Overview

Snowflake Intelligence (MCP Client)
  |
  +-- HR Assistant          --> handbook_comp_server, benefits_server, org_server
  +-- Finance Assistant     --> budget_server, product_usage_server, invoice_search_server, ...
  +-- IT Ops Assistant      --> incident_server, infra_monitor_server
  |
  +-- External MCP Connectors (optional): Atlassian | GitHub | Glean | Linear | Salesforce

What You'll Build

What You'll Learn

Prerequisites

Architecture

Foundation Setup

Create Database and Schemas

USE ROLE ACCOUNTADMIN;
USE WAREHOUSE COMPUTE;

CREATE DATABASE IF NOT EXISTS ACME_CORP;
CREATE SCHEMA IF NOT EXISTS ACME_CORP.HR;
CREATE SCHEMA IF NOT EXISTS ACME_CORP.FINANCE;
CREATE SCHEMA IF NOT EXISTS ACME_CORP.IT;

Create Tables

Tip: You can run the entire setup.sql file at once in a Snowsight SQL worksheet to create all objects in one shot.

Snowflake Managed MCP Servers

Create a Specialized MCP Server

CREATE OR REPLACE MCP SERVER ACME_CORP.HR.handbook_comp_server
  FROM SPECIFICATION $$
    tools:
      - name: "handbook-search"
        type: "CORTEX_SEARCH_SERVICE_QUERY"
        identifier: "ACME_CORP.HR.handbook_search_svc"
        title: "Employee Handbook Search"
        description: "Search the employee handbook for policies and procedures."

      - name: "compensation-analyst"
        type: "CORTEX_ANALYST_MESSAGE"
        identifier: "ACME_CORP.HR.comp_semantic_view"
        title: "Compensation Analyst"
        description: "Ask natural language questions about employee compensation and salary bands."

      - name: "execute-sql"
        type: "SYSTEM_EXECUTE_SQL"
        title: "Execute SQL"
        description: "Execute SQL queries generated by analyst tools against Snowflake."
  $$;

All MCP Servers

External MCP Connectors

Option A: Atlassian (Jira & Confluence)

CREATE API INTEGRATION atlassian_mcp_integration
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://mcp.jira.atlassian.com')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH_DYNAMIC_CLIENT,
    OAUTH_RESOURCE_URL = 'https://mcp.atlassian.com/v1/mcp'
  )
  ENABLED = TRUE;

CREATE EXTERNAL MCP SERVER ACME_CORP.IT.atlassian_mcp_server
  WITH NAME = 'Atlassian (Jira & Confluence)'
  SERVER_URL = 'https://mcp.atlassian.com/v1/mcp'
  API_INTEGRATION = atlassian_mcp_integration;

Option B: GitHub

CREATE API INTEGRATION github_mcp_integration
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://api.githubcopilot.com')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH,
    OAUTH_CLIENT_ID = '<your_github_client_id>',
    OAUTH_CLIENT_SECRET = '<your_github_client_secret>',
    OAUTH_TOKEN_ENDPOINT = 'https://github.com/login/oauth/access_token',
    OAUTH_AUTHORIZATION_ENDPOINT = 'https://github.com/login/oauth/authorize'
  )
  ENABLED = TRUE;

CREATE EXTERNAL MCP SERVER ACME_CORP.IT.github_mcp_server
  WITH NAME = 'GitHub'
  API_INTEGRATION = github_mcp_integration;

Option C: Glean

CREATE API INTEGRATION glean_mcp_integration
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://<your-company>-be.glean.com')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH,
    OAUTH_CLIENT_ID = '<your_glean_client_id>',
    OAUTH_CLIENT_SECRET = '<your_glean_client_secret>',
    OAUTH_TOKEN_ENDPOINT = 'https://<your-company>-be.glean.com/api/v1/oauth/token',
    OAUTH_AUTHORIZATION_ENDPOINT = 'https://<your-company>-be.glean.com/api/v1/oauth/authorize'
  )
  ENABLED = TRUE;

CREATE EXTERNAL MCP SERVER ACME_CORP.IT.glean_mcp_server
  WITH NAME = 'Glean Enterprise Search'
  API_INTEGRATION = glean_mcp_integration;

Option D: Linear

CREATE API INTEGRATION linear_mcp_integration
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://api.linear.app')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH,
    OAUTH_CLIENT_ID = '<your_linear_client_id>',
    OAUTH_CLIENT_SECRET = '<your_linear_client_secret>',
    OAUTH_TOKEN_ENDPOINT = 'https://api.linear.app/oauth/token',
    OAUTH_AUTHORIZATION_ENDPOINT = 'https://linear.app/oauth/authorize'
  )
  ENABLED = TRUE;

CREATE EXTERNAL MCP SERVER ACME_CORP.IT.linear_mcp_server
  WITH NAME = 'Linear'
  API_INTEGRATION = linear_mcp_integration;

Option E: Salesforce

CREATE API INTEGRATION salesforce_mcp_integration
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://<your-instance>.my.salesforce.com')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH,
    OAUTH_CLIENT_ID = '<your_salesforce_consumer_key>',
    OAUTH_CLIENT_SECRET = '<your_salesforce_consumer_secret>',
    OAUTH_TOKEN_ENDPOINT = 'https://<your-instance>.my.salesforce.com/services/oauth2/token',
    OAUTH_AUTHORIZATION_ENDPOINT = 'https://<your-instance>.my.salesforce.com/services/oauth2/authorize'
  )
  ENABLED = TRUE;

CREATE EXTERNAL MCP SERVER ACME_CORP.FINANCE.salesforce_mcp_server
  WITH NAME = 'Salesforce'
  API_INTEGRATION = salesforce_mcp_integration;

Cortex Agents

HR Assistant

CREATE OR REPLACE AGENT ACME_CORP.HR.hr_agent
  COMMENT = 'HR domain agent'
  PROFILE = '{"display_name": "HR Assistant"}'
  FROM SPECIFICATION $$
  {
    "models": {"orchestration": "claude-sonnet-4-5"},
    "instructions": {
      "orchestration": "You are an HR assistant for Acme Corp. Use handbook_search for policy questions. Use compensation_analyst for salary questions. Use benefits tools for benefits questions. Use org_explorer for org structure. Present data in markdown tables. Be concise.",
      "sample_questions": [
        {"question": "What is the total employee benefits cost by department?"},
        {"question": "What is the average salary by department?"},
        {"question": "What is the PTO policy?"}
      ]
    },
    "mcp_servers": [
      {"server_spec": {"name": "ACME_CORP.HR.handbook_comp_server"}},
      {"server_spec": {"name": "ACME_CORP.HR.benefits_server"}},
      {"server_spec": {"name": "ACME_CORP.HR.org_server"}},
      {"server_spec": {"name": "ACME_CORP.IT.glean_mcp_server"}}
    ]
  }
  $$;

Finance Assistant

CREATE OR REPLACE AGENT ACME_CORP.FINANCE.finance_agent
  COMMENT = 'Finance domain agent'
  PROFILE = '{"display_name": "Finance Assistant"}'
  FROM SPECIFICATION $$
  {
    "models": {"orchestration": "claude-sonnet-4-5"},
    "instructions": {
      "orchestration": "You are a finance assistant for Acme Corp. Use budget_analyst for budget questions. Use product_analytics for product usage and revenue. Use invoice_search for invoice lookups. Use approval_search or spend_analytics for spend requests. Use financial_reporting for P&L. Present data in markdown tables with currency formatting. Be concise.",
      "sample_questions": [
        {"question": "Show me all pending invoices. What is the total outstanding amount?"},
        {"question": "What is the gross margin by department for Q1 2025?"},
        {"question": "Which department has the highest budget utilization in Q1 2025?"}
      ]
    },
    "mcp_servers": [
      {"server_spec": {"name": "ACME_CORP.FINANCE.budget_server"}},
      {"server_spec": {"name": "ACME_CORP.FINANCE.product_usage_server"}},
      {"server_spec": {"name": "ACME_CORP.FINANCE.invoice_search_server"}},
      {"server_spec": {"name": "ACME_CORP.FINANCE.spend_approvals_server"}},
      {"server_spec": {"name": "ACME_CORP.FINANCE.reporting_server"}},
      {"server_spec": {"name": "ACME_CORP.FINANCE.salesforce_mcp_server"}}
    ]
  }
  $$;

IT Ops Assistant

CREATE OR REPLACE AGENT ACME_CORP.IT.it_agent
  COMMENT = 'IT domain agent'
  PROFILE = '{"display_name": "IT Ops Assistant"}'
  FROM SPECIFICATION $$
  {
    "models": {"orchestration": "claude-sonnet-4-5"},
    "instructions": {
      "orchestration": "You are an IT operations assistant for Acme Corp. Use incident_search for incident lookups. Use infra_health and sla_compliance for infrastructure monitoring. Present data in markdown tables. Be concise.",
      "sample_questions": [
        {"question": "What P1 incidents occurred in March 2025?"},
        {"question": "Which SLAs were breached in Q1 2025?"},
        {"question": "Show me all unresolved incidents."}
      ]
    },
    "mcp_servers": [
      {"server_spec": {"name": "ACME_CORP.IT.incident_server"}},
      {"server_spec": {"name": "ACME_CORP.IT.infra_monitor_server"}},
      {"server_spec": {"name": "ACME_CORP.IT.atlassian_mcp_server"}},
      {"server_spec": {"name": "ACME_CORP.IT.github_mcp_server"}},
      {"server_spec": {"name": "ACME_CORP.IT.linear_mcp_server"}}
    ]
  }
  $$;

RBAC for MCP Servers

Role  -->  Agent  -->  MCP Server  -->  Tools  -->  Data

Create Roles

CREATE ROLE IF NOT EXISTS hr_analyst_role;
CREATE ROLE IF NOT EXISTS finance_analyst_role;
CREATE ROLE IF NOT EXISTS it_ops_role;

GRANT USAGE ON WAREHOUSE COMPUTE TO ROLE hr_analyst_role;
GRANT USAGE ON WAREHOUSE COMPUTE TO ROLE finance_analyst_role;
GRANT USAGE ON WAREHOUSE COMPUTE TO ROLE it_ops_role;

GRANT USAGE ON DATABASE ACME_CORP TO ROLE hr_analyst_role;
GRANT USAGE ON DATABASE ACME_CORP TO ROLE finance_analyst_role;
GRANT USAGE ON DATABASE ACME_CORP TO ROLE it_ops_role;

HR Analyst Grants

GRANT USAGE ON SCHEMA ACME_CORP.HR TO ROLE hr_analyst_role;
GRANT SELECT ON ALL TABLES IN SCHEMA ACME_CORP.HR TO ROLE hr_analyst_role;
GRANT USAGE ON CORTEX SEARCH SERVICE ACME_CORP.HR.handbook_search_svc TO ROLE hr_analyst_role;
GRANT SELECT ON SEMANTIC VIEW ACME_CORP.HR.comp_semantic_view TO ROLE hr_analyst_role;
GRANT SELECT ON SEMANTIC VIEW ACME_CORP.HR.benefits_semantic_view TO ROLE hr_analyst_role;
GRANT SELECT ON SEMANTIC VIEW ACME_CORP.HR.org_semantic_view TO ROLE hr_analyst_role;
GRANT USAGE ON MCP SERVER ACME_CORP.HR.handbook_comp_server TO ROLE hr_analyst_role;
GRANT USAGE ON MCP SERVER ACME_CORP.HR.benefits_server TO ROLE hr_analyst_role;
GRANT USAGE ON MCP SERVER ACME_CORP.HR.org_server TO ROLE hr_analyst_role;
GRANT USAGE ON AGENT ACME_CORP.HR.hr_agent TO ROLE hr_analyst_role;

What RBAC Achieves

Test Your Agents

Test Internal Tools

Test External Connector

Test RBAC Isolation

GRANT ROLE hr_analyst_role TO USER <your_username>;
GRANT ROLE finance_analyst_role TO USER <your_username>;
GRANT ROLE it_ops_role TO USER <your_username>;
ALTER USER <your_username> SET DEFAULT_SECONDARY_ROLES = ();

Teardown

Conclusion And Resources

What You Learned

Key Takeaways

Related Resources