The roadmap is capability- and quality-gated. Dates are intentionally omitted until the project has a stable maintainer cadence.
- Typed Python package and CLI entry point
-
stdioand Streamable HTTP transports - Databricks unified authentication
- Health, current identity, catalog, and warehouse tools
- Deny-by-default policy foundation
- Unit tests, CI, container, and security documentation
- Capability-pack architecture with a policy-enforcing tool registry
- Capability introspection (
server_info,list_enabled_capabilities,get_policy_status) - Unity Catalog metadata exploration (schemas, tables, views, columns, functions, volumes)
- Mock-SDK contract tests for every read tool
- Read-only SQL with sqlglot AST validation, bounded results, and cancellation
- Read-only jobs, pipeline, and cluster inspection
- Read-only governance (grants and object permissions)
- Read-only workspace browse/export, MLflow, Model Serving, Vector Search, Genie
- Read-only cost and audit reads over system tables
- Consistent cursor pagination for large listings
- Opt-in live-workspace integration tests
- Mutation safety contract: risk classes, dry runs, approval tokens, audit log
-
controlled-writeaccess mode with per-tool allowlist (writes off by default) - First gated mutation pack: jobs run / cancel / delete
- Pipelines, compute, and warehouse lifecycle operations
- Workspace and Unity Catalog Volume file operations
- Idempotency-key store and async task support for long-running operations
- MCP OAuth 2.1 protected-resource implementation
- M2M, U2M, on-behalf-of-user, and workload identity federation
- Multi-user and multi-workspace isolation
- OpenTelemetry, audit sinks, quotas, and distributed rate limiting
- Databricks Apps, Docker, Kubernetes, and Helm deployments
- Unity Catalog lineage, grants, and governance
- MLflow experiments and model registry
- Model serving, Genie, AI Search, and agent tooling
- Account-level identity, workspace administration, and cost visibility
- Public extension SDK for third-party capability packs
- Stable tool and response contracts
- Client compatibility and upgrade guarantees
- Security review, SBOM, provenance, and signed releases
- PyPI, container registry, MCP Registry, and Marketplace publication