Skip to main content
Glama
sfc-gh-tjia

Snowflake MCP Server

by sfc-gh-tjia
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

General-Purpose Snowflake MCP Server

A secure Model Context Protocol (MCP) server that provides AI assistants with safe, efficient access to your Snowflake data warehouse. Execute SQL queries, analyze data, and get insights through natural language interactions.

For more detail information and example usages, reference the Blog.

Python License: MIT

Key Features

  • 🔐 Multiple Authentication: Password, private key, and SSO support

  • 🛡️ Security First: Environment-based config, no hard-coded credentials

  • ⚡ Performance Optimized: Configurable limits and efficient query execution

  • 🔍 Smart Error Handling: Detailed messages with troubleshooting guidance

  • 📊 Rich Query Results: Formatted tables with metadata and row counts

  • 🧠 AI-Ready: Natural language to SQL through MCP protocol

  • 🏗️ Universal Compatibility: Works with any MCP-compatible AI client

Quick Start

1. Install

git clone https://github.com/sfc-gh-tjia/snowflake-generic-mcp.git
cd snowflake-generic-mcp
python -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate
pip install -r requirements.txt

2. Configure

cp .env.example .env
nano .env  # Add your Snowflake credentials

3. Test

npx @modelcontextprotocol/inspector python snowflake_mcp_server.py

Configuration

Environment Variables

Required:

SNOWFLAKE_ACCOUNT=your-account-identifier  # e.g., abc12345.us-east-1.snowflakecomputing.com
SNOWFLAKE_USERNAME=your-username

Authentication (choose one):

# Option 1: Password
SNOWFLAKE_PASSWORD=your-password

# Option 2: Private Key (recommended)
SNOWFLAKE_PRIVATE_KEY_PATH=/path/to/rsa_key.p8
SNOWFLAKE_PRIVATE_KEY_PASSPHRASE=passphrase  # optional

# Option 3: SSO
SNOWFLAKE_AUTHENTICATOR=externalbrowser

Optional:

SNOWFLAKE_WAREHOUSE=your_warehouse
SNOWFLAKE_DATABASE=your_database
SNOWFLAKE_SCHEMA=your_schema
SNOWFLAKE_ROLE=your_role
SNOWFLAKE_MAX_ROWS=100

Private Key Setup (Recommended)

  1. Generate key pair:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

  1. Add public key to Snowflake:

ALTER USER your_username SET RSA_PUBLIC_KEY='your-public-key-content';

AI Tool Integration

Connect the MCP server to your AI assistant for natural language database interactions.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "snowflake": {
      "command": "/opt/homebrew/bin/uv",
      "args": ["--directory", "/path/to/your/project", "run", "snowflake_mcp_server.py"]
    }
  }
}

Cursor

Option 1: Project-specific in Cursor Settings → Tools & Integration → MCP tools
Option 2: Global config in ~/.cursor/mcp.json

{
  "mcpServers": {
    "snowflake": {
      "command": "/opt/homebrew/bin/uv", 
      "args": ["--directory", "/absolute/path/to/your/project", "run", "snowflake_mcp_server.py"]
    }
  }
}

Example Usage

Once connected, you can interact with your Snowflake data using natural language:

"What tables are available in my database?"
"Show me the schema of the users table"
"Find all customers who made purchases this month"
"Analyze sales trends for Q4"
"Help me optimize this slow query"
"Count records in each table"
"Show me the top 10 customers by revenue"

The server handles:

  • Query execution with proper formatting and metadata

  • Error handling with helpful troubleshooting suggestions

  • Security logging for dangerous operations

  • Performance limits to prevent resource exhaustion

Security Best Practices

⚠️ IMPORTANT SECURITY NOTICE: This server executes raw SQL queries on your Snowflake instance. Always follow these security practices:

  1. Use private key authentication instead of passwords

  2. Create dedicated Snowflake user with minimal permissions:

CREATE USER mcp_user PASSWORD = 'secure_password';
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO USER mcp_user;
GRANT USAGE ON DATABASE your_db TO USER mcp_user;
GRANT SELECT ON ALL TABLES IN SCHEMA your_db.public TO USER mcp_user;

  1. Secure private keys: chmod 600 /path/to/rsa_key.p8

  2. Use environment variables - never hard-code credentials

  3. Use project-specific configurations for sensitive environments

  4. ⚠️ SQL Injection Risk: This server executes any SQL query provided by AI assistants. Ensure:

    • Your Snowflake user has minimal required permissions

    • No admin or elevated privileges for the MCP user

    • Consider using read-only access for sensitive environments

    • Monitor query logs for unexpected operations

  5. Network Security: Ensure proper firewall rules and VPN access if required

Troubleshooting

Common Issues

Environment Variables Not Set:

  • Check .env file format (no quotes, no spaces around =)

  • Set variables in shell profile for global access

Connection Errors:

  • Verify account identifier format (include region if needed)

  • Check network connectivity and warehouse status

  • Verify credentials and permissions

Authentication Failures:

  • For private key: Ensure public key is set in Snowflake

  • For SSO: Test browser login first

  • Check if user account is locked

Path Issues:

  • Use absolute paths in configuration files

  • Verify paths with which uv or which python

Debug Mode

Server Logs:

export MCP_LOG_LEVEL=DEBUG
python snowflake_mcp_server.py

Client Logs:

  • Claude Desktop: ~/Library/Logs/Claude/mcp*.log

  • Cursor: Output panel → "MCP Logs"

License

MIT License - see LICENSE file for details.

Available Tools

1 tool
execute_snowflake_sql_queryA
Execute any SQL query on Snowflake.

⚠️  SECURITY WARNING: This tool executes raw SQL queries on your Snowflake instance.
Ensure proper user permissions and network security. Consider query restrictions
for production environments.

Args:
    query: The SQL query to execute (required)
    database: Override the default database (optional)
    schema: Override the default schema (optional)
    warehouse: Override the default warehouse (optional)

Returns:
    Formatted string containing query results or error message
ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
databaseNo
schemaNo
warehouseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively warns about security risks, permissions, and network considerations, and mentions that it returns formatted results or error messages. However, it lacks details on rate limits, query execution limits, or specific error handling, which holds it back from a perfect score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear purpose statement, security warning, and parameter/return sections. It is appropriately sized and front-loaded, but the security warning could be more concise, and some sentences are slightly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of executing SQL queries and the lack of annotations, the description does a good job covering purpose, security, parameters, and returns. With an output schema present, it doesn't need to detail return values, but it could benefit from more context on error scenarios or performance implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0%, so the description must compensate. It lists all four parameters with brief explanations (e.g., 'override the default'), adding meaningful context beyond the schema. However, it does not provide examples or detailed constraints, such as valid formats for database names, preventing a score of 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as 'Execute any SQL query on Snowflake,' which specifies the verb (execute) and resource (SQL query on Snowflake). However, since there are no sibling tools, it cannot differentiate from alternatives, preventing a score of 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a security warning that implies usage in secure contexts and suggests considering restrictions for production, but it does not explicitly state when to use this tool versus alternatives or provide clear exclusions. The guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev1.0.0
    • First observedexecute_snowflake_sql_query
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of ambiguity or overlap between tools. The single tool has a clear and distinct purpose: executing SQL queries on Snowflake.

Naming Consistency5/5

The single tool name 'execute_snowflake_sql_query' follows a clear verb_noun pattern. Since there is only one tool, consistency is inherently perfect with no deviations or mixed conventions.

Tool Count2/5

A single tool for a Snowflake server feels too thin for the apparent scope, as it only provides raw SQL execution without any higher-level operations like listing tables, managing schemas, or handling data workflows. This is a borderline case leaning toward under-scoped.

Completeness2/5

The tool surface is severely incomplete for a Snowflake domain, lacking CRUD/lifecycle coverage. There are significant gaps such as no tools for browsing databases, tables, or schemas, and no support for common operations like data loading or user management, which will likely cause agent failures.

Resources

Related MCP Connectors