Pins an allowlist of the exact Databricks tool names your team audited and denies every other tool name on the Databricks MCP server(s).
databricksdefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
Masks payment-card numbers (PANs) in Databricks tool responses before the agent receives them.
databricksmask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
Scans the response payloads of the Databricks MCP tools that carry lakehouse data back to the agent and rewrites personally identifiable information to fixed…
The community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…
databricksrole-gate-writesaccess-controlleast-privilegeingresssoc2
Fences off the most sensitive lakehouse namespaces from agents on the read side of Databricks.
databricksfence-sensitive-scopesingresssoc2hipaapci-dssgdpr-ccpa
Inspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…
databricksguard-warehouse-sqlingresssqlreadonlypci-dsssoxsoc2
Reusable DTwo policies for Databricks MCP servers — the official Databricks managed servers that the Claude Databricks connector uses (Genie, Databricks SQL, AI Search, UC Functions), plus the deprecated databrickslabs/mcp labs server and the community stdio servers (JustTryAI/databricks-mcp-server, RafaelCartenet/mcp-databricks-server). The MCP surface is small but potent: a handful of fixed snake_case verbs (genie_ask, execute_sql, execute_sql_read_only, poll_sql_result, genie_poll_response) plus dynamic {CATALOG}__{SCHEMA}__{NAME} tools for AI Search indexes and UC functions, and — on the community servers — cluster/job control (create_cluster, terminate_cluster, run_job, export_notebook). Its risk profile is dominated by the SQL string inside one argument: the managed execute_sql is explicitly read and write, so INSERT/UPDATE/DELETE/DROP/GRANT are irreversible data-plane and permission changes, the lakehouse routinely holds PII/PHI/cardholder tables that egress in the async poll responses (not the submit call), community PAT auth bypasses per-user Unity Catalog identity entirely, and system.ai proxy services can turn Databricks into a gateway to other SaaS apps. Policies here therefore pair tool-name matching with query-text and response-text inspection.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| default-deny-unknown-tools | ingress | Pin an audited allowlist of exact Databricks tool names and deny every other Databricks tool (drift-deny + system.ai proxy fence); all non-Databricks servers pass through. |
soc2, gdpr-ccpa |
| guard-warehouse-sql | ingress | Deny any execute_sql* statement that writes, changes schema, changes permissions, or bulk-exports (INSERT/UPDATE/DELETE/MERGE/DROP/TRUNCATE/ALTER/CREATE/GRANT/REVOKE/VACUUM/REORG); fail closed on a missing SQL argument. |
soc2, pci-dss, gdpr-ccpa, sox |
| fence-sensitive-schemas | ingress | Deny SQL and UC-describe calls whose target catalog, schema, or table matches a flagged sensitive namespace, unless the caller is in the data-privacy group. |
soc2, hipaa, pci-dss, gdpr-ccpa |
| role-gate-compute-ops | ingress | Gate cluster and job control (create_cluster, start_cluster, terminate_cluster, run_job, export_notebook) behind a platform-engineering group; read-only inventory tools pass through. |
soc2, sox |
| mask-pan-egress | egress | Mask payment-card numbers (PANs) in SQL/Genie poll responses and AI Search results before the agent sees them (transform-only). | pci-dss, gdpr-ccpa |
| redact-pii-egress | egress | Redact email, SSN, and phone PII from Databricks tool response payloads to fixed tokens (transform-only). | hipaa, gdpr-ccpa |
DTwo prefixes tool names with the MCP server name configured on the gateway. A Databricks SQL server registered as databricks-sql will surface tools like databricks-sql-execute_sql, while one registered as dbx will surface dbx-execute_sql. These policies match on the suffix / stem (execute_sql, execute_sql_read_only, poll_sql_result, etc.) so they stay portable across naming conventions and across the three different servers that each expose an execute_sql-ish tool with different auth semantics — but you should always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying. The single-space Genie invoke tool name and the genie_ask question parameter name are unverified in Databricks docs (see each policy's Known limitations); the dynamic {CATALOG}__{SCHEMA}__{NAME} AI Search / UC-function tools have no stable canonical name and need per-deployment enumeration or the allowlist pin.
The identity-gated policies (fence-sensitive-schemas, role-gate-compute-ops) read input.subject.claims.groups with placeholder group names (e.g. data-privacy, and the platform-engineering group used by role-gate-compute-ops). Replace these with your own IdP group names at import time. Missing claims fail closed for grants (no group → not exempt). The remaining policies are single-purpose and require no IdP claims.
To add a Databricks policy:
apps/databricks/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["databricks"] in the policy frontmatter, plus any industry / bundle slugs that apply.bundles/.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.