> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrating Agent With Snowflake MCP

> Explaining how to integrate a read-only Snowflake connector into an agent via MCP toolbox, enforcing least-privilege access for safe billing data queries.

It's Thursday afternoon and you open one last email. It's from Dana in Finance: "And you're still missing the money."

Dana lists risks, but "high risk" is meaningless without context — who pays this customer, what contract are they on, and when does it end? All of that billing information lives in Snowflake under `billing_accounts` keyed by the same customer ID the agent uses. And yes — you will not grant write access to the agent.

![A stylized screenshot of an email titled "Thursday Afternoon – This Last Email" from Dana in Finance with the subject "And you're still missing the money." The message asks about payments and contracts, mentions Snowflake and billing\_accounts/customer\_id, and ends by refusing write access.](https://mintcdn.com/kodekloud-c4ac6d9a/YiW0Xl5gQ25uff6L/images/AI-Agents-For-Data-Analytics/Building-Agent-With-Snowflake/Integrating-Agent-With-Snowflake-MCP/email-dana-finance-missing-money-snowflake.jpg?fit=max\&auto=format\&n=YiW0Xl5gQ25uff6L\&q=85\&s=135b52533b5a84653f4cd47a27106166)

Marcus's "last-line rule" shows up before you even ask: the agent already has a credential and can query data it is allowed to read. Dana is right — the agent might label a customer "fading" or "angry," but it can't tell you whether that customer is worth $400 or $40,000 without hitting billing data.

![A slide titled "Three Warehouses" showing icons for BigQuery, Databricks, and Snowflake. BigQuery is labeled "Fading", Databricks "Angry", and Snowflake is highlighted with a red question mark and the caption "400 or 40,000?".](https://mintcdn.com/kodekloud-c4ac6d9a/YiW0Xl5gQ25uff6L/images/AI-Agents-For-Data-Analytics/Building-Agent-With-Snowflake/Integrating-Agent-With-Snowflake-MCP/three-warehouses-fading-angry-snowflake-question.jpg?fit=max\&auto=format\&n=YiW0Xl5gQ25uff6L\&q=85\&s=c39e2854ca3a102e09810a3cd0d83fa8)

## MCP toolbox: one binary, many backends

This Snowflake integration is the third platform plugged into the MCP (Model Connector Platform) server. Each platform needs slightly different MCP setup:

* BigQuery: the toolbox ran locally as a binary (a subprocess).
* Databricks: the platform was already hosted; you provided a URL and token.
* Snowflake: no extra machinery is required — the toolbox already includes Snowflake support.

The toolbox is not tied to BigQuery only. One binary contains pre-built configurations for many databases (Postgres, MySQL, Oracle, Spanner, Snowflake, etc.). You select the platform you want by swapping a single flag.

The toolbox swaps backend behavior by a single `--prebuilt <platform>` flag. One binary can host connectors for many databases — just change the platform name.

Run the toolbox for BigQuery:

```bash theme={null}
./toolbox --prebuilt bigquery
```

Run the toolbox for Snowflake:

```bash theme={null}
./toolbox --prebuilt snowflake
```

The prebuilt Snowflake connector exposes two tools to the agent:

* execute\_sql — runs SQL generated by the model.
* list\_tables — inspects available tables so the agent can explore the schema.

![A dark-themed flow diagram titled "One Word Swaps the Backend" showing a Database Toolbox icon connected to a Snowflake icon that branches to two orange tool blocks. The blocks are labeled execute\_sql ("Runs the SQL") and list\_tables ("Explores the schema").](https://mintcdn.com/kodekloud-c4ac6d9a/YiW0Xl5gQ25uff6L/images/AI-Agents-For-Data-Analytics/Building-Agent-With-Snowflake/Integrating-Agent-With-Snowflake-MCP/one-word-swaps-backend-snowflake-tools.jpg?fit=max\&auto=format\&n=YiW0Xl5gQ25uff6L\&q=85\&s=a334746a6430069e7086af01f9bf1e2f)

## How the toolbox authenticates to Snowflake

The Snowflake prebuilt connector reads its connection configuration from environment variables. The connector expects these variables (use `export` or a `.env` file):

| Environment variable | Description | Example |
| - | -: | - |
| `SNOWFLAKE_ACCOUNT` | Snowflake account identifier (includes region) | `xyz12345.us-east-1` |
| `SNOWFLAKE_USER` | Username the toolbox will use | `agent_service` |
| `SNOWFLAKE_PASSWORD` | Password for the user (or a secrets manager token) | `Sup3rS3cret!` |
| `SNOWFLAKE_DATABASE` | Target database | `ANALYTICS` |
| `SNOWFLAKE_SCHEMA` | Target schema | `BILLING` |
| `SNOWFLAKE_WAREHOUSE` | Warehouse used to run queries | `COMPUTE_WH` |
| `SNOWFLAKE_ROLE` | Role controlling privileges | `ANALYST_READ_ONLY` |

A typical `.env` file for local testing:

```bash theme={null}
SNOWFLAKE_ACCOUNT=xyz12345.us-east-1
SNOWFLAKE_USER=agent_service
SNOWFLAKE_PASSWORD=Sup3rS3cret!
SNOWFLAKE_DATABASE=ANALYTICS
SNOWFLAKE_SCHEMA=BILLING
SNOWFLAKE_WAREHOUSE=COMPUTE_WH
SNOWFLAKE_ROLE=ANALYST_READ_ONLY
```

## Enforcing least privilege with a read-only role

Follow the principle of least privilege: create a role that allows only the operations the agent needs (usually `USAGE` and `SELECT`). Dana creates `ANALYST_READ_ONLY` and grants only the minimum privileges required to read billing tables.

SQL to create the role and grant minimal permissions:

```sql theme={null}
CREATE ROLE ANALYST_READ_ONLY;

-- Allow the role to use the database and schema
GRANT USAGE ON DATABASE ANALYTICS TO ROLE ANALYST_READ_ONLY;
GRANT USAGE ON SCHEMA ANALYTICS.BILLING TO ROLE ANALYST_READ_ONLY;

-- Allow the role to use the compute warehouse
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE ANALYST_READ_ONLY;

-- Allow the role to select from the billing_accounts table
GRANT SELECT ON TABLE ANALYTICS.BILLING.BILLING_ACCOUNTS TO ROLE ANALYST_READ_ONLY;
```

Now every SQL the model generates runs as that role. If the agent attempts any write operation, Snowflake will reject it due to insufficient privileges:

```sql theme={null}
-- Agent (or model) attempts to run a write statement
UPDATE ANALYTICS.BILLING.BILLING_ACCOUNTS
SET plan_tier = 'free'
WHERE customer_id = 'CUST-123';

-- Snowflake returns an access control error like:
-- SQL access control error: Insufficient privileges to operate on table 'ANALYTICS.BILLING.BILLING_ACCOUNTS'
```

Never grant broad write permissions to the agent's role. Use a read-only role and grant only the specific tables and usage privileges required.

This guardrail pattern repeats across platforms: a read-only service account in BigQuery, Unity Catalog and scoped privileges in Databricks, and `ANALYST_READ_ONLY` in Snowflake.

![A presentation slide titled "The Same Guardrail, Three Times" showing three data platform icons — BigQuery, Databricks, and Snowflake — with corresponding labels underneath ("Read-only service account", "Unity Catalog", and "analyst\_read\_only").](https://mintcdn.com/kodekloud-c4ac6d9a/YiW0Xl5gQ25uff6L/images/AI-Agents-For-Data-Analytics/Building-Agent-With-Snowflake/Integrating-Agent-With-Snowflake-MCP/bigquery-databricks-snowflake-readonly-guardrail.jpg?fit=max\&auto=format\&n=YiW0Xl5gQ25uff6L\&q=85\&s=be2e6dae18a246c67cf228eae7ec97ef)

### Quick comparison: guardrail implementations

| Platform | Guardrail type | Typical configuration |
| - | - | - |
| BigQuery | Read-only service account | Limited IAM roles (bigquery.dataViewer) |
| Databricks | Unity Catalog / scoped permissions | Catalog/schema/table-level grants |
| Snowflake | Read-only role | `USAGE` + `SELECT` on DB/schema/tables |

## Links and references

* Snowflake: [https://docs.snowflake.com/](https://docs.snowflake.com/)
* Databricks Unity Catalog: [https://docs.databricks.com/data-governance/unity-catalog/index.html](https://docs.databricks.com/data-governance/unity-catalog/index.html)
* BigQuery IAM: [https://cloud.google.com/bigquery/docs/access-control](https://cloud.google.com/bigquery/docs/access-control)
* Tooling / MCP: (link to your internal MCP docs or repo)

Use scoped, auditable credentials and the toolbox `--prebuilt` flag to safely give your agent read-only access to billing data so it can answer money questions without risking writes or privilege escalation.

> **[Watch Video](https://learn.kodekloud.com/user/courses/ai-agents-for-data-analytics/module/432d3dee-4625-4352-92e7-0e247db776ea/lesson/f8514674-2b7c-443b-b0bf-32ccd5d2f03e)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.