What it is
Snowflake's official MCP server runs inside your Snowflake account. You create it with a SQL statement (CREATE MCP SERVER ... FROM SPECIFICATION) and a YAML list of tools: Cortex Agents, Cortex Search services, Cortex Analyst over semantic views, SQL execution, and your own functions and procedures. The earlier community server in Snowflake-Labs/mcp is deprecated and points users here.
Clients connect to an account URL ending in /api/v2/databases/{db}/schemas/{schema}/mcp-servers/{name}, using Snowflake OAuth or external OAuth such as Okta or Entra ID. The server implements MCP protocol revision 2025-11-25, tools only, and since 20 August 2026 returns tools/call responses as an SSE stream, so clients must accept both JSON and event-stream replies.
Install
CREATE MCP SERVER (in Snowflake), then connect to https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>Our review
This is how a data team would design MCP if asked. Access to the server grants nothing on its own; every tool needs its own grant, SQL tools default to SELECT-only, and Snowflake explicitly advises against putting raw SQL on the same server as an agent because it lets a client route around the agent's guardrails. The tool annotations, such as readOnly or destructive, are labelled as hints and not security controls, which is a candour most vendors skip.
Setup is an admin job. There is no dynamic client registration, so each client needs its own OAuth security integration, and the docs specify a confidential client for Cursor and VS Code and a public PKCE client for Claude Desktop. Every user also needs a DEFAULT_WAREHOUSE or the session fails to start, which is the first support ticket a rollout will see.
The documented limits are tight enough to shape design. A server holds up to 50 tools, SQL and function responses are cut off at 250 KB, agent responses can pass 200 KB unless max_results is set, and recursion stops at 10 calls. MCP server objects are not replicated in failover groups, although their OAuth integrations are, so a disaster-recovery plan has to recreate them.
Cost is the part Snowflake leaves vague. There is no MCP line item, but each call spends warehouse time or Cortex consumption, and the docs warn that recursive agent setups can produce unbounded loops. A team budgeting for this should price it as extra warehouse load from a new class of user, because that is exactly what an agent is.
Where it earns its place
A data platform team at a retailer already using Cortex Analyst
Let finance ask revenue questions from Claude without direct table access
Expose one Cortex Agent backed by a semantic view as the only tool, granted to a finance role. Analysts get answers with the generated SQL; spend is warehouse time per question, so set a small warehouse and a query_timeout.
An analytics engineer in a 10-person data team
Run ad hoc SELECT queries from Cursor while building dbt models
A separate MCP server with only SYSTEM_EXECUTE_SQL, read_only left on, and a least-privileged role keeps exploratory queries away from the business-facing agent.
A head of data governance at a bank
Approve AI assistant access to customer data
Bind external OAuth to Entra ID, set OAUTH_USE_SECONDARY_ROLES to NONE and a restricted ALLOWED_ROLES_LIST, and never grant the access role to PUBLIC, all of which Snowflake's docs recommend.
Before you commit
- Setup
- Write a YAML spec, run CREATE MCP SERVER, grant USAGE, then create an OAuth security integration per client; documented clients are Claude.ai and Claude Desktop, ChatGPT developer mode and Cursor.
- Integrations
- Five tool types: CORTEX_AGENT_RUN, CORTEX_SEARCH_SERVICE_QUERY, CORTEX_ANALYST_MESSAGE, SYSTEM_EXECUTE_SQL and GENERIC for UDFs and stored procedures; up to 50 tools per server.
- Data and privacy
- Queries run under the user's Snowflake role and never leave the account except as tool responses to the client. Snowflake warns about tool poisoning from third-party servers; not yet FedRAMP assessed.
- Cost at scale
- No published MCP price; each call bills the chosen warehouse or Cortex service, and recursion is capped at 10 invocations to limit runaway agent loops.
- Limits
- 250 KB response cap for SQL and function tools, no resources or prompts, no dynamic client registration, no replication of server objects in failover groups.
What's good
- Per-tool grants and SELECT-only SQL by default
- Snowflake OAuth or your own identity provider
- Exposes Cortex Agents, Search and Analyst as tools
- Nothing to host; runs inside your Snowflake account
What's not
- No dynamic client registration; admin sets up each client
- Tools only; no MCP resources, prompts or sampling
- Server objects not replicated in failover groups
- Every call costs warehouse or Cortex credits
Best for
Snowflake customers who want governed agent access to warehouse data and Cortex services under existing roles.
Alternatives
Snowflake-managed MCP Server: common questions
- Is Snowflake-managed MCP Server worth it?
- Governance done properly for agents on Snowflake, paid for in admin hours and warehouse credits rather than a licence fee. We rate it 4.0 out of 5.
- How much does Snowflake-managed MCP Server cost?
- No separate MCP fee is published; tool calls run on your Snowflake warehouses and Cortex services, which bill as usual.
- What are the downsides of Snowflake-managed MCP Server?
- No dynamic client registration; admin sets up each client; tools only; no MCP resources, prompts or sampling; server objects not replicated in failover groups; every call costs warehouse or Cortex credits.
- Who is Snowflake-managed MCP Server best for?
- Snowflake customers who want governed agent access to warehouse data and Cortex services under existing roles.
- How much does Snowflake-managed MCP Server cost for a team or in production?
- No published MCP price; each call bills the chosen warehouse or Cortex service, and recursion is capped at 10 invocations to limit runaway agent loops.
- Is Snowflake-managed MCP Server safe for company data?
- Queries run under the user's Snowflake role and never leave the account except as tool responses to the client. Snowflake warns about tool poisoning from third-party servers; not yet FedRAMP assessed.
- What are the best Snowflake-managed MCP Server alternatives?
- The closest alternatives we have reviewed are ClickHouse MCP Server and MCP Toolbox for Databases.
Answers checked Oct 22, 2026.
Make Snowflake-managed MCP Server? Show this rating on your site
