MCP Connectors¶

Overview¶

An MCP connector in Snowflake connects Snowflake Intelligence and Cortex Agents to a remote Model Context Protocol (MCP) server, letting the Agent discover and invoke tools hosted by providers such as Atlassian Jira, Salesforce, or your own custom applications.

Set up supported MCP connectors¶

You can connect with the following MCP servers with minimal configuration:

• Atlassian

• GitHub

• Glean

• Linear

• Salesforce

With these MCP providers, you complete the following workflow:

1. Specify the provider detail in the API_USER_AUTHENTICATION type field.

2. Set up the provider configuration, which is unique to each provider.

3. Reference this API integration in the external MCP server object creation.

-- Create the API integration using dynamic client registration (DCR)
CREATE API INTEGRATION jira_mcp_api_integration
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://mcp.jira.atlassian.com')
  API_USER_AUTHENTICATION = (
    TYPE=OAUTH_DYNAMIC_CLIENT,
    OAUTH_RESOURCE_URL='https://mcp.atlassian.com/v1/mcp'
  )
  ENABLED = TRUE;

-- Create the external MCP server
CREATE EXTERNAL MCP SERVER atlassian_mcp_server
  WITH NAME = 'Atlassian (Jira & Confluence)'
  SERVER_URL='https://mcp.atlassian.com/v1/mcp'
  API_INTEGRATION = jira_mcp_api_integration;

Custom MCP connectors¶

You can also manually configure custom connectors to connect to any MCP-compatible endpoint.

1. Provide the full OAuth configuration as part of the API integration creation:

   CopyExpand

    -- Create the API integration with full OAuth configuration
   CREATE API INTEGRATION custom_mcp_api_integration
      API_PROVIDER = external_mcp
      API_ALLOWED_PREFIXES = ('https://internal.mycompany.com/mcp')
      API_USER_AUTHENTICATION = (
        TYPE = OAUTH
        OAUTH_CLIENT_ID = 'your_client_id'
        OAUTH_CLIENT_SECRET = 'your_client_secret'
        OAUTH_TOKEN_ENDPOINT = 'https://internal.mycompany.com/oauth/token'
        OAUTH_CLIENT_AUTH_METHOD = CLIENT_SECRET_BASIC
        OAUTH_AUTHORIZATION_ENDPOINT = 'https://internal.mycompany.com/oauth/authorize'
      )
      ENABLED = TRUE;
   

   Show lessSee more

   Scroll to top

   Alternatively, you can use API integration with DCR:

   CopyExpand

   CREATE API INTEGRATION custom_mcp_api_integration
     API_PROVIDER = external_mcp
     API_ALLOWED_PREFIXES = ('https://internal.mycompany.com/mcp')
     API_USER_AUTHENTICATION = (
       TYPE = OAUTH_DYNAMIC_CLIENT
       OAUTH_RESOURCE_URL='https://internal.mycompany.com/mcp'
     )
     ENABLED = TRUE;
   

   Show lessSee more

   Scroll to top

2. Create the MCP server object:

   CopyExpand

   -- Create the external MCP server
   CREATE EXTERNAL MCP SERVER mycompany_mcp_server
     WITH NAME = 'Mycompany MCP server'
     API_INTEGRATION = custom_mcp_api_integration;
   

   Show lessSee more

   Scroll to top

3. Reference the MCP server in the Agent configuration:

   CopyExpand

   -- Add MCP server to agent
   ALTER AGENT my_support_agent
     ADD MCP_SERVER = 'db.schema.MCP server';
   

   Show lessSee more

   Scroll to top

Add MCP connectors to the Cortex Agent¶

After MCP server object creation, the agent developer references it in the Cortex Agent config. MCP Connectors are available in the Agent Admin UI, where developers can browse and select from MCP connectors configured at the account level. You can also use SQL or API to add MCP connectors to your agents.

ALTER AGENT [ IF EXISTS ] <name> MODIFY LIVE VERSION SET SPECIFICATION $$
    <previous_spec>
    mcp_servers:
      - server_spec:
         name: "db.schema.mcp_server1"
      - server_spec:
         name: "db.schema.mcp_server2"
$$;

PUT /api/v2/databases/{database}/schemas/{schema}/agents/{name}

{
    "comment": "An agent to answer questions about all my data",
    "profile": {
        "display_name": "My Agent"
    },
    "models": {
        "orchestration": "claude-4-sonnet"
    },
    "mcp_servers": [
        {"server_spec": "prod_db.integrations.jira_mcp_server"},
        {"server_spec": "prod_db.integrations.github_mcp_server"}
    ]
}

Cortex Agents that reference these MCP servers can access tools provided by the provider. For example, with Atlassian, tools include creating Jira issues, commenting on issues, creating Confluence pages, and updating existing pages.

When the agent is invoked, it retrieves the tool list from each MCP server and includes those tools in its orchestration. The agent selects and invokes tools based on the user’s query and the tool descriptions provided by the MCP server.

Use MCP connectors in Snowflake Intelligence¶

Snowflake Intelligence users connect to external MCP servers through the Snowflake Intelligence interface:

1. Navigate to the Snowflake Intelligence interface by following the instructions in Access the agent.

2. Open the sources panel and select Connectors.

3. Select Connect next to the connector of choice. You can also select Manage Connections and then select Connect.

4. The user is redirected to the third-party service’s authentication page to approve the connection.

5. After authentication, the connector appears as Connected in the sources list. You can now interact with the Agent to get information from the external MCP server.

To disconnect the server, the user can complete the following:

1. Select Manage Connections.

2. Select MCP Server and then select Disconnect.

Users can connect and disconnect connectors in the sources dropdown to include or exclude them from the agent’s orchestration. Connectors that aren’t in the Connected state aren’t included in orchestration.

When a user’s authentication token expires, Snowflake Intelligence prompts the user to re-authenticate.

Use MCP connectors in Agent:run API¶

Agent:run API connect to MCP servers through the client interface. Use the following functions to authenticate users with the third-party service authentication:

• Function to start OAuth flow:

  CopyExpand

  -- Returns authorization URI to authenticate through the third-party service
  SELECT SYSTEM$START_USER_OAUTH_FLOW('<API_INTEGRATION_NAME>');
  

  Show lessSee more

  Scroll to top

• Function to finish OAuth flow:

  CopyExpand

  SYSTEM$FINISH_OAUTH_FLOW( '<query_string>' )
  

  Show lessSee more

  Scroll to top

For additional information, see SYSTEM$START_USER_OAUTH_FLOW and SYSTEM$FINISH_OAUTH_FLOW.

Manage MCP servers¶

-- List all MCP servers in the account
SHOW EXTERNAL MCP SERVERS IN ACCOUNT;

-- List MCP servers in a specific database or schema
SHOW EXTERNAL MCP SERVERS IN DATABASE prod_db;
SHOW EXTERNAL MCP SERVERS IN SCHEMA prod_db.integrations;

DESCRIBE EXTERNAL MCP SERVER mycompany_mcp_server;

-- Disable the MCP server
ALTER API INTEGRATION mycompany_mcp_integration SET ENABLED = FALSE;

-- Re-enable the MCP server
ALTER API INTEGRATION mycompany_mcp_integration SET ENABLED = TRUE;

-- Drop the MCP server
DROP EXTERNAL MCP SERVER mycompany_mcp_server;

-- Drop the API integration (permanently deletes OAuth configuration and secrets)
DROP API INTEGRATION mycompany_mcp_integration;

Key considerations and best practices¶

• Custom MCP servers: Use custom servers when connecting to MCP endpoints not in the available MCP connectors list. Snowflake supports user authentication types for Atlassian, GitHub, Glean, Linear, and Salesforce in the API integration.

• Least-privilege access: Grant only the minimum required privileges for each role. Access to an MCP server doesn’t automatically grant access to its tools, you must grant permissions separately for each tool.

• OAuth authentication: Snowflake only supports using OAuth for all MCP server connections.

• Disabling or dropping: Disabling an API integration preserves its configuration, but immediately invalidates all user tokens and blocks tool invocations. Dropping an API integration permanently deletes it along with all stored secrets. Disable the integration when performing maintenance. Drop the integration when decommissioning.

• Hostname formatting: Use hyphens (-) instead of underscores (_) in hostnames when configuring MCP server connections. Hostnames containing underscores cause connection issues.

Limitations¶

The following limitations apply to MCP connectors:

• Monitoring: MCP tool calls are not logged to the monitoring table.

• MCP protocol scope: External MCP servers support tool capabilities only. Resources, prompts, roots, notifications, version negotiations, lifecycle phases, and sampling are not supported.

• Disabled integrations: You can’t create an MCP server that references a disabled API integration.

• Hostname format: Hostnames must use hyphens, not underscores.