# Snowflake (official)

> Snowflake-managed MCP servers — Cortex Analyst, Cortex Search, and gated SQL, with RBAC and masking enforced by Snowflake.

[Canonical HTML page](https://top-mcps.com/mcp/snowflake-mcp-server) · [server.json](https://top-mcps.com/mcp/snowflake-mcp-server.json) · [methodology](https://top-mcps.com/about/methodology)

## Install

### Claude Desktop — `claude_desktop_config.json`

Paste under mcpServers. Fully quit and reopen Claude after editing.

```json
{
  "mcpServers": {
    "snowflake-mcp-server": {
      "command": "CREATE",
      "args": [
        "MCP",
        "SERVER",
        "<name>",
        "FROM",
        "SPECIFICATION",
        "$$",
        "…",
        "$$;",
        "then",
        "point",
        "your",
        "client",
        "at",
        "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
      ]
    }
  }
}
```

### Claude Code — `CLI or .mcp.json`

Run from your repo. Commit .mcp.json to share with your team.

```shell
claude mcp add snowflake-mcp-server -- CREATE MCP SERVER <name> FROM SPECIFICATION $$ … $$; then point your client at https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>
```

### Cursor — `.cursor/mcp.json`

Global path: ~/.cursor/mcp.json. Reload window after editing.

```json
{
  "mcpServers": {
    "snowflake-mcp-server": {
      "command": "CREATE",
      "args": [
        "MCP",
        "SERVER",
        "<name>",
        "FROM",
        "SPECIFICATION",
        "$$",
        "…",
        "$$;",
        "then",
        "point",
        "your",
        "client",
        "at",
        "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
      ]
    }
  }
}
```

### VS Code — `.vscode/mcp.json`

VS Code uses the "servers" key (not "mcpServers").

```jsonc
{
  "servers": {
    "snowflake-mcp-server": {
      "command": "CREATE",
      "args": [
        "MCP",
        "SERVER",
        "<name>",
        "FROM",
        "SPECIFICATION",
        "$$",
        "…",
        "$$;",
        "then",
        "point",
        "your",
        "client",
        "at",
        "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
      ]
    }
  }
}
```

### Windsurf — `~/.codeium/windsurf/mcp_config.json`

Open via Cascade → hammer icon → Configure.

```json
{
  "mcpServers": {
    "snowflake-mcp-server": {
      "command": "CREATE",
      "args": [
        "MCP",
        "SERVER",
        "<name>",
        "FROM",
        "SPECIFICATION",
        "$$",
        "…",
        "$$;",
        "then",
        "point",
        "your",
        "client",
        "at",
        "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
      ]
    }
  }
}
```

### Cline — `cline_mcp_settings.json`

Open via the Cline sidebar → MCP Servers → Edit.

```json
{
  "mcpServers": {
    "snowflake-mcp-server": {
      "command": "CREATE",
      "args": [
        "MCP",
        "SERVER",
        "<name>",
        "FROM",
        "SPECIFICATION",
        "$$",
        "…",
        "$$;",
        "then",
        "point",
        "your",
        "client",
        "at",
        "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
      ]
    }
  }
}
```

### Continue — `~/.continue/config.json`

Continue uses modelContextProtocolServers with a transport block.

```json
{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "CREATE",
          "args": [
            "MCP",
            "SERVER",
            "<name>",
            "FROM",
            "SPECIFICATION",
            "$$",
            "…",
            "$$;",
            "then",
            "point",
            "your",
            "client",
            "at",
            "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
          ]
        }
      }
    ]
  }
}
```

### Codex CLI — `~/.codex/config.toml`

Codex uses TOML. Each server is a [mcp_servers.<name>] subtable.

```shell
# ~/.codex/config.toml
[mcp_servers.snowflake-mcp-server]
command = "CREATE"
args = [
  "MCP",
  "SERVER",
  "<name>",
  "FROM",
  "SPECIFICATION",
  "$$",
  "…",
  "$$;",
  "then",
  "point",
  "your",
  "client",
  "at",
  "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>",
]
```

### Zed — `~/.config/zed/settings.json`

Zed calls them "context_servers". Settings live-reload on save.

```jsonc
{
  "context_servers": {
    "snowflake-mcp-server": {
      "command": {
        "path": "CREATE",
        "args": [
          "MCP",
          "SERVER",
          "<name>",
          "FROM",
          "SPECIFICATION",
          "$$",
          "…",
          "$$;",
          "then",
          "point",
          "your",
          "client",
          "at",
          "https://<account_url>/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<name>"
        ]
      }
    }
  }
}
```

### ChatGPT — `ChatGPT → Apps directory`

Snowflake (official) doesn't ship a hosted HTTPS endpoint today. ChatGPT supports remote MCP servers only — to use this server in ChatGPT you'll need to deploy it to a public HTTPS URL first (e.g. via Cloudflare Workers or Vercel) or wait for an official remote build.

```none

```

## At a glance

- **Maintainer:** Snowflake
- **Transport:** Streamable HTTP
- **Auth model:** OAuth 2.1
- **Required secrets:** None
- **Supported clients:** Claude, Claude Code, Cursor, CrewAI, Any remote-MCP client with OAuth
- **License:** Proprietary
- **Latest version:** remote
- **Last verified:** 2026-09-05
- **Score:** 55/100 (rubric 2026-09 — see https://top-mcps.com/about/methodology)
- **Homepage:** https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp

## Security & scope

- **Access scope:** read-write
- **Sandbox:** Hosted by Snowflake inside the account. Authorisation is Snowflake OAuth (or a programmatic access token) resolving to a real Snowflake role, so every tool call is evaluated against that role's privileges, row-access policies, and masking policies. No credentials leave the account and no local process runs.
- **Gotchas:**
  - SYSTEM_EXECUTE_SQL exposes arbitrary SQL under the caller's role — include it only when the roles that can reach the server are ones you would hand a SQL console.
  - A GENERIC tool runs your own UDF or stored procedure, so its blast radius is whatever that procedure does, not what the MCP layer allows.
  - MCP server objects are not replicated in failover groups; a failover leaves agents pointing at an endpoint that no longer exists.
  - Responses from SQL and generic tools are truncated at 250 KB, so a broad query returns a silently partial answer rather than an error.

## Quick answer

**What it does.** Serves a named set of Snowflake tools over an authenticated HTTP endpoint hosted by Snowflake. The server object's YAML specification decides which of the five tool types are exposed and against which objects; every call is then subject to the caller's role, row-access policies, and masking policies.

**Best for:**
- Cortex Analyst natural-language querying
- Cortex Search over unstructured data
- Governed agent access with RBAC and masking
- Publishing UDFs and stored procedures as agent tools
- Data teams standardising which tools agents may call

**Not for:**
- Developers without CREATE MCP SERVER privilege
- Government-region accounts
- Servers needing more than 50 tools
- Responses larger than 250 KB from SQL or generic tools

## Description

Snowflake-managed MCP servers are a generally available Snowflake feature, not a package you install. You declare one as an account object with `CREATE MCP SERVER … FROM SPECIFICATION`, listing exactly which tools it exposes, and clients connect to it at `https://<account_url>/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{name}` over Snowflake OAuth. Five tool types are available: CORTEX_AGENT_RUN, CORTEX_ANALYST_MESSAGE, CORTEX_SEARCH_SERVICE_QUERY, SYSTEM_EXECUTE_SQL, and GENERIC for your own UDFs and stored procedures.

## Why it matters

It is the only Snowflake MCP path where governance is enforced by Snowflake rather than by whoever configured the client. A community server holds a connection with one role's privileges; a managed server resolves privileges per caller, applies the same masking policies as any other query, and is administered with the SQL your data team already uses. Anthropic, Cursor, and CrewAI were launch partners.

## Key features

- Generally available Snowflake feature, hosted by Snowflake
- Declared as SQL DDL: CREATE MCP SERVER … FROM SPECIFICATION
- Five tool types including Cortex Agent, Analyst, and Search
- Snowflake OAuth (recommended) or programmatic access tokens
- RBAC, row-access, and masking policies enforced on every call

## FAQ

### Where do I get the endpoint URL?

You build it from the server object you create: https://<account_url>/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{name}. There is no single shared URL — each server is an object in your own account, which is why this entry has no fixed endpoint to copy.

### What are the five tool types?

CORTEX_AGENT_RUN, CORTEX_ANALYST_MESSAGE, CORTEX_SEARCH_SERVICE_QUERY, SYSTEM_EXECUTE_SQL, and GENERIC for user-defined functions and stored procedures. The specification you pass to CREATE MCP SERVER decides which of them the server exposes and against which objects.

### What privileges are needed?

CREATE MCP SERVER to create one. To call it, a user needs USAGE on the server plus the privilege each tool requires — SELECT on a semantic view, USAGE on an agent or function, and so on. That per-tool split is the point: the server is a publishing surface, not a bypass.

### What are the limits?

Fifty tools per server, responses from SQL and generic tools truncated at 250 KB, a maximum recursion depth of ten invocations, and MCP server objects are not replicated in failover groups. The feature is not supported in government regions.

### OAuth or a token?

Snowflake documents both and recommends OAuth, which is what MCP clients negotiate natively. Programmatic access tokens work as a bearer credential where OAuth is impractical, with the usual caveat that a PAT is a long-lived secret someone has to store.

### How does this compare to the community Snowflake MCP?

Different jobs. The community server (isaacwasserman, 185 stars, GPL-3.0) is a stdio process you run yourself with one role's credentials — nothing to provision, no admin involved, plain SQL and schema tools. This one is an account object your data team publishes, with Cortex tools and per-caller policy enforcement. Both are listed.

### Is this the same as Snowflake-Labs/mcp?

No, and that difference matters: Snowflake-Labs/mcp is deprecated and its README now points users here. If a search result sends you to that repository, this is what it is redirecting you to.

## Changelog

- **2026-09-05** — Refreshed install snippets and fact sheet; verified for 2026.
- **2025-10-01** — Initial directory listing.