Snowflake MCP Server – Governed Data Access

Snowflake-managed MCP Server exposes configured Snowflake tools through a hosted Model Context Protocol endpoint. AI agents can discover and invoke Cortex Analyst, Cortex Search, Cortex Agents, SQL execution, and approved custom tools while Snowflake RBAC and OAuth controls remain in force.

#snowflake#analytics#cortex

Overview

Snowflake-managed MCP Server is Snowflake's hosted Model Context Protocol interface for connecting AI agents to governed data and Snowflake Cortex capabilities. Instead of running a separate local server, teams create an MCP server object inside a Snowflake database and schema, define which tools it exposes, and point compatible MCP clients at the generated HTTPS endpoint.

What the MCP server enables

The server lets MCP clients discover and call Snowflake-defined tools using tools/list and tools/call. A server specification can expose Cortex Search services for retrieval over indexed text, Cortex Analyst over semantic views for natural-language analytics, Cortex Agents, SQL execution, and approved custom UDF or stored-procedure tools. Access to the MCP server itself does not automatically grant access to every tool: Snowflake documents separate privileges for the MCP server object and for underlying Cortex Search services, semantic views, Cortex Agents, UDFs, stored procedures, and warehouses.

When to use it

Use Snowflake-managed MCP when an assistant needs live access to enterprise data that already lives in Snowflake and should remain governed by Snowflake roles, warehouses, policies, and object permissions. Practical examples include letting an analyst ask questions over a semantic view through Cortex Analyst, retrieving policy or support-ticket context through Cortex Search, or exposing a tightly scoped stored procedure as an agent-callable business operation.

Connection and authentication

Snowflake provides a remote HTTPS MCP endpoint in the format https://<account_url>/api/v2/databases/<database>/schemas/<schema>/mcp-servers/<name>. The documented setup uses Snowflake OAuth: administrators create a Snowflake OAuth security integration, retrieve the client ID and secret, configure redirect URIs required by the chosen MCP client, and have users authenticate individually. Snowflake recommends OAuth over hardcoded tokens to reduce token leakage risk.

Key considerations

Snowflake-managed MCP is generally available but is not supported in government regions. The server currently supports tool capabilities only; Snowflake documents that resources, prompts, roots, notifications, version negotiation, lifecycle phases, and sampling are not supported. Only non-streaming responses are supported. Each MCP server can expose up to 50 tools, and generic tool and SQL execution responses are truncated at 250 KB. OAuth sessions use the connecting user's default role, secondary roles are not supported, and users need a default warehouse. If account network policies are enabled, allow the outbound IP addresses used by the MCP client provider.

Frequently Asked Questions

When should an AI agent use the Snowflake-managed MCP server?

Use it when an AI agent needs governed access to Snowflake data or Cortex capabilities without deploying a separate MCP server. It is suited for analytics, retrieval, Cortex Analyst semantic-view questions, Cortex Search lookups, and carefully scoped SQL or custom-tool workflows.

What does the Snowflake MCP server add to an AI agent's capabilities?

It gives an MCP client a standards-based way to discover and invoke tools backed by Snowflake objects. Depending on the server specification, those tools can include Cortex Search, Cortex Analyst, Cortex Agents, SQL execution, and generic UDF or stored-procedure tools.

What can the AI agent access or manage through this server?

The agent can access only the tools configured in the Snowflake MCP server object and only when the connecting user's role has the required privileges. Snowflake documents separate access requirements for the MCP server object and for underlying Cortex Search services, semantic views, Cortex Agents, UDFs, stored procedures, and warehouses.

How is authentication configured for Snowflake-managed MCP?

Snowflake documents OAuth 2.0 as the supported authentication method for MCP clients. Administrators create a Snowflake OAuth security integration, configure redirect URIs for the client, retrieve the client ID and secret with SYSTEM$SHOW_OAUTH_CLIENT_SECRETS, and users authenticate with their own Snowflake credentials.

Which transport should be used for Snowflake-managed MCP?

Use the hosted HTTPS remote MCP endpoint that Snowflake provides for the created MCP server object. The URL follows the Snowflake account, database, schema, and MCP server name path; no local stdio server is required for the managed Snowflake offering.