# snowflake-mcp

Local [MCP](https://modelcontextprotocol.io) server that exposes Snowflake as tools for VS Code Copilot, Claude Desktop, and other MCP clients. **SSO only** (`externalbrowser`) — no passwords or private keys.

---

## Prerequisites

- Python 3.10+
- [uv](https://docs.astral.sh/uv/) — `curl -LsSf https://astral.sh/uv/install.sh | sh`
- VS Code + GitHub Copilot extension
- A Snowflake account with SSO configured

---

## Setup

```bash
uv sync          # installs dependencies into .venv/
cp .env.example .env  # then fill in your values
```

**Required variables** (all six must resolve to a non-blank value):

| Variable | Example |
|---|---|
| `SNOWFLAKE_ACCOUNT` | `myorg-myaccount` |
| `SNOWFLAKE_USER` | `you@example.com` |
| `SNOWFLAKE_WAREHOUSE` | `COMPUTE_WH` |
| `SNOWFLAKE_ROLE` | `ANALYST` |
| `SNOWFLAKE_DATABASE` | `ANALYTICS` |
| `SNOWFLAKE_SCHEMA` | `PUBLIC` |
| `SNOWFLAKE_BROWSER_TIMEOUT` | `120` (optional) |

> **Account identifier:** Snowflake UI → Admin → Accounts → hover your account → copy. Looks like `myorg-myaccount` or `abc12345.us-east-1`.

Credentials are read from (in priority order): VS Code prompt → shell environment → `.env` file. Leave VS Code prompts blank to fall through to `.env`.

---

## VS Code integration

The server is pre-configured in `.vscode/mcp.json`. Open the workspace, switch Copilot Chat to **Agent mode**, and the tools are available immediately. A browser window opens for SSO on the first tool call.

### Tools

| Tool | What it does |
|---|---|
| `run_query` | Read-only SQL (`SELECT`, `SHOW`, `DESCRIBE`, `EXPLAIN`, `WITH`) |
| `list_databases` | `SHOW DATABASES` |
| `list_schemas` | `SHOW SCHEMAS IN DATABASE <db>` |
| `list_tables` | `SHOW TABLES IN SCHEMA <db>.<schema>` |
| `describe_table` | `DESCRIBE TABLE <db>.<schema>.<table>` |
| `preview_mutation` | Stage a write statement for review (`INSERT`, `UPDATE`, `DELETE`, `MERGE`, `CREATE TABLE`) |
| `confirm_mutation` | Execute a staged mutation using its approval token |

---

## Security

- Read-only by default; mutations require a two-phase `preview → confirm` with single-use tokens (5 min TTL).
- Identifier arguments validated against `[A-Za-z0-9_$]` to prevent injection.
- SQL comments stripped before statement-type analysis.
- Results capped at 500 rows / 100 000 characters.

---

## Troubleshooting

**Credentials missing** — ensure all six variables are set via `.env`, shell env, or VS Code prompts.

**SSO browser doesn't open / times out** — add `SNOWFLAKE_BROWSER_TIMEOUT=300` to `.env`; confirm your browser can reach the identity provider.

**MCP server not showing in Copilot Chat** — open VS Code at the `snowflake-mcp/` root (not a parent folder); reload with `Cmd+Shift+P` → *Developer: Reload Window*.

**`Import could not be resolved` in VS Code** — select the project venv: `Cmd+Shift+P` → *Python: Select Interpreter* → `./.venv/bin/python`.