Snowflake’s official MCP server is unusual in that it does not just hand a model a SQL connection. It exposes Cortex Analyst for semantic-model-backed questions, Cortex Search for unstructured retrieval, Cortex Agents for orchestration, plus object management and SQL execution gated by a permissions file you control.
Bring your own
Claude Sonnet 4.5
Chat with 60+ AI models on the same workflow — switch to a different model mid-conversation and re-run the same prompt, or use Compare mode to put several side-by-side and balance quality vs. cost.
Snowflake credentials — a programmatic access token or key-pair auth. The agent inherits the role you connect with, so create a dedicated one.
How models use it and what it is built for.
The server is configured by a service configuration file rather than by flags, and that file is where the interesting decisions live. You declare which Cortex Search services and which Cortex Analyst semantic models the agent may use, and you declare statement-level permissions for raw SQL — select, insert, update, delete, create, drop each allowed or refused independently. That design means a team can expose a governed, semantically modelled view of the warehouse instead of a bare connection. Cortex Analyst answers business questions against a semantic model, which sidesteps the usual failure mode of a model guessing at column meanings. Cortex Search covers RAG over unstructured data in Snowflake. Object management tools handle databases, schemas, warehouses, tables and roles. Everything runs through managed REST services, so there is no separate inference infrastructure to deploy.
Typical tools an AI model can call. Exact names vary by version.
Taken from the official Snowflake documentation — see Snowflake-Labs/mcp — official repository for the full reference.
Environment variables
SNOWFLAKE_ACCOUNTrequiredYour Snowflake account identifier.
SNOWFLAKE_USERrequiredUsername for a dedicated service user, not a person’s account.
SNOWFLAKE_PATrequiredA programmatic access token. Key-pair and other supported auth methods work too.
SNOWFLAKE_ROLERole to assume. This, not the config file, is the real security boundary.
SNOWFLAKE_WAREHOUSEWarehouse used to execute queries. Size it for agent traffic, with auto-suspend on.
Client configuration
uvx with a service configuration file
The service config declares which Cortex services are exposed and which SQL statement types are permitted.
{
"mcpServers": {
"snowflake": {
"command": "uvx",
"args": [
"--from", "snowflake-labs-mcp",
"mcp-server-snowflake",
"--service-config-file", "/path/to/tools_config.yaml"
],
"env": {
"SNOWFLAKE_ACCOUNT": "YOUR_ACCOUNT",
"SNOWFLAKE_USER": "AGENT_SERVICE_USER",
"SNOWFLAKE_PAT": "YOUR_TOKEN"
}
}
}
}Copy any of these into MCP Agent Studio after connecting.
What was revenue by region last quarter, and how does that compare to the quarter before?
Search our support transcripts for complaints about the new checkout flow.
Describe the schema of the ORDERS table and which warehouses query it most.
Which customers churned after a support ticket was escalated?
This is not a single-model product: you get the same MCP connection with 60+ models (Claude, GPT, Gemini, DeepSeek, open-weight, and more), you can switch mid-conversation, and you can open Compare mode to run the same prompt against multiple models at once. The card above is a suggested starting point for this server — not the only choice.
Default pick for Snowflake
Claude Sonnet 4.5
Warehouse questions are multi-step: pick the semantic model, ask, then sanity-check the numbers. Sonnet 4.5 does the last step, which cheaper models skip.
Listing tools proves the server is reachable, not that a model can work with it. Evals go further: they read every tool on the server, write a test suite from its real schemas, and run it — code decides pass/fail on the responses (schema conformance, error codes, pagination, result caps) while a scoring model grades plain-English tasks driven through the tools.
Get a pass/fail report per tool with the evidence behind each verdict — and replay the same suite after every schema change. Destructive tools are excluded from the run.
Run evalsOpen MCP Agent Studio with the connection pre-filled. Add your token, pick any of 60+ models, and start chatting — no install required.
Open Agent StudioCommon questions about connecting, scoping and using it safely.
It is Snowflake’s official MCP server, maintained at Snowflake-Labs/mcp. It exposes Cortex Search, Cortex Analyst, Cortex Agents, object management and governed SQL execution as MCP tools, all through managed Snowflake REST services.
Cortex Analyst answers questions against a semantic model you have defined — it knows what "revenue" means in your business. Raw SQL leaves the model to infer meaning from column names, which is where most wrong-but-plausible answers come from. Prefer Analyst where a semantic model exists.
Two layers. The service configuration file permits or refuses each SQL statement type independently, so you can allow select and refuse everything else. Underneath that, connect with a Snowflake role that has no write grants — that is the boundary that holds regardless of configuration.
No separate remote service. All the tools are managed services reached over REST, so the MCP server itself is the only process, and it runs wherever your client runs.
Point the agent at its own warehouse with a small size, aggressive auto-suspend and a resource monitor with a credit quota. An agent exploring a schema will issue more queries than a person, and the warehouse is where that shows up on the bill.