Concourse

Docs · Overview

Concourse — the governed tool factory for Databricks agent estates

Concourse turns a customer's API estate into governed Databricks tools, and gives agents a safe way to compose them.

What it does

  1. Tool Factory. Ingest OpenAPI specs, synthesize one Unity Catalog function per operation, register them idempotently in the customer's UC. From that moment they are ordinary Databricks objects: governed by UC grants, exposed through Databricks' managed MCP for UC functions, visible in Unity AI Gateway.
  2. App-hosted execution. Serverless UC functions have no external egress, so real HTTP execution lives in a Databricks App running the family governed MCP server (@fabric-harness/node) — the egress substrate, in the customer's workspace, under the caller's identity.
  3. Code mode. One MCP tool, compose: agent-authored TypeScript runs in a QuickJS sandbox whose only exit is a gated invoker over the governed catalog. Multi-tool programs in one round-trip; every inner call lands in an audit ledger. Read tools execute; mutating and destructive calls are approval-gated and fail closed.

Why it wins on Databricks

Concourse augments, never competes. Databricks keeps governance — UC, grants, Unity AI Gateway, managed MCP. Concourse adds the two things Databricks does not do: spec→tool synthesis for arbitrary (including non-Databricks) API estates, and a gated-invoker composition runtime. Every generated tool and every compose run drives serverless consumption: more tools → more agent runs → more DBUs.

Certification, not vibes

Every generated tool passes an Experiments certification gate (@fabricorg/experiments-evals): schema fidelity against the source spec, safety-classification provenance (method default → spec hint → operator override), and determinism via dual live probes. Results are signed (SHA-256 + Ed25519, Runway evidence-v2 contract) and exported to a UC Volume as a content-addressed ledger. The /console view shows the catalog, safety classes, certification verdicts, and recent compose runs with their audit ledgers.

Proven on a free plan

The entire loop — synthesis, certification, UC registration, App deploy, external MCP invoke, compose round-trip — is proven against a Databricks free-plan workspace with signed evidence per stage. No service principals, no paid compute: the portable path works on every plan.

Family stack

Consumes @fabric-harness/sdk (MCP client), @fabric-harness/node (governed server), @fabricorg/experiments-evals (certification), Tower (approvals) and Radar (SLOs) integrations. Genuinely new: synthesis, codemode, uc-registration, and the console.