Latest in AI
Databricks Unity Gateway Adds MCP Prompt-Injection Screening: How It Works
The new beta checks tool calls and results, but choosing where the check runs determines what it can actually stop.
Databricks added beta support for screening MCP tool calls and results for jailbreaks and prompt-injection attempts on October 21, 2026. Unity Gateway's Jailbreak guardrail can now inspect either side of a tool interaction, giving teams a checkpoint around the external information their agents consume.
The dated release notes describe input, output or combined screening. The setting is more consequential than it first looks: checking a proposed action and checking its returned text solve different problems.
What the MCP guardrail checks
MCP, the Model Context Protocol, lets an AI application call tools exposed by another service. A useful tool result may also contain instructions that an agent should treat as untrusted content rather than as a new command.
Databricks' service-policy documentation describes system.ai.block_jailbreak as a model-based check. On MCP services, it can judge the call and its arguments before execution, or the result afterward. Output screening includes result.content and result.structuredContent.
There are boundaries. The evaluator does not fetch linked resources, and tool descriptions returned by tools/list are not screened. Nontextual blobs and blobs that cannot be decoded within its limits can be excluded. This is a check on specific material crossing the gateway, not proof that every source an agent sees is safe.
Input versus output screening
The configuration guide says the form preselects output screening for Jailbreak on an MCP service. An output denial can stop the returned result reaching the caller, but it cannot undo the tool's side effects. Include input screening when the call itself must be checked before execution.
Consider a read-only search tool and a tool that updates a customer record. For the search tool, the returned text is an obvious place to look for an injected instruction. For the update tool, discovering a problem after the write is too late to prevent that write. A response filter and an action boundary belong at different points in the workflow.
The phase should follow the risk of the tool. Applying the same default to every service is convenient, but it skips the question of what must happen before an action is allowed.
Enabling the beta and testing it
Databricks stages releases, so account availability can lag the release date. A workspace administrator must enable the Unity Ai Gateway Service Policies preview. Attaching a policy requires the relevant service permissions. In Unity Gateway, select the MCP service, open Policies, add the Jailbreak guardrail and choose its phase.
Databricks recommends starting model-judged policies in Log mode, reviewing the would-be decisions and then moving to enforcement. Log mode does not block calls. Model verdicts can vary, so a successful demonstration against one malicious-looking string is weak evidence of production reliability.
A useful evaluation should include ordinary documents that discuss security, benign quoted instructions and representative tool outputs. Otherwise, a team may learn that the detector catches an obvious attack while missing that it also interrupts normal work. Measure both false alarms and missed cases, alongside the extra time each check adds.
Pricing and operational limits
Databricks says built-in service policies have no separate policy fee. Evaluator-model calls are still billed, including their prompts and responses. Teams adding checks before and after frequent tool calls should account for that additional inference work.
The platform also distinguishes authorization from content screening. Existing grants determine who may call a service; policies govern the interaction after access is established. A content detector should therefore complement narrowly scoped tools and permissions rather than become the only control around a powerful operation.
The useful change is that tool output now has an explicit inspection point in Unity Gateway. The deployment decision is whether each checkpoint protects a clearly identified boundary, with measured failure cases, instead of merely making the architecture diagram look more secure.
I'm Paras. I work at the intersection of AI, engineering and distribution.
I help teams explain complex enterprise AI products and technical decisions clearly, for both developers and the people evaluating them.