> Set up the MATLAB Interface for Databricks and read data via Databricks Connect (Spark). Use when connecting MATLAB to Databricks for the first time, configuring authentication (OauthU2M, OauthM2M, PAT), creating Spark sessions with getDatabricksSession(), reading Unity Catalog tables, filtering DataFrames server-side, or converting results to MATLAB .databrickscfg, large table server-side filtering.
npx skills add https://github.com/matlab/matlab-agentic-toolkit --skill matlab-connect-databricks-spark
Read data from Databricks into MATLAB via Databricks Connect. This skill covers first-time setup, authentication, and using Spark DataFrames from desktop MATLAB.
.databrickscfg and authentication (OauthU2M, OauthM2M, PAT)getDatabricksSession)/matlab-connect-databricks-jdbcsetup from the package directory to configure settings, .databrickscfg, and install the Databricks Connect library via pipspark.range(1) to confirm connectivityspark.read().table() to get a DataFrame handle (data stays on cluster).filter(), .withColumn(), .select() server-sideT = table(DF) only after reducing data| Function | Purpose |
|----------|---------|
| setup | Interactive first-time configuration: settings, .databrickscfg, and Databricks Connect library download |
| startup | Adds package paths to MATLAB (run once per session, required after setup) |
| matlab.databricks.setup.configureDBC() | Re-run Databricks Connect library download independently (supports alternativeRepo for internal Artifactory) |
| getDatabricksSession() | Creates a databricks.PySparkSession connected to Databricks (classic compute) |
| getDatabricksSession(serverless=true) | Creates a serverless session (no cluster needed, 10-min timeout) |
| updateClusterId(id) | Updates the cluster ID in .databrickscfg (pass "serverless" to switch to serverless mode) |
| spark.range(n) | Creates a DataFrame with n rows (useful for testing) |
| spark.read().table("catalog.schema.table") | Reads a Unity Catalog table as a DataFrame |
| DF.filter(expr) | Server-side row filtering |
| DF.withColumn(name, col) | Adds/transforms a column server-side (col must be a matlab.pyspark.sql.column.Column) |
| DF.limit(n) | Server-side row limiting (returns first n rows as a new DataFrame) |
| matlab.pyspark.sql.functions.col(name) | Creates a Column reference by name |
| matlab.pyspark.sql.functions.lit(value) | Creates a Column containing a literal constant |
| DF.select(cols) | Server-side column selection |
| DF.show(n) | Displays n rows (stays on cluster) |
| DF.printSchema | Prints DataFrame schema |
| table(DF) | Converts DataFrame to a MATLAB table (pulls data locally) |
| spark.sql(query) | Executes a SQL query and returns a DataFrame |
| spark.table("catalog.schema.table") | Shortcut for spark.read().table() |
| matlab.sparkutils.table2dataset(T, spark) | Converts a MATLAB table back to a Spark DataFrame |
| DF.write.mode(m).format(f).save(path) | Writes DataFrame to a file path |
| DF.write.mode(m).format(f).saveAsTable(name) | Writes DataFrame to a Unity Catalog table |
Run setup from the package's Software/MATLAB directory. It is interactive — follow the prompts to configure the host URL, authentication method, cluster ID, and Databricks Connect library installation.
The Databricks Connect library is not shipped with the package — setup downloads it via pip (from PyPI or an internal Artifactory) into a Python virtual environment under Software/MATLAB/Connect/<version>/venv/. This requires Python 3.10–3.12 and pip to be available.
If the Databricks Connect library download fails repeatedly, do not retry with modified arguments — ask the user to check with their IT team whether the required version of databricks-connect is available in their organization's Python package repository.
cd('/path/to/databricks-package/Software/MATLAB')
setup
After setup completes, MATLAB's pyenv must point to the venv Python — not the system Python. If getDatabricksSession fails with "databricks.connect package is not installed", switch pyenv:
terminate(pyenv);
pyenv(Version="/path/to/databricks-package/Software/MATLAB/Connect/17.3/venv/bin/python");
Warning: If Python has already been loaded in-process (ExecutionMode is "InProcess"), terminate(pyenv) will fail. A full MATLAB restart is required to switch pyenv in this case. Do not attempt to switch pyenv mid-session after Python has been used — it will not work and may disconnect the MCP server. Instead, ask the user to restart MATLAB, then set pyenv to the venv path before calling any Python-dependent functions.
Then run startup to add the package paths to MATLAB. This must also be run at the beginning of each new MATLAB session:
startup
Then verify connectivity:
spark = getDatabricksSession();
T = table(spark.range(1));
disp(T)
If this returns a 1-row table with column id = 0, authentication and compute are working.
Authentication uses the .databrickscfg file — an INI-format configuration file located in the user's home directory (~/.databrickscfg). It stores the Databricks workspace URL, authentication credentials, and cluster ID. The file supports multiple named profiles so you can switch between workspaces or auth methods.
OauthU2M (recommended for interactive use) — requires only host. Note: OauthU2M opens a browser for login and requires pasting a redirect URL back into MATLAB. It does not work in non-interactive contexts (scripts, batch mode, MCP tools). Use OauthM2M or PAT for automation:
[DEFAULT]
host = https://<workspace-url>
cluster_id = <cluster-id>
OauthM2M (for service principals / automation) — requires host, client_id, client_secret:
[M2M]
host = https://<workspace-url>
client_id = <service-principal-client-id>
client_secret = <service-principal-secret>
cluster_id = <cluster-id>
PAT (simple but may be disabled by admins) — requires host and token:
[PAT]
host = https://<workspace-url>
token = <personal-access-token>
cluster_id = <cluster-id>
Specifying the auth method: When authMethod is not passed, getDatabricksSession uses a chain that tries methods in order until one succeeds — this may not pick what the user expects (e.g., it may trigger an OauthU2M browser prompt even if a PAT token is configured). Always ask the user which auth method they want and pass it explicitly:
spark = getDatabricksSession(authMethod="PAT");
spark = getDatabricksSession(authMethod="OauthU2M");
spark = getDatabricksSession(authMethod="OauthM2M");
To use a named profile other than [DEFAULT]:
spark = getDatabricksSession(profileName="M2M", authMethod="OauthM2M");
Environment variables override config file values:
| Variable | Overrides |
|----------|-----------|
| DATABRICKS_HOST | host |
| DATABRICKS_TOKEN | token |
| DATABRICKS_CLUSTER_ID | cluster_id |
| DATABRICKS_CLIENT_ID | client_id |
| DATABRICKS_CLIENT_SECRET | client_secret |
spark = getDatabricksSession();
Uses the default profile's cluster_id. The cluster starts automatically if stopped (takes 3-5 minutes for a cold start).
To target a specific cluster:
spark = getDatabricksSession(cluster="0812-091301-zntwkr4b");
Serverless sessions don't require a cluster_id — they start instantly with a 10-minute inactivity timeout:
spark = getDatabricksSession(serverless=true);
To make serverless the default for a profile, remove the cluster_id and set serverless_compute_id:
updateClusterId("serverless");
Or configure .databrickscfg directly:
[DEFAULT]
host = https://<workspace-url>
serverless_compute_id = auto
Serverless requires Python 3.11–3.12 and Databricks Connect client >= 15.4.
Data stays on the cluster until explicitly collected. Filter server-side first, then collect.
spark = getDatabricksSession();
DF = spark.read().table("catalog.schema.sensor_readings");
filtered = DF.filter("temperature > 100 AND event_date > '2024-01-01'");
filtered.printSchema;
filtered.show(5);
T = table(filtered);
Use .filter() for conditional filtering and .limit() for taking the first N rows:
spark = getDatabricksSession();
DF = spark.read().table("catalog.schema.large_table");
filtered = DF.filter("status = 'active' AND created_date > '2024-01-01'");
limited = filtered.limit(1000);
T = table(limited);
withColumn requires a matlab.pyspark.sql.column.Column object — not a scalar or string. Use col() to reference existing columns and lit() for constants:
import matlab.pyspark.sql.functions.col
import matlab.pyspark.sql.functions.lit
DF = spark.read().table("catalog.schema.measurements");
DF2 = DF.withColumn("temp_fahrenheit", col("temp_celsius") * lit(9/5) + lit(32));
DF3 = DF2.withColumn("source", lit("sensor_array"));
Do not pass raw MATLAB scalars or strings to withColumn — it will error. Always wrap values in lit().
Use spark.read.format().load() for CSV, Parquet, or JSON files stored on Volumes:
spark = getDatabricksSession();
% CSV with header
DF = spark.read.format("csv").option("header", "true").load("/Volumes/catalog/schema/volume/data.csv");
% Parquet
DF = spark.read.format("parquet").load("/Volumes/catalog/schema/volume/data.parquet");
% JSON
DF = spark.read.format("json").load("/Volumes/catalog/schema/volume/data.json");
After loading, use the same filter/select/collect workflow as with tables.
DF_new = matlab.sparkutils.table2dataset(T, spark);
Write to a Volumes path as Parquet:
DF_new.write.mode("overwrite").format("parquet").save("/Volumes/catalog/schema/volume/output_data");
Write to a Unity Catalog table:
DF_new.write.mode("overwrite").format("delta").saveAsTable("catalog.schema.output_table");
Always specify .mode() — without it, writes fail if the target already exists. Options: "overwrite", "append", "ignore", "error" (default).
If a session becomes unresponsive after inactivity:
clear spark
spark = getDatabricksSession(forceNewSession=true);
The local Python version must match the Databricks runtime's Python version:
| Runtime | Python Version | Notes |
|---------|---------------|-------|
| 18.x | 3.12 | Supports serverless and classic |
| 17.3 | 3.12 | Supports serverless and classic |
| 16.4 LTS | 3.12 | Supports serverless (>= 16.4.1) and classic |
| 15.4 LTS | 3.11 | Supports serverless (>= 15.4.10) and classic |
| 14.3 LTS | 3.10 | Classic only |
| 13.3 LTS | 3.10 | Classic only |
Check with:
pe = pyenv;
disp(pe.Version)
table(DF) — pulling millions of unfiltered rows wastes bandwidth and memory"catalog.schema.table"getDatabricksSession() — never construct Spark sessions manually or mimic PySpark builder patternsforceNewSession=true when a session becomes stale, not clear all.databrickscfg or environment variables| Mistake | Why It's Wrong | Correct Approach |
|---------|---------------|-----------------|
| Manually building JDBC URLs with Simba driver params | Bypasses the package entirely; fragile and insecure | Use getDatabricksSession() for Spark or databricks.JDBCConnection for SQL |
| Inventing PySpark-like builder: databricks.spark.Session.builder().remote() | These classes do not exist in MATLAB | Use getDatabricksSession() which returns databricks.PySparkSession |
| Hardcoding tokens in source code | Security risk; tokens expire and rotate | Store credentials in .databrickscfg or environment variables |
| Calling table(DF) on unfiltered large tables | Transfers entire dataset to local MATLAB memory | Apply .filter() / .select() / .limit() first, then collect |
| Passing scalars to withColumn: DF.withColumn("x", 2) | Second argument must be a Column object | Use DF.withColumn("x", lit(2)) or DF.withColumn("x", col("y") * lit(2)) |
| Writing without .mode(): DF.write.save(path) | Fails if target exists (default mode is "error") | Use .mode("overwrite") or .mode("append") before .save() or .saveAsTable() |
| Using databricks.SCIM.me to verify auth | Deprecated API | Verify with spark = getDatabricksSession(); table(spark.range(1)) |
| Calling getDatabricksSession() without authMethod when user has PAT configured | Default chain tries methods in order and may trigger OauthU2M browser prompt instead of using PAT | Ask the user which auth method they want and pass authMethod="PAT" explicitly |
| Passing a DataFrame as an argument to a chained method: DF.unionAll(DF2) | The MATLAB Spark wrapper's bracket method only supports dot-chaining, not methods that take DataFrame arguments | Use spark.sql() with a SQL UNION ALL query instead, or if the data is small enough, collect both DataFrames to MATLAB tables, manipulate locally, and push back with table2dataset |
| Mismatched Python version | Session creation fails with version error | Match local Python to runtime version (e.g., 3.12 for runtime 17.3) |
| PAT token missing scopes | 403 "does not have required scopes: clusters" | Regenerate the PAT with All access or at minimum the clusters scope enabled |
| cluster_id not set error | .databrickscfg has no cluster_id for the active profile | Run updateClusterId("your-cluster-id") or add cluster_id to the profile manually |
----
Copyright 2026 The MathWorks, Inc.
----
> FHIR REST endpoints (Patient, Observation, Encounter, Condition, MedicationRequest), (2) Validating FHIR resources and returning proper HTTP status codes and error responses, (3) Implementing SMART on FHIR authorization and OAuth scopes, (4) Working with Bundles, transactions, batch operations, or search pagination. Covers FHIR R4 resource structures, required fields, value sets (status codes, gender, intent), coding systems (LOINC, SNOMED, RxNorm, ICD-10), and OperationOutcome error handling.
Interact with ClawDirect, a directory of social web experiences for AI agents. Use this skill to browse the directory, like entries, or add new sites. Requires ATXP authentication for MCP tool calls. Triggers: browsing agent-oriented websites, discovering social platforms for agents, liking/voting on directory entries, or submitting new agent-facing sites to ClawDirect.
Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.
Opt out of the OneCLI gateway and supply Anthropic credentials from .env instead. For users who want simple .env-based credential management without the OneCLI agent vault. Reads the API key or OAuth token from .env and injects it into the container's API requests.
Cross-product Zoom reference skill. Use after the workflow is clear when you need shared platform guidance, app-model comparisons, authentication context, scopes, marketplace considerations, or API-vs-MCP routing.
>- Static source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /triage.
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).
> Use this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.
Take matlab/matlab-connect-databricks-spark from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.