frostwatch 0.1.5

AI-powered cost and query observability for Snowflake

❄️ FrostWatch

Snowflake cost monitoring shouldn't cost more than the savings.

FrostWatch is an open source, self-hostable, AI-powered cost and query observability tool for Snowflake. Point it at your Snowflake account and get instant answers to "where is all our money going?" — no SaaS contract, no percentage-of-spend pricing, no phone-home.

What it does

• Cost breakdown by warehouse, user, role, and query tag — updated on a schedule you control
• Anomaly detection that flags unusual spend spikes against a rolling 21-day baseline
• Plain-English explanations of anomalies and expensive queries, powered by your own LLM (Anthropic, OpenAI, Gemini, or a local Ollama model)
• Query recommendations — suggested rewrites, warehouse right-sizing, clustering candidates
• Weekly digests delivered to Slack or email
• Clean web UI — dark-themed React dashboard, no BI tool required
• REST API — all data accessible via /api/* endpoints
• CLI — sync, config, and server management from the terminal

Quickstart

Option A — Docker (recommended)

# 1. Copy and edit the config
curl -O https://raw.githubusercontent.com/arunrajiah/frostwatch/main/frostwatch.yaml.example
cp frostwatch.yaml.example frostwatch.yaml
# Edit frostwatch.yaml with your Snowflake credentials and LLM API key

# 2. Start
docker compose up -d

# 3. Open the UI
open http://localhost:8000

Option B — pip

pip install frostwatch

# Initialize config
frostwatch config init
# Edit ~/.frostwatch/config.yaml with your credentials

# Start the server
frostwatch serve

Option C — from source

git clone https://github.com/arunrajiah/frostwatch
cd frostwatch

# Install Python package in editable mode
pip install -e ".[dev]"

# Build the frontend
cd frontend && npm install && npm run build && cd ..

# Initialize config
frostwatch config init

# Run
frostwatch serve --reload

Configuration

All config lives in ~/.frostwatch/config.yaml. Every field can also be set via environment variable with the FROSTWATCH_ prefix.

snowflake_account: "xy12345.us-east-1"
snowflake_user: "FROSTWATCH_USER"
snowflake_password: "your_password"
snowflake_role: "ACCOUNTADMIN"       # needs SELECT on ACCOUNT_USAGE

llm_provider: "anthropic"            # anthropic | openai | gemini | ollama
llm_api_key: "sk-ant-..."

slack_webhook_url: "https://hooks.slack.com/services/..."
email_recipients: ["[e-mail]"]

schedule_cron: "0 8 * * 1"          # weekly digest — Monday 8am
sync_cron: "0 */6 * * *"            # data sync — every 6 hours
credits_per_dollar: 3.0              # adjust for your Snowflake contract rate
snowflake_query_limit: 500           # queries fetched per sync

See frostwatch.yaml.example for the full reference.

Snowflake permissions

FrostWatch only reads from SNOWFLAKE.ACCOUNT_USAGE. The minimum required grant:

-- Create a dedicated role (recommended)
CREATE ROLE frostwatch_role;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE frostwatch_role;
GRANT ROLE frostwatch_role TO USER your_user;

The ACCOUNTADMIN role already has this access. No data is ever written to Snowflake.

LLM providers

Provider	llm_provider	Default model
Anthropic (Claude)	anthropic	claude-sonnet-4-6
OpenAI	openai	gpt-4o
Google Gemini	gemini	gemini-2.0-flash
Ollama (local)	ollama	llama3 — set llm_base_url to your Ollama server

FrostWatch is BYO-LLM. Your data never passes through a hosted proxy — it goes directly from your server to the LLM provider using the API key you supply.

CLI reference

frostwatch serve             Start the web server (default: http://localhost:8000)
frostwatch serve --reload    Start with auto-reload for development
frostwatch sync              Run a one-off Snowflake sync
frostwatch config init       Create ~/.frostwatch/config.yaml from the example
frostwatch config show       Print current config (secrets masked)
frostwatch version           Print version

API

The REST API is available under /api. Interactive docs are at http://localhost:8000/docs when the server is running.

Key endpoints:

Method	Path	Description
GET	/api/dashboard	Cost summary + recent anomalies
GET	/api/queries	Top queries by credit usage
GET	/api/warehouses	Per-warehouse cost aggregates
GET	/api/anomalies	Detected anomalies with LLM explanations
POST	/api/sync	Trigger a manual Snowflake sync
GET	/api/settings	Current configuration
PUT	/api/settings	Update configuration
POST	/api/settings/test-snowflake	Test Snowflake connectivity
POST	/api/reports/generate	Generate an AI cost report

Architecture

┌─────────────┐     read-only     ┌──────────────────────────────────┐
│  Snowflake  │ ◄───────────────  │  frostwatch serve                │
│ ACCOUNT_    │                   │                                  │
│ USAGE views │                   │  FastAPI + APScheduler           │
└─────────────┘                   │  ├── /api/*  (REST)              │
                                  │  └── /       (React SPA)         │
┌─────────────┐                   │                                  │
│  LLM API    │ ◄───────────────  │  SQLite  (local cache + history) │
│ (your key)  │                   └──────────────────────────────────┘
└─────────────┘

FrostWatch runs entirely inside your infrastructure. The only outbound calls are to Snowflake and your chosen LLM provider.

Roadmap

See ROADMAP.md.

Contributing

Contributions are welcome! Please open an issue before starting large changes so we can align on direction.

• Read CONTRIBUTING.md for setup instructions and PR guidelines
• Follow our Code of Conduct
• All PRs require passing CI (lint, type check, tests, frontend build) and one maintainer review

License

MIT — free to use, modify, and self-host. See the license file for details.