❄️ FrostWatch

Snowflake cost monitoring shouldn't cost more than the savings.

FrostWatch is an open source, self-hostable, AI-powered cost and query observability tool for Snowflake. Point it at your Snowflake account and get instant answers to "where is all our money going?" - no SaaS contract, no percentage-of-spend pricing, no phone-home.

Cost breakdown by warehouse, anomaly detection, and AI-powered explanations - all in one dark-themed dashboard.

Try it in 30 seconds (no Snowflake needed)

pip install frostwatch
frostwatch demo
# → open http://localhost:8000

frostwatch demo seeds the local database with 35 days of realistic synthetic data - warehouse cost trends, dbt model breakdowns, injected anomaly spikes, AI explanations, pre-baked query rewrites, and a weekly digest - so you can explore the full UI before connecting a real Snowflake account.

What it does

• Cost breakdown by warehouse, user, role, and query tag - updated on a schedule you control
• Anomaly detection that flags unusual spend spikes against a rolling 21-day baseline
• Plain-English explanations of anomalies and expensive queries, powered by your own LLM (Anthropic, OpenAI, Gemini, or a local Ollama model)
• Query fingerprinting - group near-identical queries by SQL pattern, surface the patterns that drive the most spend
• Week-over-week regression detection - automatically flag query patterns that became more expensive this week vs last (medium / high / critical severity)
• Cost forecasting - per-warehouse credit projections for the next 1–30 days using linear regression on historical data
• AI query rewrites - submit any expensive query to your LLM and get back optimized SQL, root-cause analysis, clustering recommendations, and estimated savings %
• dbt model attribution - per-model credit and performance breakdown parsed from query_tag
• dbt Cloud integration - sync run metadata from dbt Cloud; cost breakdown by job and environment; model spend threshold alerts; manifest.json enrichment (owner, description, materialization, tags)
• GitHub Actions - built-in workflow to post dbt cost summaries as PR comments after every dbt run
• Resource monitor management - sync existing monitors, recommend quota sizes using p95 spend analysis, generate copy-paste CREATE RESOURCE MONITOR DDL, alert when monitors approach their limits
• Budget tracking - configurable per-user and per-role daily credit budgets with over-budget flagging
• Weekly digests delivered to Slack or email
• Clean web UI - dark-themed React dashboard, no BI tool required
• REST API - all data accessible via /api/* endpoints
• CLI - sync, config, and server management from the terminal

Quickstart

Option A - Docker (recommended)

# 1. Copy and edit the config
curl -O https://raw.githubusercontent.com/arunrajiah/frostwatch/main/frostwatch.yaml.example
cp frostwatch.yaml.example frostwatch.yaml
# Edit frostwatch.yaml with your Snowflake credentials and LLM API key

# 2. Start
docker compose up -d

# 3. Open the UI
open http://localhost:8000

Option B - pip

pip install frostwatch

# Initialize config
frostwatch config init
# Edit ~/.frostwatch/config.yaml with your credentials

# Start the server
frostwatch serve

Option C - from source

git clone https://github.com/arunrajiah/frostwatch
cd frostwatch

# Install Python package in editable mode
pip install -e ".[dev]"

# Build the frontend
cd frontend && npm install && npm run build && cd ..

# Initialize config
frostwatch config init

# Run
frostwatch serve --reload

Configuration

All config lives in ~/.frostwatch/config.yaml. Every field can also be set via environment variable with the FROSTWATCH_ prefix.

snowflake_account: "xy12345.us-east-1"
snowflake_user: "FROSTWATCH_USER"
snowflake_password: "your_password"
snowflake_role: "ACCOUNTADMIN"       # needs SELECT on ACCOUNT_USAGE

llm_provider: "anthropic"            # anthropic | openai | gemini | ollama
llm_api_key: "sk-ant-..."

slack_webhook_url: "https://hooks.slack.com/services/..."
email_recipients: ["ops@example.com"]

schedule_cron: "0 8 * * 1"          # weekly digest - Monday 8am
sync_cron: "0 */6 * * *"            # data sync - every 6 hours
credits_per_dollar: 3.0              # adjust for your Snowflake contract rate
snowflake_query_limit: 500           # queries fetched per sync

See frostwatch.yaml.example for the full reference.

Snowflake permissions

FrostWatch only reads from SNOWFLAKE.ACCOUNT_USAGE. The minimum required grant:

-- Create a dedicated role (recommended)
CREATE ROLE frostwatch_role;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE frostwatch_role;
GRANT ROLE frostwatch_role TO USER your_user;

The ACCOUNTADMIN role already has this access. No data is ever written to Snowflake.

LLM providers

FrostWatch is BYO-LLM. Your data never passes through a hosted proxy - it goes directly from your server to the LLM provider using the API key you supply.

CLI reference

frostwatch demo              Seed synthetic data and start server - no Snowflake needed
frostwatch serve             Start the web server (default: http://localhost:8000)
frostwatch serve --reload    Start with auto-reload for development
frostwatch sync              Run a one-off Snowflake sync
frostwatch config init       Create ~/.frostwatch/config.yaml from the example
frostwatch config show       Print current config (secrets masked)
frostwatch version           Print version

API

The REST API is available under /api. Interactive docs are at http://localhost:8000/docs when the server is running.

Key endpoints:

Architecture

┌─────────────┐     read-only     ┌──────────────────────────────────┐
│  Snowflake  │ ◄───────────────  │  frostwatch serve                │
│ ACCOUNT_    │                   │                                  │
│ USAGE views │                   │  FastAPI + APScheduler           │
└─────────────┘                   │  ├── /api/*  (REST)              │
                                  │  └── /       (React SPA)         │
┌─────────────┐                   │                                  │
│  LLM API    │ ◄───────────────  │  SQLite  (local cache + history) │
│ (your key)  │                   └──────────────────────────────────┘
└─────────────┘

FrostWatch runs entirely inside your infrastructure. The only outbound calls are to Snowflake and your chosen LLM provider.

Roadmap

See ROADMAP.md.

Sponsors

FrostWatch is free, MIT-licensed, self-hosted, and solo-maintained. It runs on your infrastructure with your LLM key - no SaaS contract, no percentage-of-spend pricing, no phone-home.

For data teams running FrostWatch in production: sponsorship is the sustainable replacement for paid FinOps tooling. A $500/month org sponsorship is roughly 1% of what Select.dev charges to monitor a $50k/month Snowflake spend, and it funds the project for everyone - including smaller teams and non-profits who can't justify either.

Sponsorship currently funds:

• Multi-account support (currently single-account; tracked in ROADMAP.md)
• Snowflake-native scheduled task migration helpers
• Expanded forecasting models beyond linear regression (seasonality, change-point detection)
• Direct integrations with PagerDuty / Opsgenie for real-time alerts

Suggested tiers:

• $25/month (individual) - keeps the project alive; shoutout in the next release notes
• $100/month (team) - priority issue triage + roadmap input
• $500/month (org) - your logo in the README + a quarterly call to discuss your team's Snowflake workflows

Who should sponsor: data engineering teams at companies running Snowflake, Snowflake consulting partners whose engagements include cost optimization, FinOps practices using FrostWatch in client work, and anyone whose Snowflake bill has surprised them in the last quarter.

Contributing

Contributions are welcome! Please open an issue before starting large changes so we can align on direction.

• Read CONTRIBUTING.md for setup instructions and PR guidelines
• Follow our Code of Conduct
• All PRs require passing CI (lint, type check, tests, frontend build) and one maintainer review

License

MIT - free to use, modify, and self-host. See the license file for details.