--- title: Snowflake’s Managed MCP Server: Giving AI Assistants a... description: Snowflake now lets you host an MCP server as a native schema-level object, so AI assistants like Claude, Cursor or ChatGPT can query a warehouse through... canonical: https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Snowflake’s Managed MCP Server: Giving AI Assistants a Governed Door Into Your Warehouse (Part 1) | daily.dev og:description: Snowflake now lets you host an MCP server as a native schema-level object, so AI assistants like Claude, Cursor or ChatGPT can query a warehouse through... og:url: https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs og:image: https://api.daily.dev/og/posts/g7QVTAYRs.png og:image:alt: Snowflake’s Managed MCP Server: Giving AI Assistants a Governed Door Into Your Warehouse (Part 1) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Snowflake’s Managed MCP Server: Giving AI Assistants a Governed Door Into Your Warehouse (Part 1) **[Snowflake Community](https://daily.dev/sources/snowflake_comm)** · 22 min read · 0 upvotes · 0 comments ## Summary Snowflake now lets you host an MCP server as a native schema-level object, so AI assistants like Claude, Cursor or ChatGPT can query a warehouse through governed tools instead of raw SQL access. The server exposes Cortex Agents, Cortex Analyst, Cortex Search, read-only SQL, and custom UDFs or procedures, with no container to run and access controlled purely by Snowflake RBAC. The author builds a working example with two separate servers, one exposing a Cortex Agent for business users and one exposing read-only SQL for engineers, since mixing them lets a model bypass the semantic view. Key gotchas: GENERIC procedure tools must return a single VARIANT, not a table, and PATs without a ROLE_RESTRICTION silently inherit secondary roles like DEFAULT_SECONDARY_ROLES = ALL, letting an unauthorized role list tools it wasn't granted. The limit is 50 tools per server, and tools/call responses now stream as Server-Sent Events as of August 20, 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does my GENERIC procedure tool fail when called over Snowflake's MCP server? GENERIC tools over Snowflake's managed MCP server expect a single cell result, so a procedure declared RETURNS TABLE fails with an error like 'expected a single cell result set, got 3 rows and 4 columns'. The fix is to change the procedure to RETURNS VARIANT and fold the result into one JSON value using ARRAY_AGG and OBJECT_CONSTRUCT, which is also easier for a model to read. _Developers wiring stored procedures into MCP tool calls can track fixes like this one on daily.dev._ ### Why can a Snowflake role access an MCP server tool it was never granted on? A role can list or call tools it wasn't granted when the caller's programmatic access token (PAT) has no ROLE_RESTRICTION and the user has DEFAULT_SECONDARY_ROLES = ALL, the default for new users. With secondary roles active, privileges are evaluated across every role granted to the user, so another role's ownership can quietly let the request through. The fix is creating PATs with a ROLE_RESTRICTION set to the intended MCP role, or setting DEFAULT_SECONDARY_ROLES = () on dedicated MCP service users. _Teams locking down AI assistant access to a warehouse can keep up with security gotchas like this through daily.dev._ ### Why should a Snowflake MCP server expose a Cortex Agent instead of raw read-only SQL to AI clients? Putting SYSTEM_EXECUTE_SQL next to a Cortex Agent tool on the same MCP server lets the client model skip the agent entirely and write its own SQL against raw tables, bypassing the semantic view, verified queries, and instructions that make answers trustworthy. Snowflake's docs call this out explicitly, so the recommended design is two separate servers: one agent-only server for business users and one read-only SQL server for engineers. _Architects deciding how to expose a warehouse to AI assistants can compare these governance tradeoffs on daily.dev._ ## Similar posts on daily.dev - [Playing with Snowflake-managed MCP](https://daily.dev/posts/playing-with-snowflake-managed-mcp-tn6no5rel) · Snowflake Community · 1 upvotes · 0 comments - [Snowflake offers help to users and builders of AI agents](https://daily.dev/posts/snowflake-offers-help-to-users-and-builders-of-ai-agents-cyfqdsmlk) · InfoWorld · 0 upvotes · 0 comments - [Cortex Agents: The Platform Powering Snowflake Intelligence and Enterprise AI Agents](https://daily.dev/posts/cortex-agents-the-platform-powering-snowflake-intelligence-and-enterprise-ai-agents-toqxjkd4h) · Snowflake · 0 upvotes · 0 comments - [Unlocking Your Data with Snowflake Managed MCP Servers](https://daily.dev/posts/unlocking-your-data-with-snowflake-managed-mcp-servers-xaafduzyx) · Snowflake Community · 0 upvotes · 0 comments - [Build AI agents faster with GCS \(Google Cloud Storage\) MCP server](https://daily.dev/posts/build-ai-agents-faster-with-gcs-google-cloud-storage-mcp-server-ysjglamng) · Google Cloud · 1 upvotes · 0 comments --- Tags: [#mcp](https://daily.dev/tags/mcp), [#snowflake](https://daily.dev/tags/snowflake), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Snowflake’s Managed MCP Server: Giving AI Assistants a Governed Door Into Your Warehouse (Part 1)","url":"https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs"},"datePublished":"2026-10-27T20:04:05.079Z","dateModified":"2026-10-27T20:06:03.176Z","description":"Snowflake now lets you host an MCP server as a native schema-level object, so AI assistants like Claude, Cursor or ChatGPT can query a warehouse through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/01f6a129add7c3cb31ffe1900b2a782b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/01f6a129add7c3cb31ffe1900b2a782b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Snowflake Community","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Snowflake Community","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3eb5260f70bb4653be0f9581c0d937c8","url":"https://daily.dev/sources/snowflake_comm"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"mcp,snowflake,oauth","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Snowflake Community","item":"https://daily.dev/sources/snowflake_comm"},{"@type":"ListItem","position":3,"name":"Snowflake’s Managed MCP Server: Giving AI Assistants a Governed Door Into Your Warehouse (Part 1)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/snowflake-s-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1--g7qvtayrs#faq","mainEntity":[{"@type":"Question","name":"Why does my GENERIC procedure tool fail when called over Snowflake's MCP server?","acceptedAnswer":{"@type":"Answer","text":"GENERIC tools over Snowflake's managed MCP server expect a single cell result, so a procedure declared RETURNS TABLE fails with an error like 'expected a single cell result set, got 3 rows and 4 columns'. The fix is to change the procedure to RETURNS VARIANT and fold the result into one JSON value using ARRAY_AGG and OBJECT_CONSTRUCT, which is also easier for a model to read. Developers wiring stored procedures into MCP tool calls can track fixes like this one on daily.dev."}},{"@type":"Question","name":"Why can a Snowflake role access an MCP server tool it was never granted on?","acceptedAnswer":{"@type":"Answer","text":"A role can list or call tools it wasn't granted when the caller's programmatic access token (PAT) has no ROLE_RESTRICTION and the user has DEFAULT_SECONDARY_ROLES = ALL, the default for new users. With secondary roles active, privileges are evaluated across every role granted to the user, so another role's ownership can quietly let the request through. The fix is creating PATs with a ROLE_RESTRICTION set to the intended MCP role, or setting DEFAULT_SECONDARY_ROLES = () on dedicated MCP service users. Teams locking down AI assistant access to a warehouse can keep up with security gotchas like this through daily.dev."}},{"@type":"Question","name":"Why should a Snowflake MCP server expose a Cortex Agent instead of raw read-only SQL to AI clients?","acceptedAnswer":{"@type":"Answer","text":"Putting SYSTEM_EXECUTE_SQL next to a Cortex Agent tool on the same MCP server lets the client model skip the agent entirely and write its own SQL against raw tables, bypassing the semantic view, verified queries, and instructions that make answers trustworthy. Snowflake's docs call this out explicitly, so the recommended design is two separate servers: one agent-only server for business users and one read-only SQL server for engineers. Architects deciding how to expose a warehouse to AI assistants can compare these governance tradeoffs on daily.dev."}}]} ```