Databricks Genie One MCP: governed data answers for any MCP agent

Databricks made the Genie One MCP server generally available on September 22, 2026. Any MCP client can now send Genie One a business question in plain language and get back an answer drawn from the company's Databricks data, with links to the sources Genie used. The server runs as a managed service inside Unity Gateway, so who may call it, what each call may do, rate limits, and audit logs are all managed in the same place as the rest of a team's Unity Catalog governance.

For a team running a self-hosted agent such as OpenClaw or Hermes, that is a data tool you do not have to host. Your agent asks the question. Databricks decides what that caller is allowed to see.

Sources are the Databricks launch post The Genie One MCP is now Generally Available and the Databricks docs for the Genie One MCP server, Databricks-provided MCPs, governing an MCP, MCP authentication and networking, adding tools and skills, supported coding agents, and Chat in Genie One, all checked on October 11, 2026.

Use the Genie One MCP when your agent needs answers from data that already lives in Databricks, and those answers must respect the same permissions your people have. It answers questions. Genie finds the right data, writes the SQL, runs it, and returns the result with citations. When you already have the exact query, Databricks points you to its SQL MCP (`system.ai.dbsql`) instead. The value depends on how well your Genie One setup answers questions today, because the MCP uses that same setup.

The server is a Databricks-provided MCP named `system.ai.genie_one_mcp`. You call it at `https://<workspace-hostname>/ai-gateway/mcp-services/system.ai.genie_one_mcp`, and OAuth connections request the `ai-gateway` scope. Databricks hosts it, so there is nothing to deploy or register.

Behind it is Chat in Genie One. Chat first looks for a Genie Agent that matches the question, then searches dashboards, queries, and metric views. Answers are grounded in Genie Ontology, which Databricks describes as a context layer that combines what you model in Unity Catalog (metric views, domains, and Pages) with context Genie infers from your assets and how they are used. That is how Genie resolves business terms, metric definitions, and table relationships. Databricks says this gives more accurate answers than an agent writing SQL against raw tables. We have not tested that claim.

The server exposes five tools:

Genie runs its own agent to find data and execute SQL, so a question does not come back in one call. `genie_ask` returns with `status: in_progress`. Your agent then polls `genie_poll_response` until the status is `completed`, `incomplete`, or `failed`. Databricks asks clients to wait for each poll to finish before sending the next one. The finished answer includes an Explore in Databricks link to the full conversation.

Results in `genie_ask` and `genie_poll_response` are cut short to protect the model's context window. If the agent needs every row, it calls `genie_get_query_result`, which still has a size limit. To run on a specific SQL warehouse, pass `warehouse_id` in the `_meta` parameters of `genie_ask` or `view_ask`.

Clients that support MCP Apps get a panel with Genie's progress, charts, and citations. Other clients get text. If your agent replies in a chat app, plan on the text answer and the Databricks link unless you have confirmed your client renders MCP Apps.

Every call to `system.ai.genie_one_mcp` goes through Unity Gateway, and Databricks lists several separate controls:

• Who can call it. Callers need `EXECUTE` on the MCP, `USE CATALOG` and `USE SCHEMA` on its parents, and assignment to the workspace. Databricks-provided MCPs can inherit a default `EXECUTE` grant on `system.ai`, so review those broad grants before you assume access is closed. A metastore admin needs `MANAGE` on `system.ai` before granting access.
• What data comes back. Unity Catalog permissions are enforced on every request, so results are scoped to what the caller can access.
• What each call may do. Policies can check a call before it runs and check its result, then allow it, block it, or require approval. Options include a built-in Sensitive Data Detection policy, a custom SQL function that can deny a tool to one agent by its OAuth client ID on on-behalf-of calls, and an external policy from a guardrail vendor that implements the Databricks external policy API. External policies fail closed: if the vendor is unreachable or slow, Databricks denies the call.
• How much. A rate limit in queries per minute applies to `tools/call` requests. Calls over the limit get HTTP 429.
• What happened. Call volume, errors, and latency are in `system.ai_gateway.usage` with `service_type = 'MCP_SERVICE'`. Invocations appear as `mcpCall` events in `system.access.audit`. Traces of requests, responses, and policy decisions are available after an admin turns them on.

One catch: the Genie One MCP itself is generally available, but MCP policies require the Unity Gateway beta, which an account admin turns on from the account console Previews page. During the beta, Databricks says the Sensitive Data Detection policy applies to all account users on the MCP.

The Beta Genie endpoint, `/api/2.0/mcp/genie`, is deprecated and will be sunset on October 31, 2026. It uses the `genie` OAuth scope. Databricks also notes that legacy workspace MCP endpoints bypass Unity Gateway: their calls do not show up in Unity Gateway tracing tables, and they do not support MCP-level grants, policies, or guardrails. If an agent of yours still points at the old URL, move it to `system.ai.genie_one_mcp` with the `ai-gateway` scope before then.

Databricks documents setup for Claude Code, Codex, Cursor, GitHub Copilot CLI, Gemini CLI, OpenCode, and others through its Unity Gateway CLI (`ug`), plus manual steps for ChatGPT, Windsurf, and Replit. OpenClaw, Hermes, and Grok Bot are not on that list, and we are not claiming Databricks supports them. What the docs say a client needs is the useful part:

• An MCP client that speaks Streamable HTTP.
• OAuth with a preconfigured client ID, requesting `ai-gateway` and `offline_access`. Databricks MCP endpoints do not support dynamic client registration, so an account admin creates the OAuth app and redirect URL first.
• For agents that run unattended, a Databricks service principal with OAuth machine-to-machine credentials.
• For local testing only, a personal access token in an `Authorization: Bearer` header. Keep it out of source control.

If your OpenClaw or Hermes setup can reach a remote MCP server that way, Genie One is one more server in its config. Hermes already supports per-server tool filtering, so you can expose only `genie_ask`, `genie_poll_response`, and `genie_get_query_result` if that is all the agent needs. Test it with a small question before you give it to a team.

The biggest decision is whose permissions the agent uses. Databricks recommends on-behalf-of user OAuth, so each answer is scoped to the person who asked. That fits an agent one person uses directly.

Self-hosted agents often run on a schedule or answer in a shared channel. For those, Databricks supports a service principal. The answers are then scoped to what the service principal can read, and anyone who can message the agent gets that same view of the data. Give each agent its own service principal with narrow grants, and do not reuse an admin identity because it was quick to set up. Our post on trust boundaries for self-hosted AI agents covers the same choice for other tools.

If your workspace uses IP access lists, MCP calls must come from an allowed address. For a self-hosted agent, that is the public outbound IP of the host it runs on, or your VPN or proxy if traffic goes through one. Hosted clients such as ChatGPT call from the provider's servers, so their published IP ranges must be allowed too. Databricks points out that a successful browser sign-in from your network does not mean the provider's servers can reach the MCP.

We have covered other gateway designs. Nightfall's MCP Gateway is a proxy in front of the MCP servers developer tools already use. The AgentCore multi-account hub puts one AWS gateway in front of MCP servers that each team runs in its own account. Google Cloud API Gateway turns existing OpenAPI REST operations into MCP tools on the same gateway, without a separate MCP host. Unity Gateway sits on the data side: Databricks hosts the tool and governs it in the same catalog as the data it reads. Bloomberg Enterprise MCP is another vendor-hosted data MCP, aimed at licensed Bloomberg market data under Data License Plus rather than warehouse answers under Unity Catalog.

Unity Gateway is not limited to Databricks tools. Teams can register their own or third-party MCP servers that support Streamable HTTP, choose which tools to expose, and govern them with the same grants and policies. That is a separate setup from Genie One and needs `CREATE SERVICE` and connection privileges on a schema.

Genie One answers questions. If an agent has to change records, it needs a different tool with its own approval step. If a number feeds an automated decision, such as an invoice amount or a payout, a fixed query or a typed tool you control is easier to test than a fresh answer generated each time. Our posts on human approval for agent actions and securing a production MCP server cover those cases.

1. 1Ask Genie One the same questions in the Databricks UI first. The MCP honors your Genie One configuration, so weak answers there will be weak answers in your agent.
2. 2Decide per agent whether it uses on-behalf-of user OAuth or its own service principal.
3. 3Review the default `EXECUTE` grant on `system.ai`, then grant `EXECUTE` only to the groups and service principals that need it.
4. 4If you need per-call policies such as sensitive data blocking, turn on the Unity Gateway beta and treat those policies as beta.
5. 5Set a rate limit so a looping agent gets HTTP 429 instead of running up usage.
6. 6Allow your agent host's outbound IP if IP access lists are on.
7. 7Build the polling loop into the agent, handle `incomplete` and `failed`, and fetch full results only when needed.
8. 8Move any agent still on `/api/2.0/mcp/genie` before October 31, 2026.
9. 9After the first week, read `system.ai_gateway.usage` and the `mcpCall` audit events to confirm who called it and how often.
10. 10Check Genie pricing. Databricks says the MCP uses Chat in Genie One.

OrchestriAI does not resell or operate Databricks for clients. MCP development builds the narrow, typed tools an agent needs for actions Genie One does not cover. AI agent systems decide which identity each agent uses, which tools it may call, and where a person approves. Systems integration connects the agent host, OAuth apps, network rules, and logs.

OrchestriAI is an independent implementation provider. Product names are used for identification only. OrchestriAI is not affiliated with, endorsed by, or sponsored by Databricks, Nightfall, Amazon Web Services, OpenClaw, or Nous Research / Hermes. This article summarizes the Databricks launch post The Genie One MCP is now Generally Available (September 22, 2026) and the Databricks documentation pages linked above as checked on October 11, 2026, plus our existing gateway and OpenClaw and Hermes guides. We have not run the Genie One MCP ourselves. Policies, Unity Gateway features, and pricing can change, and some controls are in beta, so confirm current Databricks documentation before you connect an agent to production data. This is not a security certification or a compliance conclusion.