Set up the Snowflake MCP server

Snowflake's managed MCP server lets AI agents query Snowflake data through Cortex AI services — Cortex Search for unstructured data, Cortex Analyst for natural-language SQL, and direct SQL execution against warehouses. This guide covers creating the MCP server object in Snowflake, configuring OAuth for MintMCP, and adding it as a remote MCP.

Prerequisites

• A MintMCP admin account
• A Snowflake account with ACCOUNTADMIN or SYSADMIN privileges
• At least one Cortex AI resource already created — a Cortex Search service, a semantic view, or a warehouse for SQL execution

Create the MCP server in Snowflake

1. Sign in to Snowsight and open a SQL worksheet.

2. Run the following SQL to create an MCP server. Replace the placeholders with your database, schema, and resource identifiers:

CREATE OR REPLACE MCP SERVER my_mcp_server
  FROM SPECIFICATION $$
    tools:
      - name: "search-tool"
        type: "CORTEX_SEARCH_SERVICE_QUERY"
        identifier: "MY_DB.MY_SCHEMA.MY_SEARCH_SERVICE"
        description: "Search unstructured documents in Snowflake"
        title: "Document Search"
      - name: "analyst-tool"
        type: "CORTEX_ANALYST_MESSAGE"
        identifier: "MY_DB.MY_SCHEMA.MY_SEMANTIC_VIEW"
        description: "Natural language queries against revenue data"
        title: "Revenue Analyst"
      - name: "sql-tool"
        type: "SYSTEM_EXECUTE_SQL"
        description: "Execute SQL queries against Snowflake"
        title: "SQL Execution"
        config:
          read_only: false
          query_timeout: 600
          warehouse: "MY_WAREHOUSE"
  $$;

Include only the tool types you need — remove any blocks that don't apply.

Tool type reference:

Tool type	What it does	Required resource
CORTEX_SEARCH_SERVICE_QUERY	Searches unstructured data	Cortex Search service
CORTEX_ANALYST_MESSAGE	Converts natural language to SQL	Semantic view (not semantic model)
SYSTEM_EXECUTE_SQL	Executes SQL queries directly	Warehouse
CORTEX_AGENT_RUN	Routes messages to a Cortex Agent	Cortex Agent

Create an OAuth security integration

1. Run the following SQL to register MintMCP as an OAuth client in Snowflake:

CREATE OR REPLACE SECURITY INTEGRATION mintmcp_oauth
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  ENABLED = TRUE
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://app.mintmcp.com/oauth/callback';

For an EU organization, set OAUTH_REDIRECT_URI to https://eu.mintmcp.com/oauth/callback instead.

2. Run the following query to retrieve the client credentials:

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('MINTMCP_OAUTH');

The result is a JSON object containing OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET. Copy both values — you'll need them when configuring MintMCP.

Grant access to the MCP server

Run the following SQL to grant your users' role access to the MCP server:

GRANT USAGE ON MCP SERVER MY_DB.MY_SCHEMA.my_mcp_server TO ROLE MY_ROLE;

Also grant access to the underlying Cortex resources so users can actually invoke the tools:

Resource type	Grant command
Cortex Search service	GRANT USAGE ON CORTEX SEARCH SERVICE MY_DB.MY_SCHEMA.MY_SEARCH_SERVICE TO ROLE MY_ROLE;
Semantic view	GRANT SELECT ON VIEW MY_DB.MY_SCHEMA.MY_SEMANTIC_VIEW TO ROLE MY_ROLE;
Warehouse	GRANT USAGE ON WAREHOUSE MY_WAREHOUSE TO ROLE MY_ROLE;

Get the server URL

Your MCP server URL follows this format:

https://<account_url>/api/v2/databases/<database>/schemas/<schema>/mcp-servers/<server_name>

To find your account URL, run:

SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() || '.snowflakecomputing.com';

Substitute the output into the URL template. For example:

https://myorg-myaccount.snowflakecomputing.com/api/v2/databases/MY_DB/schemas/MY_SCHEMA/mcp-servers/my_mcp_server

Use hyphens in the account URL, not underscores — underscores cause connection failures.

Sign in with SSO

If your Snowflake account uses an identity provider such as Okta or Microsoft Entra ID, members can connect through it instead of a Snowflake password. Pick one of two setups:

Setup	What members see	Use when
SAML SSO (SP-initiated)	Snowflake's login page, where they choose to sign in with the IdP	You already have a SAML integration and want the default Snowflake OAuth setup above
External OAuth	Your IdP's sign-in page directly, with no Snowflake login page	You want the IdP to issue the tokens MintMCP uses, and can register an app in the IdP

SAML SSO (SP-initiated)

When a member connects, MintMCP redirects them to Snowflake's login page to authorize the connection. If your account uses SAML SSO, members choose to sign in with the IdP on that page instead of entering a username and password, and Snowflake hands them off to your IdP.

Snowflake only shows the IdP sign-in option when your SAML integration has SP-initiated SSO enabled. If members see only username and password fields, a user with the ACCOUNTADMIN role can enable it:

1. Find the name of your SAML integration:

SHOW SECURITY INTEGRATIONS;

Look for the SAML2 integration in the results.

2. Check the integration's current settings:

DESC SECURITY INTEGRATION my_saml_integration;

SAML2_SNOWFLAKE_ACS_URL and SAML2_SNOWFLAKE_ISSUER_URL must use the same account URL format as your MCP server URL (https://<orgname>-<account_name>.snowflakecomputing.com), and must match the URLs configured in your IdP app. If they use the older regional format, update them in both Snowflake and the IdP, or SSO fails after the IdP redirects back to Snowflake.

3. Enable SP-initiated SSO and set the label Snowflake shows for your IdP:

ALTER SECURITY INTEGRATION my_saml_integration SET
  SAML2_ENABLE_SP_INITIATED = TRUE
  SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'Okta';

Replace my_saml_integration with your integration name and Okta with the name you want members to see on the login page.

4. Optionally, require members to re-authenticate with the IdP every time they use SP-initiated SSO, even with an active IdP session:

ALTER SECURITY INTEGRATION my_saml_integration SET SAML2_FORCE_AUTHN = TRUE;

5. If members already tried to connect, ask them to restart the connect flow from MintMCP. The login page now offers the IdP sign-in option, so accounts with password authentication disabled can connect through the IdP.

For the full list of SAML integration properties, see Snowflake's Configuring SAML 2.0 federated authentication guide.

External OAuth

With External OAuth, you bind the MCP server's schema to your IdP. Snowflake then advertises the IdP as the server's authorization server, so MintMCP sends members straight to the IdP and Snowflake accepts the access token the IdP issues. This setup replaces the mintmcp_oauth integration from Create an OAuth security integration for MCP servers in that schema. The steps below use Okta. For Microsoft Entra ID, see Snowflake's External OAuth for Entra ID guide.

1. In the Okta Admin Console, go to Applications > Applications > Create App Integration and create an OIDC - OpenID Connect Web Application with these settings:

   • Grant type: Authorization Code and Refresh Token
   • Sign-in redirect URIs: https://app.mintmcp.com/oauth/callback (US) or https://eu.mintmcp.com/oauth/callback (EU)
   • Assignments: the users or groups that should connect to Snowflake

   Copy the Client ID and Client Secret.

2. Go to Security > API > Authorization Servers and add an authorization server with your Snowflake account URL as the Audience, for example https://myorg-myaccount.snowflakecomputing.com.

3. On the authorization server, add a scope for each Snowflake role members use, in the format session:role:<ROLE_NAME> (for example session:role:MY_ROLE). Then add an access policy assigned to the app from step 1, with a rule that allows the Authorization Code grant.

4. From the authorization server's metadata, copy the Issuer and the jwks_uri value.

5. In Snowflake, create the External OAuth integration:

CREATE OR REPLACE SECURITY INTEGRATION external_oauth_okta
  TYPE = EXTERNAL_OAUTH
  ENABLED = TRUE
  EXTERNAL_OAUTH_TYPE = OKTA
  EXTERNAL_OAUTH_ISSUER = '<OKTA_ISSUER>'
  EXTERNAL_OAUTH_JWS_KEYS_URL = '<OKTA_JWKS_URI>'
  EXTERNAL_OAUTH_AUDIENCE_LIST = ('https://<orgname>-<account_name>.snowflakecomputing.com')
  EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub'
  EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name';

The sub claim in the Okta token must match the member's Snowflake LOGIN_NAME, since that's how Snowflake maps the token to a user.

6. Bind the schema that holds the MCP server to the integration, and advertise the role scopes you created in Okta:

ALTER SCHEMA MY_DB.MY_SCHEMA SET OAUTH_AUTHORIZATION_SERVER = external_oauth_okta;
ALTER SCHEMA MY_DB.MY_SCHEMA SET OAUTH_SCOPES_SUPPORTED = 'session:role:MY_ROLE';

The binding applies to every MCP server in the schema. You can also set it on the database or account, and Snowflake resolves it from schema to database to account.

7. Continue to Add Snowflake to MintMCP and use the Client ID and Client Secret from the Okta app.

Add Snowflake to MintMCP

1. In MintMCP, go to MCP store and open the Recommended servers tab.
2. Select Snowflake to open its configuration panel.
3. In Server URL, enter the URL from Get the server URL.
4. Open OAuth Client Advanced Settings and paste the Client ID and Client Secret:
   • With Snowflake OAuth (including SAML SSO), use OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET from the SYSTEM$SHOW_OAUTH_CLIENT_SECRETS output.
   • With External OAuth, use the client ID and secret from your IdP app.
5. Click Install.

Each member signs in to Snowflake the first time they use the server, so tool calls run under their own Snowflake identity and role.

Security considerations

• Store the client secret securely — anyone with it can impersonate your MintMCP instance to Snowflake's OAuth endpoint.
• Each user authenticates with their own Snowflake credentials, so tool calls execute with that user's RBAC permissions.
• Members who sign in through SSO or External OAuth go through your IdP, so its MFA and conditional access policies apply to the MintMCP connection too.
• With External OAuth, members can only assume the roles your IdP grants as session:role scopes, and removing a member from the Okta app stops them from getting new tokens.
• Granting USAGE on the MCP server does not automatically grant access to the underlying tools — grant USAGE or SELECT on each Cortex Search service, semantic view, or warehouse separately.
• Snowflake recommends OAuth over Programmatic Access Tokens (PATs) to reduce the risk of credential leakage.

Known setup issues

• Login page asks for a username and password but your account uses SSO: your SAML integration doesn't have SP-initiated SSO enabled, so Snowflake doesn't offer the IdP sign-in option. Turn it on with the SAML SSO (SP-initiated) steps in Sign in with SSO, or switch to External OAuth.
• invalid code verifier error when connecting — Snowflake network policies apply to OAuth token requests at the integration and account level regardless of any user-level policy, so a policy that blocks MintMCP's IP can surface as a code verifier error instead of a clear network error. Check the network policy attached to MINTMCP_OAUTH and the account-level policy for IP restrictions, then add MintMCP's IP range to the allowed list — contact enterprise@mintmcp.com to get it.

Next steps

• Add a remote MCP server — General guide for connecting remote MCP servers to MintMCP
• Tool customization — Control which Snowflake tools are visible to users