Snowflake

This connector bridges the Snowflake-managed MCP server, Snowflake's official MCP server that runs inside your Snowflake account. You create an MCP server object in a database and schema, and it serves the tools you define in it: Cortex Agents, Cortex Analyst semantic views, Cortex Search services, SQL execution, and your own UDFs and stored procedures. AnythingMCP connects with a programmatic access token (PAT) and puts those tools behind your MCP endpoint with OAuth for Claude and ChatGPT, per-tool roles, the audit log and response mapping, next to your other systems.

The tools come from your server object. The tools are whatever your MCP server object defines (at most 50 per server), under the names you gave them. At install AnythingMCP asks the server for its list, so you get exactly your tools. The five tools shown in the store are the examples from Snowflake's documentation, one per tool type; they are only used if the server cannot be reached at install. After changing the server object (CREATE OR REPLACE MCP SERVER with a new specification), open the connector and click Discover tools.

Setup (about 15 minutes, needs a Snowflake admin):

1. In a worksheet, create the server in the database and schema that should hold it. Snowflake recommends exposing a Cortex Agent for governed business questions:

CREATE OR REPLACE MCP SERVER analytics_db.mcp.business_mcp
  FROM SPECIFICATION $$
  tools:
    - name: "business_data_agent"
      type: "CORTEX_AGENT_RUN"
      identifier: "analytics_db.mcp.sales_agent"
      title: "Governed business data agent"
      description: "Use this agent for governed business data questions."
  $$;

The other tool types are CORTEX_ANALYST_MESSAGE (a semantic view), CORTEX_SEARCH_SERVICE_QUERY (a Cortex Search service), SYSTEM_EXECUTE_SQL (direct SQL, read_only: true by default) and GENERIC (a UDF or stored procedure, with an input_schema). 2. Create a least-privileged role and grant it only what the tools need: GRANT USAGE ON MCP SERVER analytics_db.mcp.business_mcp TO ROLE mcp_access;, USAGE on the database, schema and warehouse, USAGE on each agent, Cortex Search service, function or procedure, and SELECT on each semantic view (plus GRANT DATABASE ROLE SNOWFLAKE.CORTEX_AGENT_USER for agents). Access to the server does not give access to its tools: each tool needs its own grant. Grant the role to the user AnythingMCP connects as, ideally a service user (TYPE = SERVICE), and give that user a default warehouse. 3. Create the token, restricted to that role and with an expiry: ALTER USER mcp_service ADD PROGRAMMATIC ACCESS TOKEN amcp_token ROLE_RESTRICTION = 'MCP_ACCESS' DAYS_TO_EXPIRY = 90; and copy token_secret (Snowflake shows it once). In Snowsight the same is under Governance & security > Users & roles > the user > Programmatic access tokens > Generate new token, with One specific role. 4. Fill in the variables and install:

• SNOWFLAKE_ACCOUNT_HOST: the account host name without https://, for example myorg-myaccount.snowflakecomputing.com. Use hyphens, not underscores: a host such as myorg-my_account fails to connect, write myorg-my-account instead.
• SNOWFLAKE_DATABASE, SNOWFLAKE_SCHEMA and SNOWFLAKE_MCP_SERVER: where the server object lives and its name.
• SNOWFLAKE_PAT: the token from step 3, stored encrypted and sent as a Bearer token with X-Snowflake-Authorization-Token-Type: PROGRAMMATIC_ACCESS_TOKEN.

Network: by default a PAT only works for a user under a network policy, and that policy must allow the address AnythingMCP calls from (on AnythingMCP Cloud, ask support for the current egress IP): CREATE NETWORK RULE amcp_ingress MODE = INGRESS TYPE = IPV4 VALUE_LIST = ('<egress IP>'); then ALTER NETWORK POLICY <your_policy> ADD ALLOWED_NETWORK_RULE_LIST = ('amcp_ingress');.

Safety: the role is the real boundary, the AI sees whatever that role sees. Prefer a Cortex Agent or Cortex Analyst over raw SQL; Snowflake advises putting a SYSTEM_EXECUTE_SQL tool on a separate server with its own least-privileged role. The SQL execution example installs switched off here; if your server has such a tool, keep read_only: true in its config before you turn it on. Tools run on your warehouse and Cortex calls consume Snowflake credits. Revoke the token at any time with ALTER USER mcp_service REMOVE PROGRAMMATIC ACCESS TOKEN amcp_token;.

Working with it: ask an agent or Analyst tool a plain question in message (Cortex Analyst returns the SQL it generated); give a Cortex Search tool a query and a limit. Responses of SQL execution and custom tools are cut at 250 KB, so select fewer columns or rows; agent responses can be large because they include reasoning steps and citations. A 401 means the token is wrong or expired, or the network policy blocks the call; tools missing from the list mean the role lacks USAGE on the MCP server; a listed tool that fails means the role lacks the grant on the underlying object, or the user has no default warehouse.