Evaluation record · mcp-server-snowflake

MCP Snowflake Server

vManaged MCP server (GA 2025-11-04); snowflake-labs-mcp 1.x (deprecated)

Snowflake (Official)

MCPdatabasedata-warehousesqlnl-to-sql

Strong

About This MCP

Official Snowflake MCP server, GA since 2025-11-04 as a fully managed in-account endpoint (CREATE MCP SERVER object). Exposes Cortex Analyst NL-to-SQL over semantic views, Cortex Search, Cortex Agents, SQL execution with configurable read-only mode, and custom UDF/procedure tools. OAuth 2.0 or Programmatic Access Token auth with per-tool RBAC; masking and data policies apply. The self-hosted snowflake-labs-mcp (PyPI) was deprecated in May 2026 in favor of the managed server.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

api reliability

Endpoint availability and GA-status review

Evidence

Snowflake-managed MCP server GA release note — Managed MCP server reached general availability on 2025-11-04 after an October 2025 preview; runs inside Snowflake's platform with no separate infrastructure, inheriting platform reliability (not supported in government regions)

highVerified: 2026-07-09

nl to sql accuracy

NL-to-SQL capability review; semantic-view grounding improves accuracy but accuracy still depends on semantic view quality

Evidence

Snowflake-managed MCP server documentation — Cortex Analyst tools translate natural language to SQL, constrained to semantic views (semantic models are not supported), which bounds hallucinated joins but limits coverage

mediumVerified: 2026-07-09

search retrieval quality

Retrieval capability assessment based on Cortex Search service documentation

Evidence

Snowflake Managed MCP Servers announcement — Cortex Search provides semantic search over unstructured documents as MCP tools, plus Cortex Knowledge Extensions for licensed third-party content

mediumVerified: 2026-07-09

sql execution

SQL tool feature review

Evidence

Snowflake-managed MCP server documentation — SQL execution tool supports configurable read-only mode, query timeout, and warehouse selection; custom tools via UDFs and stored procedures

highVerified: 2026-07-09

error handling

Failure-mode and limit documentation review

Evidence

Snowflake-managed MCP server documentation — Documented guardrails: 50 tools per server maximum, 250 KB response truncation for generic/SQL tools, and a recursion depth limit of 10 invocations

mediumVerified: 2026-07-09

🛡️Security

authentication security

Authentication mechanism review

Evidence

Snowflake-managed MCP server documentation — OAuth 2.0 via Snowflake security integrations is the recommended path; Programmatic Access Tokens supported with least-privilege role assignment; Snowflake advises OAuth over hardcoded tokens and network policies for client provider IPs

highVerified: 2026-07-09

access control

Access control model review; per-tool privilege separation is stronger than most MCP servers evaluated

Evidence

Snowflake-managed MCP server documentation — Per-tool RBAC: access to the MCP server object alone does not grant tool access — individual privileges are required per tool; standard Snowflake role-based access, masking, and data policies apply to all agent operations

highVerified: 2026-07-09

data modification control

Write-surface assessment; read-only mode plus RBAC scoping mitigates but writes to production data remain possible when enabled

Evidence

Snowflake-managed MCP server documentation — SQL execution tool offers a configurable read-only mode; when writes are enabled the agent can modify data within the session role's privileges, and OAuth sessions use only the user's DEFAULT_ROLE (secondary roles unsupported)

highVerified: 2026-07-09

prompt injection resilience

Prompt-injection exposure analysis; governed perimeter constrains impact but the generic MCP injection vector via returned data is unmitigated

Evidence

Snowflake Managed MCP Servers announcement — All operations occur within Snowflake's governed perimeter with masking and policies enforced server-side, limiting blast radius; however query results containing untrusted content still reach the LLM and no result-wrapping mitigation is documented

mediumVerified: 2026-07-09

credential management

Credential handling review

Evidence

Snowflake-managed MCP server documentation — Managed OAuth flow avoids long-lived credentials in client config; PATs are revocable and role-scoped; no connection strings or account passwords are placed in MCP client configuration

highVerified: 2026-07-09

🔒Privacy & Compliance

data residency

Data residency review

Evidence

Snowflake-managed MCP server documentation — MCP server runs inside the customer's Snowflake account and region; data does not leave Snowflake's perimeter for tool execution (not available in government regions)

highVerified: 2026-07-09

compliance certifications

Platform certification review

Evidence

Snowflake Trust Center — Underlying platform holds SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, FedRAMP and other certifications that extend to in-perimeter MCP execution

highVerified: 2026-07-09

data exposure to llm

Data flow analysis

Evidence

MCP Architecture — Query results, search hits, and semantic view metadata returned by tools are sent to the connected LLM provider — masking policies apply before egress but returned data is exposed per the client provider's terms

highVerified: 2026-07-09

governance policy enforcement

Governance enforcement review

Evidence

Snowflake Managed MCP Servers announcement — The same user and group access controls, masking, and data policies apply to agent access as to any other Snowflake access path — governance is enforced server-side, not by the MCP client

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

Snowflake Documentation — First-party documentation covering CREATE MCP SERVER YAML specification, tool types, auth setup, limits, and security guidance, maintained alongside the GA product

highVerified: 2026-07-09

open source transparency

Source availability review; scored down because the actively supported path is proprietary and the open-source path is end-of-life

Evidence

Snowflake-Labs/mcp repository — The managed MCP server is closed-source; the open-source Apache 2.0 snowflake-labs-mcp (292 stars) is deprecated and no longer maintained (final PyPI release 2026-05-15), with users directed to the managed server

highVerified: 2026-07-09

audit logging

Audit trail assessment

Evidence

Snowflake Access History — Agent-issued SQL and tool invocations run as governed Snowflake queries, appearing in query history and access history for audit

highVerified: 2026-07-09

community activity

Community engagement analysis

Evidence

snowflake-labs-mcp on PyPI — Community activity migrated from the deprecated labs repo to Snowflake's official support channels; managed-server feedback flows through Snowflake support rather than public issue trackers

mediumVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment

Evidence

Snowflake-managed MCP server documentation — Setup requires a CREATE MCP SERVER statement with a YAML tool specification plus an OAuth security integration or PAT — more admin steps than one-click hosted servers, but no infrastructure to run

highVerified: 2026-07-09

scalability

Scalability review

Evidence

Snowflake Warehouses — Tool execution scales on Snowflake virtual warehouses with per-tool warehouse selection; capacity is elastic and independent of the MCP endpoint

highVerified: 2026-07-09

cost efficiency

Cost analysis for agent-driven workloads

Evidence

Snowflake Cortex pricing — Agent queries consume warehouse credits and Cortex Analyst/Search incur Cortex consumption charges; costs of exploratory agent traffic can be material without resource monitors

mediumVerified: 2026-07-09

integration ecosystem

Ecosystem integration review

Evidence

Snowflake Managed MCP Servers announcement — Standards-based streamable HTTP endpoint works with Claude, Cursor, and other MCP clients; integrates the broader Cortex ecosystem including Knowledge Extensions (AP, Washington Post, NASDAQ, MSCI)

highVerified: 2026-07-09

managed operations

Operational burden assessment

Evidence

Snowflake Managed MCP Servers announcement — No separate infrastructure to deploy, patch, or monitor — the MCP endpoint is operated by Snowflake inside the customer account

highVerified: 2026-07-09

Strengths

+Fully managed, GA MCP endpoint inside the Snowflake account — no infrastructure to run
+Per-tool RBAC: server access alone does not grant tool access; masking and data policies enforced server-side
+OAuth 2.0 security integrations or revocable PATs — no passwords or connection strings in client config
+Cortex Analyst NL-to-SQL grounded in semantic views reduces hallucinated queries
+SQL execution tool with configurable read-only mode, query timeout, and warehouse selection
+Full audit trail via Snowflake query history and access history

Limitations

!Managed server is closed-source; the open-source snowflake-labs-mcp is deprecated (final release 2026-05-15)
!Query and search results are exposed to the connected LLM provider
!When the SQL tool's read-only mode is off, agents can write to production data within the role's privileges
!OAuth sessions use only the user's DEFAULT_ROLE; secondary roles unsupported
!Response truncation at 250 KB and 50-tool cap can constrain large workloads
!Cortex Analyst supports semantic views only (not semantic models); not available in government regions
!No documented result-wrapping or other prompt-injection countermeasure for untrusted data in results

Metadata

license: Proprietary (managed service); deprecated snowflake-labs-mcp was Apache 2.0

supported platforms

0: Any MCP client (remote streamable HTTP)

programming languages

0: N/A (managed service); Python (deprecated labs server)

mcp version: 1.0

github repo: https://github.com/Snowflake-Labs/mcp

github stars: 292

docs: https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp

remote endpoint: https://<account_url>/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{name}

api dependency: Snowflake Cortex (Analyst, Search, Agents), Snowflake SQL engine

authentication: OAuth 2.0 via Snowflake security integration (recommended); Programmatic Access Token

security controls

0: per-tool RBAC

1: SQL read-only mode

2: masking and data policies

3: network policies

4: query timeout and warehouse scoping

ga date: 2025-11-04

first release: 2025-10 (public preview); labs server early 2025

deprecated predecessor: snowflake-labs-mcp (PyPI), deprecated May 2026, final release 2026-05-15

maintained by: Snowflake

transport types

0: streamable-http (managed)

Use Case Ratings

code generation

Good for generating SQL and Snowflake object DDL against real schemas

customer support

Cortex Search over support content works well; guard customer PII exposure

content creation

Limited direct fit; useful for data-backed content via Cortex Search

data analysis

Primary use case: governed NL-to-SQL over semantic views plus warehouse-scale SQL

research assistant

Strong retrieval over enterprise documents with Cortex Search and Knowledge Extensions

legal compliance

Server-side masking, RBAC, and audit history support compliance workflows

healthcare

HIPAA-certified platform helps, but LLM exposure of results needs careful policy design

financial analysis

Governed access to financial marts with masking policies; strong audit trail

education

Good for teaching governed analytics, though account setup is enterprise-oriented

creative writing

Not a fit beyond retrieving reference data for narratives

Similar MCPs

MCP Databricks Managed Servers

Databricks (Official)

MCP PostgreSQL Server

Anthropic (Archived)

MCP Elasticsearch Server

Elastic

MCP MongoDB Server

MongoDB (Official)