> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dema.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

> Let the Dema Agent query data, run Cortex AI tools, and execute SQL through your Snowflake account.

## Overview

Once Snowflake is connected, the Dema Agent can query data, run Cortex AI tools, and execute SQL through your Snowflake-managed MCP server. Useful for bringing governed warehouse data into an analysis alongside Dema metrics.

***

## Prerequisites

* A Snowflake account with an active Cortex MCP server deployed.
* A Snowflake role with permission to create security integrations (typically `ACCOUNTADMIN` or a role granted `CREATE INTEGRATION`).
* The database, schema, and name of your Cortex MCP server, plus your Snowflake account identifier in the form `{orgname}-{account}`, so you can build the MCP server URL.

***

## Connect Snowflake

<Steps>
  <Step title="Create an OAuth security integration in Snowflake">
    In a Snowflake worksheet, run the following. The `OAUTH_REDIRECT_URI` is the fixed Dema callback URL, which you will use again when you connect:

    ```sql theme={null}
    CREATE SECURITY INTEGRATION dema_agent
      TYPE = OAUTH
      ENABLED = TRUE
      OAUTH_CLIENT = CUSTOM
      OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
      OAUTH_REDIRECT_URI = 'https://app.dema.ai/agents/oauth/callback'
      OAUTH_ISSUE_REFRESH_TOKENS = TRUE
      OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;
    ```
  </Step>

  <Step title="Fetch the client ID and client secret">
    Run:

    ```sql theme={null}
    SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('DEMA_AGENT');
    ```

    Copy the `OAUTH_CLIENT_ID` and `OAUTH_CLIENT_SECRET` values from the result.
  </Step>

  <Step title="Paste the credentials into Dema">
    In Dema, go to **Agents → Settings → Integrations**, find **Snowflake**, and click **Connect**. Enter:

    * **Client ID** from the previous step
    * **Client secret** from the previous step
    * **MCP URL** in the form `https://{orgname}-{account}.snowflakecomputing.com/api/v2/databases/{db}/schemas/{schema}/mcp-servers/{name}`, using the database, schema, and name of your Cortex MCP server

    Click **Add**. Sign in to Snowflake and approve the authorization. You are returned to Dema with the integration marked as Active.
  </Step>
</Steps>

***

## Permissions

Dema does not request named OAuth scopes in Snowflake. The Snowflake-managed MCP server runs the session with the **authorizing user's `DEFAULT_ROLE`** — there is no role picker during sign-in, and secondary roles are not used. Grant that role only the access the agent should have.

A typical setup creates a dedicated role (for example `DEMA_AGENT_ROLE`) with `USAGE` on the warehouse, database, schema, and MCP server plus the per-tool grants (see [Troubleshooting](#mcp-server-access-errors)), then makes it the authorizing user's default:

```sql theme={null}
ALTER USER your_user SET DEFAULT_ROLE = DEMA_AGENT_ROLE;
```

<Warning>
  If the authorizing user's `DEFAULT_ROLE` is not the role you granted access to, the agent's requests will fail even when the grants are correct. The session always uses the default role.
</Warning>

***

## When the connection expires

The OAuth refresh token issued by the security integration is valid for up to 90 days (`OAUTH_REFRESH_TOKEN_VALIDITY = 7776000`, which is Snowflake's maximum). When it expires, Snowflake requires the user to authorize again.

To restore access, go to **Agents → Settings → Integrations**, find **Snowflake**, and click **Reconnect**, then sign in and approve. You do not need to recreate the security integration or re-enter the Client ID and secret unless they have changed.

***

## Troubleshooting

### Integration setup

* **Dema says the MCP URL is invalid.** The MCP URL must be HTTPS and must be on `.snowflakecomputing.com`. Use the `{orgname}-{account}` format (not a deprecated region-specific URL) and double-check the database, schema, and MCP server name.
* **Authorization fails.** Make sure the security integration is `ENABLED = TRUE` and that `OAUTH_REDIRECT_URI` is exactly `https://app.dema.ai/agents/oauth/callback`.

### MCP server access errors

If the agent cannot connect to your MCP server (error message: "MCP server does not exist or not authorized"), verify the following in your Snowflake account:

**Confirm the MCP server exists**

List all MCP servers in your schema:

```sql theme={null}
SHOW MCP SERVERS IN SCHEMA YOUR_DATABASE.YOUR_SCHEMA;
```

Or describe the specific server to verify its configuration:

```sql theme={null}
DESCRIBE MCP SERVER YOUR_DATABASE.YOUR_SCHEMA.YOUR_MCP_SERVER;
```

If the server does not exist, you need to [create an MCP server](https://docs.snowflake.com/en/sql-reference/sql/create-mcp-server) in Snowflake or update the database, schema, and name in your Dema integration settings.

**Verify role permissions**

The role you use to authorize the OAuth connection must have `USAGE` privilege on the MCP server, database, and schema. Check existing grants:

```sql theme={null}
SHOW GRANTS ON MCP SERVER YOUR_DATABASE.YOUR_SCHEMA.YOUR_MCP_SERVER;
```

If your role is missing the required privileges, grant them:

```sql theme={null}
GRANT USAGE ON MCP SERVER YOUR_DATABASE.YOUR_SCHEMA.YOUR_MCP_SERVER TO ROLE YOUR_ROLE;
GRANT USAGE ON DATABASE YOUR_DATABASE TO ROLE YOUR_ROLE;
GRANT USAGE ON SCHEMA YOUR_DATABASE.YOUR_SCHEMA TO ROLE YOUR_ROLE;
```

Note that `USAGE` on the MCP server does not automatically grant access to the tools configured within it. Each tool (Cortex Search, Cortex Analyst, etc.) requires its own permissions. See [Snowflake MCP server access control](https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp#access-control) for details.

**Check object name casing**

Snowflake converts unquoted identifiers to uppercase. If you created your database, schema, or MCP server with quoted names (for example `"MyDatabase"`), the MCP URL must match that casing exactly. Most setups use unquoted names, so the URL should use uppercase (for example `YOUR_DATABASE.YOUR_SCHEMA.YOUR_MCP_SERVER`).

***

## Additional resources

* [Snowflake Cortex MCP server overview](https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp)
* [Create an OAuth security integration](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-oauth-snowflake)
* [Create MCP server](https://docs.snowflake.com/en/sql-reference/sql/create-mcp-server)
* [SHOW MCP SERVERS](https://docs.snowflake.com/en/sql-reference/sql/show-mcp-servers)
* [DESCRIBE MCP SERVER](https://docs.snowflake.com/en/sql-reference/sql/desc-mcp-server)
* [SHOW GRANTS](https://docs.snowflake.com/en/sql-reference/sql/show-grants)