MCP Snowflake Server NSP

A Snowflake MCP server — SQL queries, schema exploration, and data insights for AI assistants

AModel Context Protocol (MCP)server / MCP server that connects AI assistants to Snowflake — enabling SQL queries, schema exploration, and data insights directly from your LLM client.

- Multiple authentication methods: password, key-pair, external browser, OAuth 2.0 (client credentials & bearer token), TOML connection files
- TOML multi-connection config — manageproduction,staging, anddevelopmentenvironments in one file
- Write-safety guard — write operations are disabled by default and must be explicitly enabled
- Exclusion patterns — filter out databases, schemas, or tables from discovery
- --exclude-json-resultsflag — reduces LLM context window usage
- Selective tool exclusion via--exclude_tools
- Prefetch mode — pre-load table schema as MCP resources
- Docker support with hardened image (DHI, nonroot user, no shell in runtime)

- Snowflake MCP Server NSP

- Table of Contents
- Quick Start

- Claude Code
- Visual Studio Code (VSCode)
- OpenCode

- Resources
- Tools

- Query Tools
- Schema Tools
- Analysis Tools

- Password
- Key-Pair
- External Browser
- OAuth 2.0 Client Credentials
- OAuth Bearer Token
- TOML Connection File (Recommended)

# 1. Create a connections file cat > ~/snowflake_connections.toml << 'EOF' [myconn] account = "your_account" user = "your_user" password = "your_password" warehouse = "COMPUTE_WH" database = "MY_DB" schema = "PUBLIC" role = "MYROLE" EOF # 2. Run the server uvx --python=3.13 --from mcp-snowflake-server-nsp mcp_snowflake_server \ --connections-file ~/snowflake_connections.toml \ --connection-name myconn

Add to your MCP client config (e.g.claude_desktop_config.json) usingsnowflake_connections.toml:

"mcpServers": { "snowflake": { "command": "uvx", "args": [ "--python=3.13", "--from", "mcp-snowflake-server-nsp", "mcp_snowflake_server", "--connections-file", "/absolute/path/to/snowflake_connections.toml", "--connection-name", "myconn" ] } }

Or add manually to your MCP client config (e.g..vscode/mcp.json) using.envfile (seeAuthentication):

"snowflake": { // Snowflake MCP server "type": "stdio", "command": "uvx", "args": [ "--from", "mcp-snowflake-server-nsp", "--python=3.13", "mcp_snowflake_server" ], "envFile": "${workspaceFolder}/.env" }

Add to your MCP client config (e.g.opencode.jsonc) with.envfile (seeAuthentication):

"snowflake": { "type": "local", "command": [ "uvx", "--from", "mcp-snowflake-server-nsp", "--python=3.13", "mcp_snowflake_server", ], "enabled": true, "timeout": 300000, }

Set credentials via environment variables or CLI flags (seeConfiguration Reference):

SNOWFLAKE_USER="user@example.com" SNOWFLAKE_ACCOUNT="myaccount" SNOWFLAKE_AUTHENTICATOR="snowflake" SNOWFLAKE_PASSWORD="secret" SNOWFLAKE_WAREHOUSE="COMPUTE_WH" SNOWFLAKE_DATABASE="MY_DB" SNOWFLAKE_SCHEMA="PUBLIC" SNOWFLAKE_ROLE="MYROLE"

SNOWFLAKE_USER="user@example.com" SNOWFLAKE_ACCOUNT="myaccount" SNOWFLAKE_AUTHENTICATOR="snowflake_jwt" SNOWFLAKE_PRIVATE_KEY_FILE="/absolute/path/to/key.p8" SNOWFLAKE_PRIVATE_KEY_FILE_PWD="passphrase" # Optional — only if key is encrypted SNOWFLAKE_WAREHOUSE="COMPUTE_WH" SNOWFLAKE_DATABASE="MY_DB" SNOWFLAKE_SCHEMA="PUBLIC" SNOWFLAKE_ROLE="MYROLE"

SNOWFLAKE_AUTHENTICATOR="externalbrowser"

Use theOAuth 2.0 client credentials flowto authenticate with a client ID and secret (no user interaction required):

SNOWFLAKE_AUTHENTICATOR="oauth_client_credentials" SNOWFLAKE_ACCOUNT="myaccount" SNOWFLAKE_OAUTH_CLIENT_ID="your_client_id" SNOWFLAKE_OAUTH_CLIENT_SECRET="your_client_secret" SNOWFLAKE_OAUTH_TOKEN_REQUEST_URL="https://your-idp.example.com/oauth/token" SNOWFLAKE_OAUTH_SCOPE="session:role:MY_ROLE" # Optional SNOWFLAKE_WAREHOUSE="COMPUTE_WH" SNOWFLAKE_DATABASE="MY_DB" SNOWFLAKE_SCHEMA="PUBLIC" SNOWFLAKE_ROLE="MYROLE"

SNOWFLAKE_AUTHENTICATOR="oauth" SNOWFLAKE_ACCOUNT="myaccount" SNOWFLAKE_TOKEN="eyJhbGciOiJSUzI1NiJ9..." SNOWFLAKE_WAREHOUSE="COMPUTE_WH" SNOWFLAKE_DATABASE="MY_DB" SNOWFLAKE_SCHEMA="PUBLIC" SNOWFLAKE_ROLE="MYROLE"

Manage multiple environments in a single file. Seeexample_connections.tomlfor a full template.

[production] account = "your_account" user = "your_user" password = "your_password" authenticator = "snowflake" warehouse = "COMPUTE_WH" database = "PROD_DB" schema = "PUBLIC" role = "ACCOUNTADMIN" [development] account = "your_account" user = "dev_user" authenticator = "externalbrowser" warehouse = "DEV_WH" database = "DEV_DB" schema = "PUBLIC" role = "DEVELOPER" [reporting] account = "your_account" user = "reporting_user" authenticator = "snowflake_jwt" private_key_file = "/path/to/private_key.pem" private_key_file_pwd = "passphrase" # Optional warehouse = "REPORTING_WH" database = "REPORTING_DB" schema = "REPORTS" role = "REPORTING_ROLE" [analytics_oauth] account = "your_account" authenticator = "oauth_client_credentials" oauth_client_id = "your_client_id" oauth_client_secret = "your_client_secret" oauth_token_request_url = "https://your-idp.example.com/oauth/token" oauth_scope = "session:role:ANALYTICS_ROLE" # Optional warehouse = "ANALYTICS_WH" database = "ANALYTICS_DB" schema = "PUBLIC" role = "ANALYTICS_ROLE"

Pass the file with--connections-fileand select a profile with--connection-name. Both flags are required together.

The package is published onPyPI asmcp-snowflake-server-nsp.

Contributing or running from source?SeeCONTRIBUTING.mdfor local development setup, test commands, formatting, and building the Docker image from source.

"mcpServers": { "snowflake_production": { "command": "uvx", "args": [ "--python=3.13", "--from", "mcp-snowflake-server-nsp", "mcp_snowflake_server", "--connections-file", "/path/to/snowflake_connections.toml", "--connection-name", "production" // Optional flags — see Configuration Reference ] }, "snowflake_staging": { "command": "uvx", "args": [ "--python=3.13", "--from", "mcp-snowflake-server-nsp", "mcp_snowflake_server", "--connections-file", "/path/to/snowflake_connections.toml", "--connection-name", "staging" ] } }

"mcpServers": { "snowflake": { "command": "uvx", "args": [ "--python=3.13", "--from", "mcp-snowflake-server-nsp", "mcp_snowflake_server", "--account", "your_account", "--warehouse", "your_warehouse", "--user", "your_user", "--password", "your_password", "--role", "your_role", "--database", "your_database", "--schema", "your_schema" // Optional: "--private_key_file", "/absolute/path/key.p8" // Optional: "--private_key_file_pwd", "passphrase" // Optional flags — see Configuration Reference ] } }

The image is published onDocker Hub— no build step required:

docker pull nsphung/mcp-snowflake-server-nsp

"mcpServers": { "snowflake": { "command": "docker", "args": [ "run", "--rm", "-i", "--env-file", "/absolute/path/to/.env", "nsphung/mcp-snowflake-server-nsp" ] } }

"mcpServers": { "snowflake": { "command": "docker", "args": [ "run", "--rm", "-i", "-v", "/path/to/snowflake_connections.toml:/app/snowflake_connections.toml:ro", "nsphung/mcp-snowflake-server-nsp", "--connections-file", "/app/snowflake_connections.toml", "--connection-name", "production" ] } }

"snowflake": { "type": "stdio", "command": "docker", "args": [ "run", "--rm", "-i", "nsphung/mcp-snowflake-server-nsp" ], "envFile": "${workspaceFolder}/.env" }

"snowflake": { "type": "stdio", "command": "docker", "args": [ "run", "--rm", "-i", "-v", "/path/to/snowflake_connections.toml:/app/snowflake_connections.toml:ro", "nsphung/mcp-snowflake-server-nsp", "--connections-file", "/app/snowflake_connections.toml", "--connection-name", "production" ] }

"snowflake": { "type": "local", "command": [ "docker", "run", "--rm", "-i", "--env-file", "/absolute/path/to/.env", "nsphung/mcp-snowflake-server-nsp" ], "enabled": true, "timeout": 300000 }

All connection parameters can also be set as environment variables (SNOWFLAKE_<PARAM_UPPER>).

Editruntime_config.jsonto exclude databases, schemas, or tables from all discovery tools. Patterns are matched case-insensitively as substrings.

{ "exclude_patterns": { "databases": ["temp"], "schemas": ["temp", "information_schema"], "tables": ["temp"] } }

The server loads this file automatically at startup from the working directory.

This project is licensed under theMIT License. See theLICENSEfile for the full text.

This repository is a fork ofisaacwasserman/mcp-snowflake-server.

- Upstream authors and contributors retain copyright for their contributions.
- Fork-specific changes are maintained bynsphung.
- A summary of notable modifications is tracked inNOTICE.

A read-only MCP server for Avro data sources, powered by the CData JDBC Driver.