What you will be able to do
- Choose among MCP Services, Databricks managed MCP servers, and a self-hosted MCP server for a given tool requirement
- Select the right managed MCP server (Genie One, Genie Agent, AI Search, Databricks SQL, Unity Catalog functions) for a scenario
- Recognise when a scenario calls for MLflow 3 tracing, evaluation and monitoring
- Order the MLflow agent improvement loop
1.MCP: giving agents governed tools
Unity Catalog and Lakebase decide where data is governed and stored. MCP is about what an agent can do. "Tools give your agents practical capabilities beyond text generation, like searching documents, querying tables, calling external APIs, or running custom code." MCP is an open-source standard that connects AI agents to tools, resources and prompts. On Databricks it "is one of several ways to connect tools on Databricks". Unity Catalog function tools and vector search retrieval tools also exist, for example.
Whichever MCP servers an agent uses, governance works the same way. Unity Gateway controls access and monitors activity from a single control plane, and "Unity Catalog enforces permissions and manages credentials so agents and users reach only the tools and data you grant them".
| Option | What it is | Choose it when |
|---|---|---|
| MCP Services | Register external MCP servers as Unity Catalog securables, or use built-in system.ai services for SaaS tools like Slack, GitHub, and Google Drive | The tool lives in an external or SaaS system and needs governed access through Unity Gateway |
| Databricks managed MCP servers | Ready-to-use servers for Genie, AI Search, Databricks SQL, Unity Catalog functions, and the code interpreter | The agent needs Databricks data or functions, with no server to build or host |
| Host your own MCP | A custom MCP server hosted as a Databricks app | You need to expose your own tools |
Checkpoint 1 of 6· Check yourself
Your agent needs to read issues from GitHub, and the security team wants access governed through Unity Catalog grants and Unity Gateway. Which MCP option fits?
MCP Services register external MCP servers as Unity Catalog securables and include built-in system.ai services for SaaS tools such as GitHub, with governed access through Unity Gateway.
“Register external MCP servers as Unity Catalog securables”Source: docs.databricks.com
Sources1
2.Picking the managed MCP server for the job
Databricks managed MCP servers are in Public Preview. They are "ready-to-use servers that connect your AI agents to data in Unity Catalog, Databricks AI Search indexes, Genie Agents, and custom functions". Databricks hosts them and manages authentication, Unity Catalog enforces their permissions, and you manage all of them from Unity Gateway. The exam-relevant skill is choosing which one fits a scenario.
| Server | Use case | OAuth scope |
|---|---|---|
| Genie One | Natural-language analytics across your workspace | ai-gateway |
| Genie Agent | Natural-language analytics scoped to one Genie Agent | genie |
| AI Search | Retrieval over unstructured documents | ai-search |
| Databricks SQL | Developer queries and data engineering | sql |
| Unity Catalog functions | Predefined SQL logic as tools | unity-catalog |
Many people would pick Databricks SQL here, and the docs say otherwise. Genie resolves business terms through Genie Ontology, the governed semantic layer, and that "produces more accurate answers than an agent writing SQL directly against raw tables." Save the SQL server for when you "need to run a specific query you already wrote", such as validating syntax or authoring a pipeline. Some other details matter in scenarios. The system.ai schema includes ready-to-use functions, and "the code interpreter (system.ai.python_exec) lets an agent run Python code with no setup". Parameters can be tool call arguments the LLM generates, or _meta parameters that you preset in agent code to set behavior deterministically. For a third-party coding agent such as Claude Code or Cursor, pair the servers with Databricks AI tools: "Managed MCP servers give the agent governed tools to call. AI tools teaches it the Databricks patterns to apply when it writes code."
Checkpoint 2 of 6· Match them up
Match each agent requirement to the managed MCP server that fits it
Tap a term, then the definition that fits it.
AI Search covers retrieval over unstructured documents, Databricks SQL runs queries you already wrote, Unity Catalog functions expose predefined SQL logic as tools, and Genie Agent scopes analytics to one Genie Agent.
“Use the Databricks SQL MCP server when you need to run a specific query you already wrote”Source: docs.databricks.com
Checkpoint 3 of 6· Exam question
An agent occasionally enters a loop where it repeatedly retries a failing tool call dozens of times in a row, each retry appending more output to context and pushing the session closer to the window limit. Which guardrail most directly prevents this specific failure from consuming context length unchecked?
Correct answer: A — Set an iteration or retry limit so the agent stops after a bounded number of attempts
- A. Correct. Guarding against repeated or invalid tool calls with an explicit iteration or timeout limit directly caps the unchecked growth of context caused by a retry loop, which is the specific failure described.
- B. Incorrect. More reasoning effort per call does not stop the loop from repeating; it can even increase the token cost of each failing retry without addressing the unbounded repetition.
- C. Incorrect. Adding more tools does not prevent the agent from retrying the same failing call and can add further ambiguity and context volume rather than bounding the existing loop.
- D. Incorrect. Moving toward a more dynamic pattern grants the agent more autonomy over tool use, which does not inherently bound retries and could make an unconstrained loop more likely, not less.
Sources2
3.MLflow 3: when the scenario is about measuring and improving
Unity Catalog governs, Lakebase stores state, and MCP supplies tools. None of them tells you why an agent gave a bad answer. That is MLflow's job. On Databricks, agent observability and quality is done with MLflow, and "MLflow on Databricks is MLflow — the same open source product, just managed and integrated with the Databricks platform". It is the right choice when a scenario mentions debugging a failure, latency, token cost, collecting feedback, building evaluation datasets, or monitoring production quality.
Tracing is the foundation. "A trace includes the initial input and final output, plus every intermediate step — such as model calls, tool calls, and retrieval". It records inputs, outputs, latency, token usage and cost for each step. That detail is what makes diagnosis possible: "With only an input and final response, you cannot tell which intermediate decision caused a failure." Managed MLflow runs "with no tracking server to run and no version to maintain yourself", and it connects back to Unity Catalog. You can "Store traces as Unity Catalog Delta tables with schema- and table-level access control, no per-experiment limit, and direct SQL access."
curl -LsSf https://mlflow.org/wizard/setup.sh | shMLflow frames quality work as a cycle: "Improving an agent isn't a one-time step — it's a loop you run continuously." Each pass fixes one issue and surfaces the next. A scorer is an LLM judge or a code-based check. It turns a failure you found by hand into one that is caught automatically, and in production you "Run your scorers against live traffic so the issue doesn't recur".
Checkpoint 4 of 6· Put it in order
Put the steps of the MLflow agent improvement loop in order
- 1.Collect feedback and curate a dataset
- 2.Trace your agent
- 3.Fix the agent
- 4.Find an issue
- 5.Write a scorer
- 6.Evaluate the fix
Traces are the evidence every later step depends on. You find an issue in them, turn failures into a dataset, write a scorer that catches the issue, fix the agent, then re-run evaluation to confirm the fix. Monitoring production comes after.
“Evaluate the fix. Re-run evaluation against your dataset to confirm the fix”Source: docs.databricks.com
Checkpoint 5 of 6· Exam question
A long-running planning agent has accumulated a transcript containing both (a) reasoning steps for a sub-task that was already completed and resolved, and (b) the still-open question the user is currently waiting on. The team wants to safely shrink context without harming the agent's ability to finish the open question. Which content is the safest candidate to remove or compact first?
Correct answer: A — The reasoning steps and intermediate detail tied to the already-completed, resolved sub-task
- A. Correct. Superseded reasoning tied to a sub-task that is already resolved no longer needs to remain in full detail; it is a safe candidate for removal or compaction because it does not affect the agent's ability to address the still-open question.
- B. Incorrect. The open, unresolved question is exactly the information the agent still needs to act on, so removing or compacting it risks the agent losing track of the very task it must complete.
- C. Incorrect. A tool result the agent has not yet acted on is active, needed information for the next step, not superseded detail, so it is not a safe removal candidate.
- D. Incorrect. The system prompt defines ongoing role and constraints that apply for the life of the session; removing or compacting it risks the agent losing governing instructions rather than shedding safely superseded detail.
4.Routing a mixed scenario
Exam scenarios often combine requirements, and the answer is the tool that matches the specific need being asked about. Take a production support agent. It answers revenue questions through Genie One over MCP. It remembers each customer's history in Lakebase long-term memory. Its traces are captured with MLflow and stored as Unity Catalog Delta tables. Unity Catalog governs who may call each MCP service. If the question is "the agent's answers got worse after a prompt change; how do we find which step broke?", the answer is MLflow traces and evaluation. Lakebase holds the conversation state but does not explain failures, and MCP supplies the tools but does not score them.
Checkpoint 6 of 6· Check yourself
After a prompt change, a support agent occasionally calls the wrong tool. The team wants to confirm their fix works and catch the problem automatically if it returns in production. What should they use?
Catching an issue automatically and confirming a fix is the job of an MLflow scorer: run in evaluation against a dataset, then in production monitoring on live traffic.
“Write a scorer. Define a scorer (an LLM judge or code-based check) that catches the issue automatically.”Source: docs.databricks.com
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.On Databricks, every agent tool has to be exposed through MCP.Why is that wrong?
MCP is one of several ways to connect tools. Unity Catalog function tools and vector search retrieval tools are also documented options.
Covered in MCP: giving agents governed tools
2.For natural-language analytics, give the agent the Databricks SQL MCP server so it can write queries itself.Why is that wrong?
Start with Genie One. Genie resolves business terms through Genie Ontology and is more accurate than an agent writing SQL against raw tables. Use Databricks SQL for queries you already wrote.
Covered in Picking the managed MCP server for the job
3.Using MLflow tracing on Databricks means running and upgrading your own tracking server, with traces kept outside Unity Catalog.Why is that wrong?
Managed MLflow needs no tracking server or version maintenance, and traces can be stored as Unity Catalog Delta tables with access control and SQL access.
Covered in MLflow 3: when the scenario is about measuring and improving
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.https://docs.databricks.com/aws/en/agents/mcp-toolsOfficial docs
“Tools give your agents practical capabilities beyond text generation, like searching documents, querying tables, calling external APIs, or running custom code.”
↩︎ MCP: giving agents governed tools“is one of several ways to connect tools on Databricks”
↩︎ MCP: giving agents governed tools“Unity Catalog enforces permissions and manages credentials so agents and users reach only the tools and data you grant them”
↩︎ MCP: giving agents governed tools“Host a custom MCP server as a Databricks app to expose your own tools.”
↩︎ MCP: giving agents governed tools“is one of several ways to connect tools on Databricks”
↩︎ Exam trap 1“Register external MCP servers as Unity Catalog securables”
↩︎ Checkpoint - 2.
“ready-to-use servers that connect your AI agents to data in Unity Catalog, Databricks AI Search indexes, Genie Agents, and custom functions”
↩︎ Picking the managed MCP server for the job“produces more accurate answers than an agent writing SQL directly against raw tables”
↩︎ Picking the managed MCP server for the job“the code interpreter (system.ai.python_exec) lets an agent run Python code with no setup”
↩︎ Picking the managed MCP server for the job“Managed MCP servers give the agent governed tools to call. AI tools teaches it the Databricks patterns to apply when it writes code.”
↩︎ Picking the managed MCP server for the job“Governed: Unity Catalog enforces permissions, so agents and users access only the tools and data you grant them.”
↩︎ Routing a mixed scenario“For analytics use cases, start with the Genie One MCP server.”
↩︎ Exam trap 2“For analytics use cases, start with the Genie One MCP server.”
↩︎ Prediction“Use the Databricks SQL MCP server when you need to run a specific query you already wrote”
↩︎ Checkpoint - 3.
“MLflow on Databricks is MLflow — the same open source product, just managed and integrated with the Databricks platform”
↩︎ MLflow 3: when the scenario is about measuring and improving“A trace includes the initial input and final output, plus every intermediate step — such as model calls, tool calls, and retrieval”
↩︎ MLflow 3: when the scenario is about measuring and improving“With only an input and final response, you cannot tell which intermediate decision caused a failure.”
↩︎ MLflow 3: when the scenario is about measuring and improving“Improving an agent isn't a one-time step — it's a loop you run continuously.”
↩︎ MLflow 3: when the scenario is about measuring and improving“Run your scorers against live traffic so the issue doesn't recur”
↩︎ MLflow 3: when the scenario is about measuring and improving“Write a scorer. Define a scorer (an LLM judge or code-based check) that catches the issue automatically.”
↩︎ Routing a mixed scenario“Evaluate the fix. Re-run evaluation against your dataset to confirm the fix”
↩︎ Checkpoint - 4.
“Store traces as Unity Catalog Delta tables with schema- and table-level access control, no per-experiment limit, and direct SQL access.”
↩︎ MLflow 3: when the scenario is about measuring and improving“with no tracking server to run and no version to maintain yourself”
↩︎ Exam trap 3