Snowflake MCP server

​

When should you use this server

• Ask natural-language questions over governed Snowflake data via Cortex Analyst
• Run semantic/Cortex Search over indexed documents and support content
• Execute parameterized SQL from agents under guardrails and access control

​

Key features

• Managed, cloud-hosted endpoint—no self-hosted binary to run
• Role-scoped access: every request runs under a specific Snowflake role
• OAuth 2.1 with an external identity provider (per-user attribution)

​

Authentication

• Method: OAuth 2.1 with manual OAuth metadata (pre-registered client).
• Why: Snowflake’s OAuth server does not support Dynamic Client Registration (DCR / RFC 7591). Portkey’s default OAuth flow auto-registers a client against the upstream server, which Snowflake rejects with:
  Incompatible auth server: does not support dynamic client registration
  
• The supported pattern: front Snowflake with an IdP it trusts (this guide uses Okta via Snowflake External OAuth), pre-register a confidential OAuth client there, and give Portkey those credentials in oauth_metadata. Portkey then skips DCR and uses the pre-registered client for the upstream token exchange.

​

Endpoint

https://<account>.<region>.snowflakecomputing.com/api/v2/databases/<db>/schemas/<schema>/mcp-servers/<server>

​

Connect via Portkey MCP Gateway

​

Step 1: Snowflake — role, user, and External OAuth integration

USE ROLE ACCOUNTADMIN;

-- Role the MCP server runs under
CREATE ROLE IF NOT EXISTS MCP_ROLE;
GRANT USAGE ON DATABASE my_db                          TO ROLE MCP_ROLE;
GRANT USAGE ON SCHEMA   my_db.data                     TO ROLE MCP_ROLE;
GRANT USAGE ON MCP SERVER my_db.data.my_mcp_server     TO ROLE MCP_ROLE;

-- The Snowflake user the federated identity maps to.
-- LOGIN_NAME must equal the claim Snowflake reads out of the token (see USER_MAPPING_CLAIM below).
CREATE USER IF NOT EXISTS okta_user
  LOGIN_NAME   = 'user@your-okta-domain'
  DEFAULT_ROLE = MCP_ROLE
  TYPE         = PERSON;
GRANT ROLE MCP_ROLE TO USER okta_user;

-- Tell Snowflake to trust Okta-issued tokens (run after Step 2 — you need Okta's issuer + JWKS URL).
CREATE OR REPLACE SECURITY INTEGRATION OKTA_MCP
  TYPE = EXTERNAL_OAUTH
  ENABLED = TRUE
  EXTERNAL_OAUTH_TYPE = OKTA
  EXTERNAL_OAUTH_ISSUER                           = 'https://<okta-domain>/oauth2/<auth-server-id>'
  EXTERNAL_OAUTH_JWS_KEYS_URL                     = 'https://<okta-domain>/oauth2/<auth-server-id>/v1/keys'
  EXTERNAL_OAUTH_AUDIENCE_LIST                    = ('https://<account>.<region>.snowflakecomputing.com')
  EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM         = 'sub'
  EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name'
  EXTERNAL_OAUTH_SCOPE_MAPPING_ATTRIBUTE          = 'scp'
  EXTERNAL_OAUTH_ANY_ROLE_MODE                    = 'ENABLE';

​

Step 2: Okta — authorization server, scope, and confidential app

1. Security → API → Authorization Servers → Add. Set Audience to the Snowflake account URL (https://<account>.<region>.snowflakecomputing.com). Note the Issuer URI—feed it into Step 1 and Step 3.
2. Scopes → Add Scope: create session:role:<role> (literal, colons and all; lowercase as Snowflake expects). Check Include in public metadata.
3. Access Policies → Add Policy + Rule: grant type Authorization Code (+ Refresh Token), and list the session:role:<role> scope and the allowed users.
4. Applications → Create App Integration → OIDC → Web Application (gives a client_secret). Set the Sign-in redirect URI to:
   https://mcp.portkey.ai/oauth/upstream-callback
   
5. Copy the Client ID, Client Secret, and from <issuer>/.well-known/oauth-authorization-server the authorization_endpoint and token_endpoint.

​

Step 3: Register the integration in Portkey

1. In Portkey, go to MCP Registry → Add MCP Integration.
2. Set:

3. Expand Advanced Configuration and paste (replace placeholders):

{
  "oauth_metadata": {
    "issuer": "https://<okta-domain>/oauth2/<auth-server-id>",
    "client_id": "YOUR_OKTA_CLIENT_ID",
    "client_secret": "YOUR_OKTA_CLIENT_SECRET",
    "redirect_uri": "https://mcp.portkey.ai/oauth/upstream-callback",
    "authorization_endpoint": "https://<okta-domain>/oauth2/<auth-server-id>/v1/authorize",
    "token_endpoint": "https://<okta-domain>/oauth2/<auth-server-id>/v1/token",
    "scope": "session:role:<role>"
  }
}

4. Configure workspace access as needed, then save.

​

Step 4: Connect from an agent

{
  "mcpServers": {
    "snowflake": {
      "url": "https://mcp.portkey.ai/snowflake/mcp"
    }
  }
}

​

Troubleshooting

​

Tools provided

• Cortex Analyst — natural-language questions answered against a configured semantic view/model.
• Cortex Search — semantic search over an indexed service (documents, tickets, etc.).
• SQL execution — run SQL under the mapped Snowflake role.