Snowflake MCP Server: Cortex Agents, SQL, RBAC

Overview

Snowflake MCP Server implements the Model Context Protocol (MCP) for Snowflake environments, enabling developers to run Cortex Agents, execute SQL and semantic view queries, manage persisted objects, and enforce fine-grained role-based access control (RBAC). It acts as a bridge between model-driven agents and Snowflake data assets, exposing a stable HTTP API that agents and client apps can use to request context, run queries, and operate against semantic views and metadata.

This server is useful when you want to build AI-enabled workflows that interact with Snowflake data while preserving authorization, auditability, and centralized policy enforcement. By combining Cortex Agent orchestration, SQL execution, and RBAC enforcement, the MCP server lets you embed models in data workflows safely and operationally: agents can retrieve context, run bounded queries, and produce actions without exposing raw credentials or bypassing governance.

Features

• Cortex Agents hosting and orchestration via MCP-compatible endpoints
• Run SQL queries against Snowflake with server-side execution and result streaming
• Query and materialize semantic views (embedding/semantic index integration)
• Object management (upload/download objects, store metadata, manage embeddings)
• RBAC enforcement integrated with Snowflake roles and server-side policies
• Full authentication and authorization support (tokens / mTLS / external identity)
• Audit logging and provenance tracking for agent actions and SQL runs
• Deployable as Docker container or within Kubernetes

Installation / Configuration

Prerequisites:

• Access to a Snowflake account with credentials/keys and appropriate privileges
• Docker (for quick start) or Go toolchain (if running from source)
• Network access from the MCP host to Snowflake

Quick start (Docker)

# pull the MCP server image (example)
docker pull snowflake-labs/mcp:latest

# run with an env file providing Snowflake credentials and server config
docker run --env-file .env -p 8080:8080 snowflake-labs/mcp:latest

Example .env (replace placeholders)

MCP_LISTEN_ADDR=0.0.0.0:8080
SNOWFLAKE_ACCOUNT=myaccount.region
SNOWFLAKE_USER=mcp_service_user
SNOWFLAKE_PRIVATE_KEY_PATH=/secrets/sf_key.pem
SNOWFLAKE_ROLE=MCP_ROLE
SNOWFLAKE_DATABASE=MY_DB
SNOWFLAKE_SCHEMA=PUBLIC
AUTH_JWKS_URL=https://auth.example.com/.well-known/jwks.json
RBAC_POLICY_FILE=/config/rbac_policies.yaml

Run from source (Go)

git clone https://github.com/Snowflake-Labs/mcp.git
cd mcp
# build
go build ./cmd/mcp
# run with config file
./mcp --config config/mcp.yaml

Example config (YAML)

server:
  listen: ":8080"
snowflake:
  account: "myaccount.region"
  user: "mcp_service_user"
  private_key_path: "/secrets/sf_key.pem"
  database: "MY_DB"
  schema: "PUBLIC"
auth:
  jwks_url: "https://auth.example.com/.well-known/jwks.json"
rbac:
  policy_file: "/config/rbac_policies.yaml"
logging:
  level: info

Available Resources

The MCP server typically exposes a RESTful MCP surface. Common endpoints and their purpose:

Client tools:

• HTTP API for automation and agents
• Optional CLI wrapper for common operations (ship with repo or build your own)

Authentication and RBAC:

• Supports JWT/OIDC token validation (via JWKS)
• Can be configured to use mTLS for service-to-service auth
• RBAC policies map MCP actions to Snowflake roles and server-side permissions (policy files in YAML/JSON)

Use Cases

1. Natural-language data assistant using Cortex Agent

• User asks a question; frontend issues a request to MCP /mcp/agents.
• MCP validates the caller, runs a Cortex Agent chain that queries semantic views and executes SQL as needed, then returns a composed answer with provenance. Example (curl)

curl -X POST https://mcp.example.com/mcp/agents \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"agent":"nlq", "prompt":"Show sales trend by region last quarter","max_steps":3}'

2. Programmatic SQL execution with enforced RBAC

• Applications execute parameterized queries through /mcp/sql rather than using Snowflake credentials directly. MCP maps the request to a Snowflake role and enforces limits (time, rows). Example SQL request

curl -X POST https://mcp.example.com/mcp/sql \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"sql":"SELECT region, SUM(amount) FROM sales WHERE date >= ? GROUP BY region", "params":["2025-01-01"]}'

3. Semantic view lookups and embedding-backed search

• Agents call /mcp/semantic-views to resolve entity context or search using vector embeddings stored or managed by the MCP server.

4. Object lifecycle and auditability

• Upload data artifacts or embeddings to /mcp/objects, tag them with metadata, and control access via RBAC. All operations are auditable for compliance.

When to use MCP Server

• You need