ae-mcp

A small, fast MCP server for Snowflake. Four tools, one file, browser SSO auth.

Auth

Authenticates via externalbrowser SSO. The connector caches the SSO ID token locally (in the OS keyring, via the secure-local-storage extra), so the browser only opens when the cached token expires — not on every server restart. Caching requires this once on the account (ask an admin if it isn't already set):

ALTER ACCOUNT SET ALLOW_ID_TOKEN = TRUE;

While the server process is running, CLIENT_SESSION_KEEP_ALIVE holds the session open indefinitely — you won't be re-prompted mid-session.

Install

Windows and macOS (Python 3.11+):

python -m pip install --user ae-mcp

Or:

uv tool install ae-mcp

Configure (Cursor / Claude Desktop / Claude Code)

{
  "mcpServers": {
    "ae-mcp": {
      "command": "ae-mcp",
      "env": {
        "SNOWFLAKE_ACCOUNT": "myorg-myaccount",
        "SNOWFLAKE_USER": "me@example.com",
        "SNOWFLAKE_ROLE": "ANALYST_ROLE",
        "SNOWFLAKE_WAREHOUSE": "COMPUTE_WH",
        "SNOWFLAKE_MCP_ALLOW_WRITE": "false"
      }
    }
  }
}

SNOWFLAKE_MCP_ALLOW_WRITE is shown explicitly above as a reminder — it's false (read-only) by default even if omitted entirely.

Optional env: SNOWFLAKE_DATABASE, SNOWFLAKE_SCHEMA.

Tools

Performance notes

• One lazy connection, kept alive with CLIENT_SESSION_KEEP_ALIVE, reused across calls; auto-reconnects once on session expiry.
• Blocking connector calls run in a worker thread — the MCP event loop never stalls.
• SHOW TERSE / DESCRIBE are metadata operations: instant results, no warehouse credits.
• STATEMENT_TIMEOUT_IN_SECONDS=300 guards against runaway queries.

Safety

Secure by default. snowflake_query is read-only out of the box — no env var needs to be set for that. Writes (INSERT/UPDATE/DELETE/MERGE/ CREATE/DROP/ALTER/TRUNCATE/GRANT/REVOKE/COPY/CALL/etc.) are blocked unless explicitly enabled.

The read-only guard, when active:

• Allows only statements starting with SELECT/SHOW/DESCRIBE/DESC/ EXPLAIN/WITH/LIST/USE.
• Also scans the whole statement (not just the first keyword) for write-capable keywords, so a CTE prefix can't smuggle a write past the first-token check (WITH x AS (...) INSERT INTO ... is blocked, not just a bare INSERT).
• Rejects stacked statements — anything after a ; other than trailing whitespace (SELECT 1; DROP TABLE x;) is blocked outright.
• Ignores keywords found inside string/identifier literals and comments, so a column named e.g. delete_flag or a literal containing the word "insert" doesn't trigger a false block.

Call snowflake_session_info any time to see the live gating state (which of the two env vars is active) alongside connection details. A blocked snowflake_query call returns an error explaining which env var to set — no SQL is ever sent to Snowflake for a blocked statement.

This is a keyword/pattern guard, not a full SQL parser — it's meant to stop accidental or casual writes from an LLM-driven client, not to withstand a determined adversary with control over the input. If you need real guarantees, use a read-only Snowflake role for this connection rather than relying on the guard alone.