Please email bugbounty@databricks.com to report any security vulnerabilities. We will acknowledge receipt of your vulnerability and strive to send you regular updates about our progress. If you're curious about the status of your disclosure please feel free to email us again.
This section describes what code executes when you install the Databricks AI Dev Kit as a Claude Code plugin.
When you install this plugin, the SessionStart hook executes .claude-plugin/setup.sh.
This script:
- Checks if already installed (exits early if so)
- Verifies
uvpackage manager is available - Creates a Python 3.11 virtual environment at
.venv/ - Installs local packages:
databricks-tools-coreanddatabricks-mcp-server - Verifies the MCP server module can be imported
- Make network requests (except to PyPI for Python dependencies)
- Modify files outside the plugin directory
- Run with elevated privileges
| File | Trigger | Purpose |
|---|---|---|
| .claude-plugin/setup.sh | SessionStart hook | Install Python dependencies |
We encourage you to review these files before installation:
- .claude-plugin/setup.sh - Setup script (~50 lines)
- hooks/hooks.json - Hook definitions (~15 lines)
- .mcp.json - MCP server configuration
Python packages are installed from:
- GitHub or Local (bundled):
databricks-tools-core/anddatabricks-mcp-server/ - PyPI (transitive): databricks-sdk, fastmcp, pydantic, and other dependencies