Skip to main content
No longer maintained. This Runlayer-built connector is deprecated and will not receive further updates. Use Snowflake’s managed Cortex Agents MCP server instead.
Connect your AI assistant to Snowflake for data warehouse queries and schema exploration. Uses Snowflake OAuth for authentication.

​
Available Tools

​
Setup

1

Create Security Integration

Run the following SQL in your Snowflake console. Replace <your-tenant> with your Runlayer subdomain:Snowflake console with SQL commands
Security Note: Never set BLOCKED_ROLES_LIST to empty. Always block at minimum ACCOUNTADMIN, SECURITYADMIN, and ORGADMIN to prevent OAuth tokens from having administrative access.
2

Get OAuth Credentials

Run this SQL to get your credentials:
Copy the OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET from the result.Snowflake OAuth credentials output
3

Add Server in Runlayer

  1. In Runlayer, go to My connectors, find Snowflake, and click Add connector
Runlayer connectors page showing Snowflake MCP server
  1. Enter:
    • SNOWFLAKE_ACCOUNT: Your account identifier (e.g., SNFKACCT-EL36949)
    • SNOWFLAKE_HOST: Your Snowflake host (e.g., snfkacct-el36949.snowflakecomputing.com)
    • SNOWFLAKE_OAUTH_CLIENT_ID: Client ID from Step 2
    • SNOWFLAKE_OAUTH_CLIENT_SECRET: Client Secret from Step 2
    • SNOWFLAKE_WAREHOUSE: Default warehouse (e.g., COMPUTE_WH)
  2. Click Deploy Server
Snowflake server configuration form
4

Authorize

  1. Click Connect on the server page
Snowflake server with Missing auth status
  1. Log in with your Snowflake credentials
Snowflake OAuth login page
  1. Review permissions and click Allow
Each user will need to complete this authorization process with their own Snowflake credentials. This ensures that queries run with each user’s individual permissions.
5

Test the Connection

In your MCP client, try asking:
“Show me who am I using the Snowflake MCP”
The agent will run a query and return your connected user details.Cursor showing Snowflake connection test results

​
Configuration Reference

Required: Optional:

​
Account vs Host

  • SNOWFLAKE_ACCOUNT: Account identifier, required for OAuth URL construction (e.g., SNFKACCT-EL3694)
  • SNOWFLAKE_HOST: Snowflake hostname — use default ({account}.snowflakecomputing.com) or custom for proxy/private endpoints

​
Updating Configuration

After initial deployment, you can update configuration options via CLI:

​
Troubleshooting

Check your Snowflake URL for the correct format. For regional accounts, include the region (e.g., abc12345.us-east-1).
Verify the OAUTH_REDIRECT_URI in your security integration matches exactly: https://<your-tenant>.runlayer.com/oauth/callback (no trailing slash).
Ensure the role you authorized has USAGE privilege on the warehouse: GRANT USAGE ON WAREHOUSE <name> TO ROLE <role>;
Remove the role from BLOCKED_ROLES_LIST or choose a different role during authorization.