How do I connect Claude to my Snowflake data warehouse?

Use an MCP server. Snowflake offers a managed MCP server, Snowflake Labs publishes an open-source one, and analytics layers such as Kater provide their own. Give the connection a read-only role with only the schemas it needs, and test with one small question before you share it.

Is it safe to give an AI agent access to a data warehouse?

It can be, when the warehouse enforces the limits and not the prompt. Use a read-only role, scope it to curated schemas, set row limits and timeouts, log every query, and decide whether queries run as each person or as a shared service account. The remaining risk is a correct-looking wrong answer, which access control does not stop.

Does the Snowflake MCP server let the AI write SQL?

It can. Snowflake's managed MCP server offers a SQL execution tool, which is read-only by default, and a Cortex Analyst tool, which turns a question into SQL over a semantic view. It can also expose stored procedures as custom tools, where the model passes arguments instead of SQL.

How is Kater different from a SQL tool over MCP?

For a question that a query contract covers, the agent selects the contract and fills its typed inputs, and Kater's compiler writes the SQL from the data team's definitions. Required filters always run. Every command runs as the person who asked. Exploration with new SQL stays in that person's own Sandbox.

How to connect Claude to Snowflake without letting the AI write SQL (2026)

To connect Claude to Snowflake, you add an MCP server that Claude can call. The choice that matters is not which server, but who writes the SQL that reaches your warehouse: the model, a Snowflake service such as Cortex Analyst, or a compiler that works from queries your data team approved.

All three can be read-only and permission-checked. They differ in how they fail. A model that writes SQL can return a correct-looking wrong number. A system that only runs approved queries refuses the questions it does not cover.

Three ways to connect Claude to Snowflake

	SQL tool over MCP	Snowflake-managed MCP server	Query contracts (Kater)
Example	Snowflake Labs MCP server, community servers	Snowflake-managed MCP server	Kater MCP server
Who writes the SQL	The model. Snowflake Labs describes the tool as “Run LLM-generated SQL”	The model (SQL tool), Cortex Analyst (from a semantic view), or nobody (a stored procedure you wrote)	Kater’s compiler, from an approved contract and the data team’s shared definitions
What limits a write	A list of allowed statement types in the server’s configuration	The SQL tool’s `read_only` setting, which is on by default	The agent fills typed inputs. Required filters in the contract always run
Whose permissions apply	The Snowflake role in the connection	Snowflake roles, with grants on the server and on each tool	The person who asks, for every command
A question nobody prepared for	The model writes new SQL	Depends on the tool the agent selects	The agent says what is missing, and the gap can go to the data team
Most work for	The prompt and the reviewer	The semantic views and the procedures	The data team, up front

Snowflake’s managed server can expose five tool types: Cortex Agents, Cortex Search, Cortex Analyst, SQL execution, and custom tools built from user-defined functions and stored procedures. A stored procedure gives you the same idea as a contract: the model passes arguments, not SQL. You build and maintain one procedure for each question.

On August 28, 2026, Snowflake published a release note titled “Snowflake recommends transitioning from Cortex Analyst to Cortex Agents.” If you plan around Cortex Analyst, read that note first.

The safety checks every setup needs

These checks apply whichever server you choose. Most current guides agree on them.

Use a dedicated role that can only read. Do not reuse an admin or owner role. Grant it only the schemas the agent needs, such as your curated marts.
Let the warehouse enforce read-only. A setting in the MCP server helps. A role without write grants is the real limit.
Decide whose identity runs each query. Per-person OAuth keeps each person’s row and column access, and gives a clear audit trail. A shared service account is simpler, but everyone who uses it sees what the account sees.
Limit cost and size. Use a dedicated warehouse, a statement timeout and a row limit.
Log every query. You need to know who asked what, and which SQL ran.
Plan for prompt injection. Text inside your data can contain instructions. In June 2025, Trend Micro reported a SQL injection flaw in Anthropic’s reference SQLite MCP server, which joined text into SQL without parameters. The server had been forked or copied more than 5,000 times. Limit what a successful injection can reach, and pass values as parameters, never as SQL text.

These checks protect the warehouse. They do not protect the reader from a wrong number. A read-only query with the wrong join is still read-only.

Where the wrong number comes from

When a model writes SQL, it decides the joins, the filters and the formula each time. Small differences in the question can change any of them. The dbt Labs 2026 benchmark measured this: across its full question set, text-to-SQL answered 64.5% of runs correctly, and its errors were plausible numbers, not error messages.

Gartner’s Market Guide for Agentic Analytics (February 9, 2026) makes the same point about MCP: “by 2028, 60% of agentic analytics projects relying solely on MCP will fail due to the lack of a consistent semantic layer.”

MCP is how the agent reaches your data. It does not decide what “revenue” means.

How the Kater MCP server works

Kater sits between Claude and Snowflake. The data team defines datasets, measures, dimensions and relationships once, in Kater SQL. Workspaces build query contracts on those definitions for the questions the business asks again and again.

When a person asks Claude a question:

Claude selects a contract and fills its inputs. For example, it sets Country to DE on a revenue-by-region contract. It does not write the WHERE clause.
Kater compiles the SQL. The compiler writes Snowflake SQL from the contract and the shared definitions. Filters that the contract marks as required always run.
The command runs as the person who asked. Kater checks that they can read the workspace and the query.
The answer comes back as a card. In a host that supports MCP Apps, such as Claude, a result arrives as a chart and a comparison arrives as a row-by-row diff. See Kater in your chat.
A question no contract covers gets a clear answer too. The agent says what is missing. Exploration with new SQL happens in the person’s own Sandbox, where nobody else reads it. A new definition reaches others only through a promotion request that the data team approves.

To connect, open the Kater portal, select Ask, then Connect your agent, and copy the MCP address into your MCP host.

Which setup should you use?

Your situation	Start with
An analyst wants to explore a new schema from Claude	A SQL tool over MCP, with a read-only role and a small scope
Your team already maintains Snowflake semantic views	Snowflake’s managed MCP server
A few fixed questions, and you are happy to write SQL procedures	Custom tools on Snowflake’s managed MCP server
Business teams ask the same questions every week, and cannot check SQL	Query contracts, with refusal on anything not covered

Limits

Kater connects to Snowflake and DuckDB today. This guide does not cover BigQuery or Databricks.
We checked Kater’s cards in the MCP Apps reference host and in Claude. Other hosts may draw them differently.
A contract covers only the questions the data team approved. The first weeks are spent approving the questions that repeat most.