Snowflake MCP, Snowflake's managed MCP server
Snowflake's own server lets Claude, ChatGPT and Cursor query your Snowflake data, search documents and ask Cortex Agents.
This is Snowflake's own server, built into your Snowflake account. An admin sets it up and picks what it offers, such as Cortex Agents, document search, semantic views and SQL queries. Each account gets its own address, and the assistant can only reach what the signed-in person's roles allow. Snowflake now recommends it over its older Labs server.
Good for
- Data teams who want business users to ask questions of Snowflake in plain English
- Analysts who query tables from Claude, ChatGPT or Cursor
- Snowflake admins who control access with roles and grants
Works in
2 supported · 2 with issues · 9 should work
Tap an app to see how to set it up and any known problems.
Add the URL and OAuth client ID and secret to ~/.cursor/mcp.json, then sign in under Cursor Settings. docs.snowflake.com
Snowflake names VS Code as a confidential OAuth client; register all its callback URLs on the integration. docs.snowflake.com
Add a custom connector with the server URL and OAuth client ID and secret. Claude.ai uses the same steps.
Known problems
- Open
Snowflake sign-in succeeds, then Claude reports the client is invalid and never connects
Workaround: Check the integration's network policy allows Claude's IPs; the same server works from Claude Code.
Since May 2026 · GitHub
- Closed
Connection fails after sign-in: blocked role ALL, or server not found with the legacy account URL
Workaround: Use the org-account URL and grant USAGE on the server, database and schema. Some users also turned on secondary roles, which widens access.
Reported Mar 2026 · GitHub
Turn on developer mode, create a connector with the server URL, choose OAuth and enter the client ID and secret.
Known problems
- Open
Agent tools time out or return nothing while direct SQL tools work
Workaround: A user suggests capping search results and narrowing the agent's tools.
Since Jun 2026 · community.openai.com
Not in Snowflake's docs, but users report the same server connects from Claude Code.
Known problems
- Closed
Sign-in fails with an invalid client error although the client ID and secret are correct
Workaround: Allow Claude's outbound IPs in the integration's network policy and use a PUBLIC client with PKCE.
Reported Jul 2026 · GitHub
Supports hosted MCP servers.
Supports hosted MCP servers.
Supports hosted MCP servers.
Supports hosted MCP servers.
Supports hosted MCP servers.
Supports hosted MCP servers.
Supports hosted MCP servers.
Supports hosted MCP servers.
Client does not support this transport.
Install Snowflake-managed MCP
Claude Code
- 1
Copy this prompt.
Add the Snowflake-managed MCP server to Claude Code. Run this command: claude mcp add --transport http snowflake https://<account_url>/api/v2/databases/<database>/schemas/<schema>/mcp-servers/<name> --client-id <CLIENT_ID> Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires A Snowflake MCP server created by an admin, OAuth security integration set up as a PUBLIC client (client ID only).
Read-only mode: Snowflake has no account-wide read-only switch. Leave the SQL execution tool at its default read_only: true (SELECT only) and grant the sign-in role only the objects it should read.
Snowflake's docs do not cover Claude Code, but users report it connects. Claude Code cannot pass a client secret at sign-in, so use a PUBLIC integration with PKCE, and allow Claude's outbound IPs if your account has a network policy. Each Snowflake account has its own server URL: replace <account_url>, <database>, <schema> and <name> with yours, and use hyphens instead of underscores in the host name. An admin creates the server first with CREATE MCP SERVER <database>.<schema>.<name> FROM SPECIFICATION $$ ... $$ (needs the CREATE MCP SERVER privilege and USAGE on the schema). Then they create an OAuth security integration (CREATE SECURITY INTEGRATION ... TYPE = OAUTH, CONFIDENTIAL for clients that hold a secret, PUBLIC with PKCE for Claude Desktop) and read the client ID and secret with SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<INTEGRATION_NAME>'). Set its redirect URI to the one your client shows. Grant USAGE on the MCP server to the role people sign in with, plus a grant for each tool: USAGE on the Cortex Search service or agent, SELECT on the semantic view, USAGE on a function or procedure. If your account has a network policy, allow the client's outbound IPs, or sign-in can fail with invalid_client.
From its listing on github.com. Source.
Tools
We don't list Snowflake-managed MCP's tools here yet. After you connect it, ask your assistant "What can you do with Snowflake-managed MCP?" to see them.
Pros and cons
Good
- Built and supported by Snowflake, and it replaces the deprecated Labs server.
- Runs inside your account, with no separate server to host.
- Uses your existing roles and grants, and each tool needs its own grant.
- No separate charge for the server itself.
- Can expose Cortex Agents, Cortex Search, semantic views, SQL and your own procedures.
Watch out
- Each account has its own server address, and you create the server yourself.
- An admin has to set up sign-in in Snowflake first, because apps cannot register themselves.
- Claude.ai and Claude Desktop sign-in has open reports of invalid client errors.
- Up to 50 tools per server.
- SQL and custom tool replies are cut at 250 KB.
- SQL and custom tools use warehouse credits, and Cortex tools use AI Credits.
Permissions
medium risk · 5 things to watch
Medium risk
The assistant can do whatever the signed-in person's Snowflake roles allow, and that can include roles beyond their default one. Use a dedicated role, keep the SQL tool read-only, and leave secondary roles off unless your client will not connect without them.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
Your role decides what the assistant can do
The server acts as the signed-in user's role. Custom procedure tools, or SQL with read_only set to false, can change data if that role can. Use a dedicated role with only the grants you want. docs.snowflake.com
Secondary roles can widen what it can do
Snowflake recommends leaving secondary roles off, but some Claude users only connected after turning them on, and one then saw a DELETE run under a read-only default role. If you turn them on, check every role the signing-in user holds. barazany.dev
Tool hints do not enforce anything
The read-only and destructive hints only inform the client. Match privileges on the underlying objects to what each tool does. docs.snowflake.com
SQL next to an agent skips its rules
Putting the SQL tool on the same server as a Cortex Agent lets clients bypass the agent's governance. Use a separate server for direct SQL. docs.snowflake.com
Do not grant the access role to PUBLIC
Grant the MCP access role only to people who need it, and use OAuth instead of hardcoded tokens. docs.snowflake.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Turning on read-only | The SQL tool allows only SELECT unless you set read_only: false. Agents, search and custom procedures run with the signed-in role's grants, so use a role that only has SELECT and USAGE on what each tool needs. |
|---|---|
| Sign-in and keys | Snowflake OAuth through a security integration; External OAuth such as Okta or Entra ID can be bound instead. |
Alternatives
Use the Snowflake-managed server, not the Labs server that Snowflake has deprecated. If you cannot create objects in your Snowflake account, the community nsphung server runs on your computer for SQL queries and schema browsing.
| Server | Status | Official | Runs | Sign-in | Stars |
|---|---|---|---|---|---|
| Snowflake-managed MCP ServerThis page | Current | Official | Hosted | Account | – |
| Snowflake Labs MCP Server (deprecated) | Deprecated | Official | Local | – | 303 |
| nsphung/mcp-snowflake-server | – | Community | Local | – | 2 |
| snowflake-generic-mcp | – | Community | Local | – | 3 |
What people say
People like that it is Snowflake's supported route and dislike how hard the Claude sign-in is to get working.
What people like
- Snowflake staff steer users to it as the first-class option over the Labs server.
- It now covers generic text-to-SQL as well as Cortex tools.
Common complaints
- Connecting Claude's web connector took one user a month, with a hard-to-find redirect URI and silent role failures.
- Claude.ai and Claude Desktop sign-in failures have blocked some company rollouts.
- Network policies can block sign-in and show up as a misleading invalid client error.
- ChatGPT users hit permission errors early on and later agent calls that time out.
In their words
“FYI - We are encouraging our users to try Snowflake-managed MCP server as it is first class to Snowflake.”sfc-gh-twhiteBlogDec 2025
“It took me a month to connect Snowflake to Claude's web connector.”GitHub issueMar 2026
“This is also blocking our rollout of Claude across our organization.”RHayes-IHSGitHub issueApr 2026
“FWIW, we were able to fix our issue by giving the MCP role `USAGE` access to the MCP server, database, and schema.”dweaver33
Questions
What is the Snowflake MCP server URL?
There is no single public URL. You create the server in your account with CREATE MCP SERVER, and each account gets its own address. Use hyphens instead of underscores in the hostname.
Does the Snowflake MCP server cost extra?
No. Snowflake lists no charge for the server itself. You pay for what the tools use: AI Credits for Cortex Agents, Analyst and Search, and warehouse credits for SQL and custom tools.
Can the assistant change or delete my data?
The SQL tool allows only SELECT by default. Custom procedure tools, or SQL set to allow writes, can change data if the signed-in role has those privileges.
Can a read-only role still write through secondary roles?
Yes, if secondary roles are on. Snowflake leaves them off by default, but some Claude setups only connect with them on, and one user saw a DELETE run that way. Sign in as a user whose roles are all limited to what the assistant should do.
Why does Claude say "invalid client" when my credentials are right?
A network policy may be blocking the token request from Claude's servers, so add Claude's outbound IPs to the policy on the security integration. Also grant the role USAGE on the server, database and schema, and use the org-account URL. For Claude Code, a PUBLIC client with PKCE avoids needing a secret.
Why does Claude.ai sign in to Snowflake and then fail?
It is a known open bug in Claude.ai and Claude Desktop, and users say the same server works from Claude Code. Check the network policy and role grants first, then try Claude Code.
Why can I connect but not use any tools?
Access to the server does not give access to the tools. Each tool needs its own grant, such as USAGE on the search service or agent, or SELECT on the semantic view.
Should I still use the Snowflake Labs MCP server?
No. Snowflake deprecated it and asks all users to move to the Snowflake-managed server.
Does it work with PrivateLink accounts?
Yes, with a setting. Snowflake says to use the public MCP URL and set USE_PRIVATELINK_FOR_AUTHORIZATION_ENDPOINT to TRUE.
Which Snowflake edition do I need?
The MCP docs name no edition requirement. Cortex Search and Cortex Analyst are listed for all editions.
Examples
Ask a Cortex Analyst semantic view a business question in plain English
Using the revenue semantic view, what were total sales by region last quarter?
Search documents indexed by a Cortex Search service
Search the support docs for articles about password reset errors and summarize the top three.
Hand a question to an existing Cortex Agent
Ask the sales agent which accounts have open renewals this month and why they might churn.
Run a read-only SQL query
Show me the 10 most recent rows in ANALYTICS.PUBLIC.ORDERS.
Information
updated Nov 1, 2026
- Publisher
- Official
- Transport
- Streamable HTTP
- Auth
- OAuth
Other Snowflake MCP servers
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 11Hide
- Snowflake-managed MCP server · docs.snowflake.com
- claude mcp login fails with OAuth invalid_client against Snowflake-managed MCP server, despite verified-valid credentials · github.com
- CREATE MCP SERVER · docs.snowflake.com
- Unrecognized option "--verbose" · github.com
- Connecting Snowflake to Claude · barazany.dev
- Snowflake Connector Issue in Claude AI · github.com
- Cortex pricing · docs.snowflake.com
- Claude Desktop Enterprise - Snowflake MCP Connector - MCP Client Invalid Error · github.com
- Snowflake-Labs/mcp · github.com
- Snowflake editions · docs.snowflake.com
- MCP connector and Snowflake managed MCP · community.openai.com