Connect a Genie Agent to MCP tools and sources

A Genie Agent can use Databricks-provided MCP (Model Context Protocol) connectors to pull context from and take actions in external tools and sources during an Agent mode conversation. An agent author attaches the connectors, and each user authenticates to them individually. Every tool call runs with the permissions of the user who asks the question.

How MCP connectors work in a Genie Agent

MCP connectors let a Genie Agent combine its SQL and file analysis with the external applications your organization already uses. For example, a single conversation can analyze a sales table, pull related context from Google Drive, and draft a summary email. Azure Databricks governs every tool call through Unity Catalog and Unity Gateway. See Govern an MCP.

MCP tools fall into two categories:

• Read-only tools (search, fetch, and list) run automatically.
• Write tools (for example, sending a message or drafting an email) pause and ask the user to approve the action before it runs.

Genie Agents support the following Databricks-provided MCP connectors:

• Google Drive: Search and create Google Docs, Sheets, and Slides; edit Docs it created.
• Gmail: Search, read, and draft email.
• Google Calendar: Search and create calendar events.
• Microsoft 365: Search SharePoint, Teams, Outlook, and Calendar; draft Outlook email.
• Atlassian: Search and update Jira and Confluence.
• Asana: Search tasks, projects, portfolios, users, and teams, and create or update tasks when write actions are allowed.
• Glean (Beta): Search across your organization's connected apps using Glean.
• Slack: Search Slack messages and channels, and send messages.
• GitHub: Search and update repositories, issues, and pull requests.

Requirements

The following requirements apply to the agent and its users:

• Unity Catalog enabled in your workspace.
• Agent mode available in your region. See Databricks Designated Services.

• Unity Gateway available in your region. See supported regions.

• Both the Workspace access and Databricks SQL access entitlements for every user of the agent. Consumer-only, Databricks SQL-only, and account-only users can't use MCP tools. See Access entitlements.
• An account in each connected external system for every user of the agent.

Add connectors to a Genie Agent

To attach connectors to a Genie Agent:

1. Open your Genie Agent.
2. Open the Sources tab, then click Add.
3. Select one or more MCP Services.

To attach a connector, you need EXECUTE on the connector's MCP Service in Unity Catalog, plus USE CATALOG and USE SCHEMA on its parent catalog and schema. Connectors you don't have permission to run are unavailable. See Databricks-provided MCPs.

Configure tools

After you attach a connector, configure how the agent uses it:

• Add a clear Description that explains how and when the agent should use the connector's tools. For example, you can instruct the agent on a required ticket-title format or tell it to look up a user's profile at the start of each conversation.
• Enable or disable individual tools within a connector to scope which actions the agent can take.

Use MCP tools in a conversation

To use MCP tools in a Genie Agent:

1. Open a Genie Agent that has MCP connectors attached.

2. Turn on Agent mode in the chat box.

3. Authenticate to the connector from the Configure panel. If the agent needs a connector you haven't authorized, or your authentication has expired, the agent prompts you to sign in.

   If your organization blocks the sign-in, see Get admin approval for connectors.

4. Send a prompt that uses the connector. When the agent calls a write tool, choose Allow once to approve the single action, Always allow in this chat to approve that tool for the rest of the conversation, or Reject to decline it.

To confirm a connector works, ask a question that requires it, for example "Search my Google Drive for the Q3 sales plan." The agent cites the external resource it used in its response.

Get admin approval for connectors

Two groups of administrators control whether users can sign in to a connector and what the connection can do:

• Provider administrators: Your organization's Slack, Google Workspace, Microsoft Entra ID, or GitHub administrators decide whether users can authorize the app and which permissions it gets, such as OAuth scopes or access to GitHub repositories. They are often not your Azure Databricks admins.
• Azure Databricks admins: Users with the MANAGE privilege on a connector's MCP decide which tools are available and who can call them. See Govern an MCP.

If a provider blocks sign-in or limits what a connector can access, share the steps for that provider with its administrator. After the administrator approves the app, sign out of the connector and sign in again to get the approved permissions. See Manage provider sign-in.

Approve the Databricks Genie app in Slack

If your Slack workspace requires app approval, the Slack sign-in screen warns that the app is likely blocked. Slack can also drop permissions that an administrator hasn't approved. For example, sign-in succeeds, but the connector can't send messages.

A Slack Workspace Owner or app manager must approve the Databricks Genie app:

1. In Slack, click Admin in the sidebar.
2. Select Apps and workflows to open the Slack Marketplace.
3. Click Browse, then search for and select Databricks Genie.
4. Review the requested permissions and click Approve. The Send messages on a user's behalf permission (chat:write) lets users send messages through the connector.

If a user already requested the app, the Workspace Owner or app manager can approve the pending request instead. See Manage app approval for your workspace.

When Azure Databricks adds a permission to the connector, Slack asks for approval again. Until the new permission is approved, sign-in fails or Slack drops the new permission.

When you sign in again, check the actions that Databricks Genie can take on the Slack sign-in screen. The list should include sending messages. If the connector still can't send messages, ask a metastore admin or another user with MANAGE on system.ai.slack to check its tools:

1. In Unity Gateway, select MCPs and open system.ai.slack.
2. On Overview, click Edit tools.
3. Confirm that the tools that send messages are selected, then click Save changes.

See Choose available tools.

Allow the connectors in Google Workspace

If Google sign-in shows an access blocked error or says that your administrator's policy blocks the app, your Google Workspace administrator restricts which third-party apps can access Google data. The Google Drive, Gmail, and Google Calendar connectors use the same Google OAuth app, so one configuration covers all three.

A Google Workspace administrator with the Service Settings administrator privilege must configure the app:

1. In the Google Admin console, go to Security > Access and data control > API controls.
2. Click Manage App Access.
3. For Configured apps, click Configure new app.
4. Enter the client ID 645306276512-s5jbhbhff6irpdq1fpt2f21pcrf4agqs.apps.googleusercontent.com, click Search, and click the app in the search results.
5. For Scope, leave the top organizational unit selected to configure access for all users, or click Select org units to choose specific organizational units. Click Continue.
6. For Access to Google data, select Trusted. To allow only the scopes that the connectors request, select Specific Google data instead and add the scopes listed in Managed OAuth providers. Click Continue.
7. Review the settings and click Finish.

The app appears in the Configured apps list with the access level you selected. See Control which apps access Google Workspace data.

Approve Microsoft 365 permissions

The Microsoft 365 connector requests its Microsoft Graph permissions for SharePoint, OneDrive, Teams, Outlook, Calendar, and online meetings in a single consent. Users and administrators can't consent to only some of them, such as only the Outlook mail permissions. For the full list, see Microsoft 365 scopes.

Permissions that end in .All typically require administrator consent. If your organization requires administrator approval, share the app name from the consent screen with your Microsoft Entra ID administrator.

To limit what the connector can do, a metastore admin or another user with MANAGE on system.ai.microsoft_365 can remove its write tools. See Choose available tools. Removing tools controls which tools the connector can call. It doesn't change the permissions that the consent screen requests.

Enable GitHub write access and private repository access

By default, the GitHub connector (system.ai.github) can read only public repositories. To access private repositories, or to make changes such as committing files or creating issues and pull requests, the repository owner or a GitHub organization administrator must:

1. Install the Databricks GitHub connector app and grant it access to the required repositories.

2. If the organization uses an IP allowlist, add the Azure Databricks serverless outbound IPs for your workspace's cloud and region.

After the app is installed, users can work with the granted repositories through the connector, within their own GitHub permissions.

Limitations

The following limitations apply:

• MCP tools run only in Agent mode. They don't run in Chat mode.
• Through the Agent mode APIs, only read tools work, and users can't authenticate to a connector. Complete authentication and write-tool approval in the UI.
• For compliance guidance for connected applications, see External provider requirements.

The following sections describe limitations for specific connectors.

Google Drive

• When authorizing Google Drive, you might see an Unverified app screen. Click Advanced and continue the authorization process.
• Maximum file size is 25 MB.
• Only native Google Workspace files (Docs, Sheets, Slides) are supported. PDFs, images, and other binary formats are not supported.
• The connector can create Google Docs, Sheets, and Slides, and edit Google Docs it created. It can't edit Docs created outside the connector, or edit existing Sheets or Slides.
• Reading a very large document can be slow.

Gmail

• The connector can search, read, and draft email, but it can't send email or edit existing messages.
• The connector can't add Drive files as native Gmail attachments. As a workaround, include links to the files in the email body.

Microsoft 365

• Includes SharePoint, OneDrive, Teams, Outlook, Calendar, and online meetings.
• The connector can draft Outlook email but can't send it.
• Maximum file size is 25 MB for SharePoint files.
• Supported SharePoint file types include built-in SharePoint documents, spreadsheets, and presentations, as well as common text-based formats such as .txt, .csv, .json, .md, and others. PDFs, images, and other binary formats are not supported.

Glean (Beta)

• Glean is search-only. It can't read a document from a direct link.
• A metastore admin must first configure the Glean tenant ID before non-admin users can use the connection. The admin can enter the tenant ID when first connecting to Glean.
• To connect to a specific Glean MCP server, a metastore admin can optionally set the MCP server path (for example, /mcp/eng) when setting up the connection. Leave this field blank to use the default path (/mcp/default). Non-admin users cannot specify or change the Glean MCP server path.

Slack

• The connector can't edit or delete a message after sending it.

GitHub

• Writes are limited to file contents, issues, and pull requests.
• By default, the Databricks GitHub MCP connector can access only public repositories. To access private repositories, or to make changes such as committing files or creating issues and pull requests, the repository owner or a GitHub organization administrator must complete additional setup. See Enable GitHub write access and private repository access.
• GitHub Enterprise Server (the self-hosted version of GitHub) is not supported.

Additional resources

See the following resources for related information:

• Connect Genie One to external applications with MCP
• Databricks-provided MCPs
• Managed OAuth providers
• External MCP servers
• AI governance with Unity Gateway