Screen MCP tool calls for jailbreaks in Unity Gateway

Databricks now allows screening Model Context Protocol (MCP) tool calls and results in Unity Gateway for jailbreak and prompt injection attempts. This built-in guardrail can be attached to MCP services to evaluate inputs, outputs, or both.

To configure it via the interface, navigate to AI Gateway in the workspace sidebar, select your service under the MCPs tab, go to the Policies tab, and create a new policy choosing the Jailbreak guardrail.

Use cases

Imagine an AI agent connected to enterprise systems through MCP tools, such as running database queries or calling external APIs. A malicious user—or untrusted external data retrieved by a tool—could attempt to hijack the model's instructions through prompt injection. With this feature, you can:

• Intercept malicious arguments sent to MCP tools before execution takes place (input phase).
• Screen tool outputs to prevent indirect prompt injections from reaching the model or end user (output phase).
• Enforce centralized security controls without developing custom validation code.

Limitations and requirements

• Stage: Beta. Workspace admins must turn on the Unity AI Gateway Service Policies preview in workspace settings.
• Permissions: Requires MANAGE on the target MCP service securable. If configuring a non-default evaluator model, EXECUTE on that model service and USE CATALOG and USE SCHEMA on its namespace are required.
• Tool side effects: The output evaluation occurs after the tool finishes running. A denial blocks the output from propagating but cannot revert actions already performed; to prevent execution altogether, apply the guardrail on the input phase (ON CALL).