. The better your data layer, the more useful every agent becomes.
If you can explain how an agent reaches governed data safely, you can explain it in an interview too.