What Block's Use of DataHub's MCP Server Shows About AI Agents in Data Governance
Photo by Polina Zimmerman on Pexels
Block connected its open-source Goose agent to DataHub's MCP server so that engineers can ask an agent for metadata context: what depends on a broken table, who owns it, where a field comes from. The pattern rests on an open protocol and open-source tools, so other organizations can try it without a large platform commitment. It also shows where the line between agent and human currently sits.
Revised October 25, 2026, to match what DataHub and Block have published about this setup. An earlier version overstated how autonomously the agents act.
The Governance Execution Gap
Data governance policies get written and approved, then applied unevenly. The gap between intent and execution grows with every new platform, warehouse and pipeline. The problem is mostly structural: teams do not have the time to trace lineage, find owners and check policies by hand every time something changes.
Metadata catalogs hold much of that context already. The hard part is getting it to people at the moment they need it, such as during an incident at 2 a.m.
The Integration Problem MCP Addresses
Enterprise data ecosystems are federations: warehouses, streaming platforms, transformation tools, observability and access control, each with its own API and metadata model. An AI agent faces the same fragmentation a human analyst does.
The Model Context Protocol (MCP) is an open standard for connecting agents to tools. A catalog that exposes an MCP server lets any MCP-compatible agent search metadata, read lineage and look up ownership without a custom connector for each agent.
What Block Describes
According to DataHub's write-up, Block manages more than 50 data platforms under strict financial compliance requirements. DataHub's follow-up post says that before the integration, engineers spent hours during incidents on routine questions such as tracing dependencies across platforms and finding stakeholders. With Goose connected to DataHub's MCP server, they can ask for that context in conversation. DataHub describes three uses:
- Incident response: which downstream assets and teams a failing table affects.
- Data discovery: finding the right dataset and its definition by asking in plain language.
- Impact analysis: what a proposed change would break before it ships.
Block has also written about how it runs MCP more broadly: it controls which models can call which tools, and marks tools as read-only or destructive so that destructive actions require a person to confirm them.
That is the important detail for governance. In this setup the agent gathers and explains context, and destructive actions wait for a person to confirm them.
Why the Pattern Matters
Photo by The catalog becomes useful at the moment of need. Lineage and ownership that already exist in a catalog get used during incidents and changes, not only during audits.
The agent works inside existing permissions. If the MCP server authenticates as the individual user rather than with a shared service account, the agent sees only what that user may see, and its queries can be logged like any other access. Check which way your platform does it.
Read before write is a sensible order. Starting with read-only tools (search, lineage, ownership) gives value with little risk. Write actions such as tagging or classification can come later, behind confirmation, once the read path is trusted.
Open standards keep options open. MCP is an open protocol, and DataHub and Goose are open-source, so the pattern can be tried without committing to one vendor.
What to Take From It
If you are evaluating catalog or governance platforms, add MCP support (or an equivalent agent interface) to the requirements, and ask how the platform enforces permissions and logging for agent access.
If you already run a catalog, the low-risk first step mirrors Block's: give engineers an agent that can read lineage and ownership during incidents. Keep changes to metadata with people, or behind explicit confirmation, until you have evidence the agent's suggestions are reliable.
The longer-term shift is that governance context stops living only in documents and starts showing up where work happens. That makes the catalog's quality matter more, not less: an agent can only surface the ownership and lineage that someone recorded.