← tutti gli articoli

Databricks now lets Claude, ChatGPT and Cursor sign in without a custom OAuth app

Databricks made default OAuth apps for external AI agents generally available. What changes for a data engineer, how to try it, and the limits that stay in place.

·4 min di lettura

Every time someone on my team wants to point an AI agent at our lakehouse, the same question comes up: how does it log in? For a long time the honest answer was a personal access token pasted into a config file. It works, and it is also the kind of long-lived secret I would rather not have sitting in a dozen laptops.

On 27 October, Databricks marked something small but useful as generally available: default OAuth apps for external AI agents. I want to explain what it changes, because it is easy to miss in a release-notes page with about a hundred entries.

What it is

Databricks can expose parts of your data and tools through MCP servers. MCP is the open protocol that lets an AI client call tools in another system. Until now, connecting a client such as Claude Code to those servers over OAuth meant that an admin first had to create an OAuth app for it.

Now Databricks ships pre-created OAuth apps. According to the release note, ChatGPT, Codex, Claude, Claude Code and Cursor can connect to Databricks MCP servers with default OAuth client IDs, and no admin has to create an app. The documentation says these apps do not need a client secret.

Why a data engineer should care

Three things stand out to me.

First, fewer long-lived tokens. The docs say that using OAuth reduces reliance on personal access tokens. A token that expires is a smaller problem than a token that lives for months in a forgotten file.

Second, permissions stay where they were. The docs state that Unity Catalog enforces your existing data permissions on each tool call. The agent does not get a back door. It gets the same access you have, and only through the MCP servers you are allowed to call.

Third, less waiting. A small team does not have to open a ticket to register an app for each new tool someone wants to try.

A concrete example

Say you are debugging a pipeline that writes to a table in Unity Catalog. You open Claude Code in your terminal and want it to look at that table and the job that fills it. You add the Databricks MCP server to the client and use the client ID URL for Claude Code from the Databricks docs. You sign in with your Databricks account in the browser. From then on the agent can call the tools that server offers, with your permissions.

I have not run this against a production workspace yet. This is what the documentation describes, and I will say so again in the limits below.

How to try it in three steps

  1. Ask your account admin to check that the default AI agent OAuth apps are turned on. The docs say an account admin can switch them on or off for the account.
  2. Make sure you have what the docs list as requirements: permission to call the MCP server, and the Consumer access or Workspace access entitlement.
  3. In your agent, enter the full client ID URL for that agent, taken from the table in the docs, as the client ID. For the exact steps, follow the agent's own setup guide, which the Databricks page links to.

The limits

  • It is not a free pass. An admin still decides whether the apps are on, and you still need permission to call the MCP.
  • MCP servers that use per-user OAuth also need you to sign in with that provider.
  • The release note does not say anything about regions or plans, so check your own workspace before you plan around it.
  • OAuth reduces token risk, but it does not make an agent safe by itself. An agent that can run tools can still do something you did not intend. Keep its permissions narrow.

One more thing from this week

Two other announcements point the same way, towards agents that follow shared standards. On 22 October, Anthropic said it is donating the Agent Skills standard to the Agentic AI Foundation, which also hosts MCP. And on 28 October, Microsoft announced a public preview of the Microsoft Copilot harness in Foundry Agent Service, a managed way to run agents. Microsoft says billing for it starts on 1 December 2026.

None of this is flashy. But when I move agents from a demo to a pipeline, boring things like login and permissions decide whether it survives a security review.

Sources

databricksmcpsecurity