Skip to main content
It’s Thursday afternoon and you open one last email. It’s from Dana in Finance: “And you’re still missing the money.” Dana lists risks, but “high risk” is meaningless without context — who pays this customer, what contract are they on, and when does it end? All of that billing information lives in Snowflake under billing_accounts keyed by the same customer ID the agent uses. And yes — you will not grant write access to the agent.
A stylized screenshot of an email titled "Thursday Afternoon – This Last Email" from Dana in Finance with the subject "And you're still missing the money." The message asks about payments and contracts, mentions Snowflake and billing_accounts/customer_id, and ends by refusing write access.
Marcus’s “last-line rule” shows up before you even ask: the agent already has a credential and can query data it is allowed to read. Dana is right — the agent might label a customer “fading” or “angry,” but it can’t tell you whether that customer is worth 400or400 or 40,000 without hitting billing data.
A slide titled "Three Warehouses" showing icons for BigQuery, Databricks, and Snowflake. BigQuery is labeled "Fading", Databricks "Angry", and Snowflake is highlighted with a red question mark and the caption "400 or 40,000?".

​
MCP toolbox: one binary, many backends

This Snowflake integration is the third platform plugged into the MCP (Model Connector Platform) server. Each platform needs slightly different MCP setup:
  • BigQuery: the toolbox ran locally as a binary (a subprocess).
  • Databricks: the platform was already hosted; you provided a URL and token.
  • Snowflake: no extra machinery is required — the toolbox already includes Snowflake support.
The toolbox is not tied to BigQuery only. One binary contains pre-built configurations for many databases (Postgres, MySQL, Oracle, Spanner, Snowflake, etc.). You select the platform you want by swapping a single flag.
The toolbox swaps backend behavior by a single --prebuilt <platform> flag. One binary can host connectors for many databases — just change the platform name.
Run the toolbox for BigQuery:
Run the toolbox for Snowflake:
The prebuilt Snowflake connector exposes two tools to the agent:
  • execute_sql — runs SQL generated by the model.
  • list_tables — inspects available tables so the agent can explore the schema.
A dark-themed flow diagram titled "One Word Swaps the Backend" showing a Database Toolbox icon connected to a Snowflake icon that branches to two orange tool blocks. The blocks are labeled execute_sql ("Runs the SQL") and list_tables ("Explores the schema").

​
How the toolbox authenticates to Snowflake

The Snowflake prebuilt connector reads its connection configuration from environment variables. The connector expects these variables (use export or a .env file): A typical .env file for local testing:

​
Enforcing least privilege with a read-only role

Follow the principle of least privilege: create a role that allows only the operations the agent needs (usually USAGE and SELECT). Dana creates ANALYST_READ_ONLY and grants only the minimum privileges required to read billing tables. SQL to create the role and grant minimal permissions:
Now every SQL the model generates runs as that role. If the agent attempts any write operation, Snowflake will reject it due to insufficient privileges:
Never grant broad write permissions to the agent’s role. Use a read-only role and grant only the specific tables and usage privileges required.
This guardrail pattern repeats across platforms: a read-only service account in BigQuery, Unity Catalog and scoped privileges in Databricks, and ANALYST_READ_ONLY in Snowflake.
A presentation slide titled "The Same Guardrail, Three Times" showing three data platform icons — BigQuery, Databricks, and Snowflake — with corresponding labels underneath ("Read-only service account", "Unity Catalog", and "analyst_read_only").

​
Quick comparison: guardrail implementations

Use scoped, auditable credentials and the toolbox --prebuilt flag to safely give your agent read-only access to billing data so it can answer money questions without risking writes or privilege escalation.

Watch Video