> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SeekOut to Databricks

> Install SeekOut from Databricks Marketplace, sign in, and use it in Genie One or AI Playground.

Install the public **SeekOut Talent Search MCP** listing from Databricks Marketplace to bring SeekOut recruiting workflows into Databricks. An administrator configures the connection once, and each user signs in with their own SeekOut account before using it in Genie One, AI Playground, or an agent.

## Prerequisites

* An active SeekOut Recruit account with MCP access for each user
* A Databricks workspace enabled for Unity Catalog in a [region that supports Model Serving](https://docs.databricks.com/aws/en/resources/feature-region-support#model-serving)
* The [**Managed MCP Servers** preview](https://docs.databricks.com/aws/en/admin/workspace-settings/manage-previews#manage-workspace-level-previews) enabled by a Databricks workspace administrator
* For Genie One, the [**Third Party Connectors for Agents** Beta](https://docs.databricks.com/aws/en/genie-one/external-sources#connect-an-external-data-source) enabled from the workspace **Previews** page
* A Databricks installer with `USE MARKETPLACE ASSETS` and `CREATE CONNECTION` on the Unity Catalog metastore attached to the workspace
* A Unity Catalog catalog and schema where the Marketplace installation can create the MCP service
* `USE CATALOG`, `USE SCHEMA`, and `CREATE SERVICE` on that location, plus `USE CONNECTION` on the installed connection, for the service owner
* Outbound HTTPS access to `seekout-search-mcp.seekout.io` and `app.seekout.io`

<Note>
  To enable either preview, a workspace administrator opens their user menu, selects **Previews**, searches for the feature name, and turns it on. See [Manage Databricks previews](https://docs.databricks.com/aws/en/admin/workspace-settings/manage-previews). Menu names and availability can vary by workspace, cloud, and region.
</Note>

<Info>
  `USE MARKETPLACE ASSETS` lets the installer get or request products from Databricks Marketplace. Databricks grants it to users by default, but a metastore administrator can revoke it. `CREATE CONNECTION` lets the installer create the Unity Catalog connection that stores the SeekOut endpoint and OAuth configuration; installing the listing creates this connection automatically.

  The installer does not need an administrator role if a metastore administrator grants both privileges directly. If the listing is visible but installation is unavailable, ask your metastore administrator to grant them to the installer or an installer group:

  ```sql theme={null}
  GRANT USE MARKETPLACE ASSETS ON METASTORE TO `seekout_installers`;
  GRANT CREATE CONNECTION ON METASTORE TO `seekout_installers`;
  ```

  See the [Databricks Marketplace requirements](https://docs.databricks.com/aws/en/marketplace/get-started-consumer#before-you-begin) and [Unity Catalog privilege reference](https://docs.databricks.com/aws/en/data-governance/unity-catalog/access-control/privileges-reference).
</Info>

### MCP service owner permissions

These permissions apply to the administrator or service owner who installs the SeekOut listing and owns the resulting MCP service:

| Privilege        | Purpose                                                                                           |
| ---------------- | ------------------------------------------------------------------------------------------------- |
| `USE CATALOG`    | Reference the catalog that will contain the MCP service.                                          |
| `USE SCHEMA`     | Reference the schema inside that catalog.                                                         |
| `CREATE SERVICE` | Allow the Marketplace installation to create the MCP service in the selected schema.              |
| `USE CONNECTION` | Let the new MCP service reference the SeekOut connection created during Marketplace installation. |

A metastore administrator can grant these permissions to a service-owner group. Replace the example object and group names with your own:

```sql theme={null}
GRANT USE CATALOG ON CATALOG main TO `seekout_service_owners`;
GRANT USE SCHEMA ON SCHEMA main.ai_tools TO `seekout_service_owners`;
GRANT CREATE SERVICE ON SCHEMA main.ai_tools TO `seekout_service_owners`;
GRANT USE CONNECTION ON CONNECTION seekout_mcp TO `seekout_service_owners`;
```

End users do not need `CREATE SERVICE` or `USE CONNECTION`. To use the finished service, they need `USE CATALOG`, `USE SCHEMA`, and `EXECUTE` on the MCP service. Avoid granting end users `USE CONNECTION`, which would let them bypass the service's tool selection, policies, and auditing. See the [Databricks MCP service requirements](https://docs.databricks.com/aws/en/ai-gateway/register-mcp-service#register-an-external-mcp-server).

### Outbound network access

The Databricks-managed proxy behind the MCP service must be able to make outbound HTTPS requests on port 443 to these domains:

| Domain                          | Purpose                                                           |
| ------------------------------- | ----------------------------------------------------------------- |
| `seekout-search-mcp.seekout.io` | Runs SeekOut MCP tool discovery and recruiting requests.          |
| `app.seekout.io`                | Handles SeekOut sign-in, OAuth authorization, and token exchange. |

Most workspaces allow this traffic without additional setup. If your organization restricts outbound traffic with a Databricks network policy or another egress control, ask your network administrator to allow both fully qualified domain names on port 443. A user's browser must also be able to reach `app.seekout.io` during sign-in.

This requirement is outbound-only; you do not need to expose an inbound port on the Databricks workspace. If either domain is blocked, users might see OAuth login failures, DNS or network timeouts, or a successful login followed by failed tool discovery. See [Unity Catalog connections and network policies](https://docs.databricks.com/aws/en/connect/uc-connections#connections-and-network-policies).

## Choose names and a Unity Catalog location

Before setup, choose the catalog and schema that will govern the MCP service. Use your organization's naming conventions. For example:

| Object                 | Example                               |
| ---------------------- | ------------------------------------- |
| Unity Catalog catalog  | `main`                                |
| Unity Catalog schema   | `ai_tools`                            |
| Marketplace connection | `main.ai_tools.seekout_mcp`           |
| MCP service            | `seekout_talent_search`               |
| Full MCP service name  | `main.ai_tools.seekout_talent_search` |

The Marketplace installation creates two Unity Catalog objects:

| Object          | Where to find it                                                                                                                                            |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| MCP service     | **Catalog → `main` → `ai_tools` → MCP services**. Its full name follows the `catalog.schema.service` format, such as `main.ai_tools.seekout_talent_search`. |
| HTTP connection | **Catalog → `main` → `ai_tools` → Connections**. Its full name follows the `catalog.schema.connection` format, such as `main.ai_tools.seekout_mcp`.         |

The MCP service references the HTTP connection and is the object you grant to end users. Replace the example catalog, schema, service, and connection names with the names used in your installation.

## Administrator setup

<Info>
  This is a one-time, administrator-managed setup. A Databricks administrator can delegate it to an installer who has the required permissions. End users do not install the Marketplace listing or manage the Unity Catalog connection and MCP service.
</Info>

<Steps>
  <Step title="Request OAuth credentials from SeekOut">
    Contact [SeekOut Support](https://seekout.com/contact) or your SeekOut account team and request a **Databricks Marketplace OAuth client** for your workspace.

    Provide your exact Databricks workspace URL. SeekOut must register this redirect URI character for character:

    ```text theme={null}
    https://<databricks-workspace-host>/login/oauth/http.html
    ```

    SeekOut configures the client for the `mcp:tools` scope and this required OAuth resource:

    ```text theme={null}
    https://seekout-search-mcp.seekout.io/tools
    ```

    Use a separate OAuth client for each Databricks workspace. SeekOut sends the client ID and client secret through a secure channel.
  </Step>

  <Step title="Handle the client secret securely">
    Limit the credentials to the administrator performing the installation. Paste them only into the Databricks installation dialog, which stores them in the Unity Catalog connection.

    Do not put the client secret in a notebook, source control, ticket, chat, email, screenshot, or shared document. If it is exposed, ask SeekOut to rotate it before continuing.
  </Step>

  <Step title="Find the public SeekOut listing">
    In your Databricks workspace, open **Marketplace** and search for **SeekOut**.

    Open the public listing published by **SeekOut**. If the listing asks you to request access, submit the request and return after it is approved.
  </Step>

  <Step title="Install SeekOut from Marketplace">
    Select **Install** and enter the connection name you chose, such as `seekout_mcp`. Confirm that the listing supplies these endpoint values:

    | Field     | Value                           |
    | --------- | ------------------------------- |
    | Host      | `seekout-search-mcp.seekout.io` |
    | Base path | `/tools`                        |

    Enter the SeekOut-provided client ID and client secret, then select **Install**. The installation creates both the Unity Catalog connection and the MCP service; you do not need to register the MCP service separately. Note the catalog, schema, and service name shown after installation because you use them to find the service in Catalog.
  </Step>

  <Step title="Grant access to users">
    Grant users or groups `USE CATALOG` and `USE SCHEMA` on the parent objects and `EXECUTE` on the MCP service. Users must also be assigned to the workspace where they invoke it.

    Do not grant ordinary users `USE CONNECTION`. Reserve it for administrators and service authors so calls continue through the MCP service's tool selection, policies, and auditing.
  </Step>
</Steps>

<Warning>
  Per-user OAuth login requires **Workspace access** in Databricks. The **Consumer access** entitlement can invoke shared MCP services but cannot complete the per-user login required by SeekOut.
</Warning>

## Use SeekOut in Databricks

After the administrator completes setup and grants access, users can open SeekOut directly from Genie One or AI Playground. They do not need access to the underlying Unity Catalog connection. The first time a user accesses SeekOut, Databricks might prompt them to sign in and authorize their individual SeekOut account; OAuth tokens are not shared between users.

If the sign-in prompt does not appear in Genie One or AI Playground, open **Catalog**, select the catalog and schema used during installation, select **MCP services**, and open the SeekOut MCP service. Select **Login** on the service detail page.

<Tabs>
  <Tab title="Genie One">
    1. Open the Genie One home page.
    2. Select the plus icon beside the chat box, then select **More connections**.
    3. Select the SeekOut entry backed by the MCP service your administrator shared.
    4. If prompted, select **Sign in** and authorize SeekOut.
    5. Ask Genie One to use SeekOut for your recruiting request.

    If Genie One does not select the tools automatically, include **Use SeekOut** in your prompt.
  </Tab>

  <Tab title="AI Playground">
    Use AI Playground to validate the connection or prototype an agent:

    1. Open **AI Playground** and select a model marked **Tools enabled**.
    2. Select **Tools → Add tool → MCP Servers → External MCP servers**.
    3. Select the SeekOut MCP service.
    4. If prompted, select **Sign in** and authorize SeekOut.
    5. Enter a recruiting request and confirm that the model calls SeekOut tools.
  </Tab>
</Tabs>

## Try a recruiting prompt

<Prompt description="Use SeekOut to find senior data engineers in Austin with production Snowflake and Airflow experience. Treat fintech experience as preferred, not required." icon="quote">
  Use SeekOut to find senior data engineers in Austin with production Snowflake and Airflow experience. Treat fintech experience as preferred, not required.
</Prompt>

<Prompt description="Use SeekOut to compare the available pool of staff machine learning engineers in Seattle, Boston, and New York. Show common employers and skills, and identify which requirements narrow the pool most." icon="quote">
  Use SeekOut to compare the available pool of staff machine learning engineers in Seattle, Boston, and New York. Show common employers and skills, and identify which requirements narrow the pool most.
</Prompt>

<Prompt description="Use SeekOut to build a shortlist of five senior platform engineers with AWS, Kubernetes, and infrastructure-as-code experience. Explain the ranking and do not retrieve contacts or save candidates until I approve." icon="quote">
  Use SeekOut to build a shortlist of five senior platform engineers with AWS, Kubernetes, and infrastructure-as-code experience. Explain the ranking and do not retrieve contacts or save candidates until I approve.
</Prompt>

## Permissions and entitlements

* Databricks controls who can install the Marketplace listing, create the connection and MCP service, and invoke the service.
* SeekOut controls the talent data, tools, actions, integrations, and credits available after a user signs in. Users cannot gain access beyond their existing SeekOut role and subscription.
* Contact retrieval, exports, and other actions can use SeekOut credits or change data. Use MCP service tool selection and Databricks policies to expose only the tools your organization approves.

For the full identity and permission model, see [Authentication](/mcp/security/authentication) and [Security overview](/mcp/security/overview).

## Learn more

* [Recruiting workflows](/mcp/capabilities/workflows)
* [Prompting tips](/mcp/capabilities/prompting-patterns)
* [Tool reference](/mcp/reference/operations)
* [Authentication](/mcp/security/authentication) and [Security overview](/mcp/security/overview)
* [Usage limits](/mcp/security/usage-limits)
* [SeekOut service status](/mcp/reference/status)
* [Install external MCP servers from Databricks Marketplace](https://docs.databricks.com/aws/en/marketplace/get-started-consumer#get-access-to-external-mcp-servers)
* [Register an external MCP server in Databricks](https://docs.databricks.com/aws/en/ai-gateway/register-mcp-service)