Snowflake AgentSAFE
MCP Server for Snowflake including Cortex AI, object management, SQL orchestration, semantic view consumption, and more
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[!CAUTION] This project is deprecated and no longer maintained. Please migrate to the official Snowflake MCP Server. The official server is actively developed, fully supported by Snowflake, and continues to add new features.
This community MCP server previously provided tooling for Snowflake Cortex AI, object management, and SQL orchestration. It is no longer supported. For all new and existing use cases, please use the official Snowflake MCP Server instead.
Legacy documentation (for reference only)
The MCP server supported the below capabilities:
- [Cortex Search](https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-search/cortex-search-overview): Query unstructured data in Snowflake as commonly used in Retrieval Augmented Generation (RAG) applications.
- [Cortex Analyst](https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-analyst): Query structured data in Snowflake via rich semantic modeling.
- [Cortex Agent](https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents): Agentic orchestrator across structured and unstructured data retrieval
- Object Management: Perform basic operations against Snowflake's most common objects such as creation, dropping, updating, and more.
- SQL Execution: Run LLM-generated SQL managed by user-configured permissions.
- [Semantic View Querying](https://docs.snowflake.com/en/user-guide/views-semantic/overview): Discover and query Snowflake Semantic Views
Getting Started
Service Configuration
A simple configuration file is used to drive all tooling. An example can be seen at services/configuration.yaml and a template is below. The path to this configuration file will
468cad51b0c4OBSERVED · 2026-10-05Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add snowflake-labs-mcp --env SNOWFLAKE_PASSWORD=${SNOWFLAKE_PASSWORD} --env SNOWFLAKE_PRIVATE_KEY=${SNOWFLAKE_PRIVATE_KEY} -- None snowflake-labs-mcp==${VERSION}Exposed tools (1)
0 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
run_snowflake_query | write | return run_query(statement, snowflake_service) |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (2)
.pre-commit-config.yaml
#### Can I use a Programmatic Access Token (PAT) instead of a password?
Gates applied: no_behavioural_pass.
468cad51b0c4full audit observations/trust-audit/mcp-server/snowflake-labs__snowflake-agent.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-05 | 468cad51b0c4 | SAFE | B | 89 | first audit |
Questions
What is the Snowflake Agent MCP server?
MCP Server for Snowflake including Cortex AI, object management, SQL orchestration, semantic view consumption, and more
What tools does Snowflake Agent expose?
1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Snowflake Agent safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Snowflake Agent need?
It reads SNOWFLAKE_PASSCODE, SNOWFLAKE_PASSWORD, SNOWFLAKE_PRIVATE_KEY, SNOWFLAKE_PRIVATE_KEY_FILE and SNOWFLAKE_PRIVATE_KEY_FILE_PWD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Snowflake Agent run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as snowflake-labs-mcp.
How current is this page?
The grade is for one exact copy of the source (468cad51b0c4), read on 2026-10-05. The repository is watched and re-audited when it changes.