Snowflake MCP: What It Actually Does (and How to Set It Up)

Snowflake MCP usually means the Snowflake-managed MCP server: a remote Model Context Protocol server that lives inside your Snowflake account and has been generally available since November 4, 2025. You define it with a CREATE MCP SERVER statement, choose which Cortex Agents, Cortex Analyst semantic views, Cortex Search services, SQL and custom tools it exposes, and connect Claude, ChatGPT, Cursor or any remote MCP client over OAuth, with Snowflake roles deciding what each person can reach.

It is the supported, first-party way to put Snowflake data in front of an AI tool, and the server carries no separate charge. Out of the box, it answers from data in Snowflake. I read Snowflake's docs, release notes, blog and GitHub on October 6, 2026, and each fact links to its source. For other databases, see our roundup of MCP servers for databases.

What does "Snowflake MCP" refer to?

Four Snowflake features carry the MCP name:

Snowflake CoWork is Snowflake's agent app for business users, announced on June 2, 2026 as the new name for Snowflake Intelligence, and is unrelated to Coworker. This guide covers the first row; tutorials that run uvx snowflake-labs-mcp use the deprecated project.

What tools does the Snowflake MCP server expose?

Snowflake supports five tool types, declared in the server's YAML specification, with up to 50 tools per server (Snowflake docs).

Snowflake recommends one Cortex Agent as the only client-facing tool for business questions, with raw SQL on a separate server and least-privileged role, because SQL on the same server bypasses the agent's semantic views and verified queries. Cortex Analyst supports semantic views here, not semantic models.

How do you set up the Snowflake MCP server?

Per Snowflake's MCP server guide and quickstart:

1. Build what the tools will call: a Cortex Agent, a semantic view or a Cortex Search service.
2. Run CREATE MCP SERVER with a YAML specification giving each tool a name, type, title, description and, for most types, a target object.
3. Create a dedicated access role and grant it USAGE on the server plus each tool's own privilege, such as USAGE on the agent or SELECT on the semantic view, since server access alone does not cover the tools.
4. Create an OAuth security integration: confidential for clients that keep a secret, such as Cursor, and public with PKCE for Claude Desktop. Limit it to the access role with ALLOWED_ROLES_LIST, keep OAUTH_USE_SECONDARY_ROLES at NONE, and read the client ID and secret with SYSTEM$SHOW_OAUTH_CLIENT_SECRETS.
5. Set each user's DEFAULT_ROLE to that role and give them a DEFAULT_WAREHOUSE, since sessions fail without one.
6. Copy the server URL, https://<account_url>/api/v2/databases/<database>/schemas/<schema>/mcp-servers/<name>, with hyphens rather than underscores in the hostname.

How do you connect Snowflake MCP to Claude, ChatGPT and Cursor?

Any remote MCP client takes the same URL, and our Claude MCP and ChatGPT MCP guides cover those clients in general.

Claude

Claude's directory lists a Snowflake connector made by Snowflake, added in November 2025. You can also add a custom connector, per Anthropic's help center: Customize > Connectors > Add custom connector on Pro and Max, or Organization settings > Connectors for a Team or Enterprise owner.

Choose Use your own OAuth client, enter the integration's client ID and secret, and set its redirect URI to the one Claude shows, typically https://claude.ai/api/mcp/auth_callback. Sessions run as the user's default role, since Claude requests the session:role:all scope, and any Snowflake network policy must allow Anthropic's outbound IP addresses.

Claude Code

Connectors added in claude.ai show up in Claude Code automatically when you sign in with that account (Claude Code docs), the simplest route.

Adding the server directly needs pre-configured credentials, because Snowflake has no dynamic client registration: claude mcp add --transport http --client-id YOUR_CLIENT_ID --client-secret --callback-port 8080 snowflake YOUR_SERVER_URL, then /mcp to sign in. The catch is the callback, http://localhost:8080/callback, which Snowflake accepts only if the integration sets OAUTH_ALLOW_NON_TLS_REDIRECT_URI to TRUE, a setting it recommends against. Snowflake's quickstart uses a programmatic access token as a Bearer header instead; keep any token on a least-privileged role.

Snowflake's Cortex Code plugin for Claude Code is a separate product, not the MCP server.

ChatGPT

Snowflake's guide uses developer mode with OAuth: your server URL, the client ID and secret, and the redirect URI ChatGPT displays. OpenAI's help center now calls these apps and offers developer mode to Business and Enterprise/Edu workspaces on the web, with full MCP support in beta. An admin turns developer mode on before anyone creates the app under Apps > Create.

Cursor

Add an mcpServers entry to ~/.cursor/mcp.json with the server URL and your client ID and secret read from environment variables, then click Sign in under Cursor Settings > MCP. Snowflake's Cursor plugin template uses a programmatic access token instead.

What are the permissions, limits and costs?

Snowflake OAuth is the default; External OAuth through Okta or Microsoft Entra ID and programmatic access tokens also work. Sessions run as the user's default role with secondary roles off, so Snowflake suggests separate servers per role when a client cannot request one.

Snowflake said at launch that the server carries no separate charge. Per its AI pricing page, Cortex Agents bill in AI Credits per million tokens, with costs adding up across the services they call. Generated SQL runs on your warehouse, and Cortex Search bills for serving and embedding compute. AI Credits list at $2.00 with global routing and $2.20 with regional routing.

Where does a Snowflake-only MCP server stop?

It answers from what is in Snowflake. Ask why renewals slipped in one region and it can return the numbers, but a reason sitting in a Slack thread, a ticket or a sales call stays invisible until someone brings that context into Snowflake.

Snowflake offers two ways, both set up by your admins. Openflow connectors ingest Slack messages, Jira Cloud data and Google Drive shared drive files, and the Slack and Drive connectors can feed Cortex Search. MCP connectors let a Cortex Agent call Atlassian, GitHub, Glean, Linear or Salesforce servers, with each user signing in to those services through Snowflake CoWork.

Running Snowflake MCP beside other servers adds three costs:

• One system per server. Each server answers about its own system, and the AI client joins the results inside the conversation.
• Context. Claude Code defers tool definitions with tool search, so most of the cost is in results. An agent reply can pass 200 KB, while Claude Code warns above 10,000 tokens of MCP output and caps it at 25,000 by default, so set max_results on the agent's search tool.
• Wiring per tool. Each Snowflake account needs its own server objects, OAuth integration, roles and network rules, and every other MCP server adds its own sign-in. Snowflake warns that unverified servers invite tool poisoning and tool shadowing.

Snowflake MCP server vs Coworker MCP: how do they compare?

They cover different parts of the same question.

Sources: Snowflake's MCP docs and AI pricing; Coworker's MCP, OM2 and connectors pages.

What should you check before connecting Snowflake MCP?

Snowflake's own guidance makes a good checklist:

• Start with one Cortex Agent per server, and leave read_only at true on any SQL server.
• Never grant the MCP role to PUBLIC or to all current and future tables just to make a client work.
• Prefer OAuth, and tie any programmatic access token to the least-privileged role that works.
• Review custom tools for side effects. Snowflake's own quickstart includes a stored procedure that sends email.
• Allow your clients' outbound IP addresses in network policies. A blocked token request can return invalid_client, which looks like a bad credential.
• Watch spend in the CORTEX_AGENT_USAGE_HISTORY view, and avoid agents that call back into themselves. Snowflake stops loops at 10 invocations.

Pilot with one team and one agent before widening access. Our guides to MCP security and enterprise MCP cover the wider risks.

Where does Coworker MCP fit?

If you only need Snowflake data inside Claude, ChatGPT or Cursor, Snowflake's first-party server is the simpler pick, and it runs on roles you already manage.

Coworker MCP covers the rest of the question. One connection gives Claude Code, Cursor, ChatGPT, Windsurf or any MCP client a single pipe to 50+ connected apps, Snowflake included. For large organizations, OM2 decomposes documents, messages and tickets into atomic facts, with customers, people, projects and deals as first-class nodes, and works as a portable context layer for the AI tools people already use. The OM2 launch post puts it simply: "You can think of OM2 as a context graph." Queries respect your existing permission model, and once an admin enables MCP access, people sign in with their existing Coworker login and SSO.

Run both: Snowflake MCP for the governed numbers, and Coworker MCP for the threads, tickets, calls and docs that explain them. In Coworker's 100-task benchmark, Claude with Coworker MCP and OM2 had 9x lower token cost and finished 64% faster than Claude with its native connectors in the best case, retrieval-heavy categories with Coworker Learning (75.5% cheaper and 45.6% faster across all 7 categories). Snowflake was not a tested source. Source: Statistically significant benchmarks comparing Coworker MCP vs. Claude Native Tooling, on the benchmarks page.

Book a demo to see it next to your Snowflake server, or ask for a Context Impact Report on your own data.

Frequently asked questions

Does Snowflake have an official MCP server?

Yes. The Snowflake-managed MCP server runs inside your Snowflake account and exposes Cortex Agents, Cortex Analyst, Cortex Search, SQL and custom tools to clients such as Claude, ChatGPT and Cursor. It entered preview on October 2, 2025 and became generally available on November 4, 2025.

Is the Snowflake-Labs MCP server still supported?

No. Snowflake deprecated the open-source Snowflake-Labs/mcp server on May 15, 2026, and its README says it is no longer maintained and points users to the Snowflake-managed MCP server.

Does the Snowflake MCP server cost extra?

Snowflake said at launch that the server carries no separate charge. You pay for what its tools use: AI Credits for Cortex Agents and Cortex Search, and warehouse compute for the SQL that runs.

Can the Snowflake MCP server write data?

Its SQL execution tool has a read_only setting that defaults to true, which allows only SELECT queries. Custom tools run whatever UDF or stored procedure you name, so a procedure that writes data or sends email gives the AI client that ability.

What are Snowflake MCP connectors?

They work in the opposite direction from the MCP server: MCP connectors let Snowflake CoWork, formerly Snowflake Intelligence, and Cortex Agents call remote MCP servers such as Atlassian, GitHub, Glean, Linear and Salesforce. Snowflake announced them as generally available on June 2, 2026.

Can I use Snowflake MCP and Coworker MCP together?

Yes. They are separate MCP servers, so one AI client can connect to both: Snowflake MCP for warehouse data, and Coworker MCP for context from 50+ connected apps such as Slack, Jira, Google Drive and Gong.

Related reading

• Coworker MCP
• Best MCP servers for databases
• Snowflake connector
• What is MCP?
• MCP security
• Enterprise MCP
• HubSpot MCP
• Glean MCP vs Coworker MCP
• What is a context layer?
• Organizational memory (OM2)