Codex and Snowflake: two ways to connect over MCP

There are two routes from Codex to Snowflake. Snowflake's own managed MCP server is a schema object you create with SQL and sign in to with OAuth. Contextflo connects once with a read-only role and gives Codex one URL. Both work from the terminal.

Option 1: Snowflake's managed MCP server in Codex

Snowflake lets you create an MCP server as a schema object. You define it with CREATE MCP SERVER ... FROM SPECIFICATION, and it can expose a SYSTEM_EXECUTE_SQL tool. The URL follows this pattern:

https://<account-identifier>.snowflakecomputing.com/api/v2/databases/<DB>/schemas/<SCHEMA>/mcp-servers/<NAME>

Auth is OAuth through a SECURITY INTEGRATION ... TYPE = OAUTH that lists your client's redirect URI. OAuth cannot use ACCOUNTADMIN, so create a role for it first. The full walkthrough is in Claude and Snowflake semantic views.

In Codex, point a server at that URL in ~/.codex/config.toml:

[mcp_servers.snowflake]
url = "https://<account-identifier>.snowflakecomputing.com/api/v2/databases/<DB>/schemas/<SCHEMA>/mcp-servers/<NAME>"

Option 2: Contextflo

Run this in Snowflake once. It creates a role, a user and a small warehouse:

• Role CONTEXTFLO_ROLE and user CONTEXTFLO_USER.
• An XSMALL warehouse with AUTO_SUSPEND = 60.
• USAGE on the database and schema.
• SELECT on ALL and FUTURE tables and views.
• Key-pair auth: ALTER USER CONTEXTFLO_USER SET RSA_PUBLIC_KEY='...'.

The FUTURE grants matter. Skip them and every new table stays invisible.

In Contextflo, go to Data Sources, then Add data source, and choose Snowflake. Enter the account identifier, warehouse, role, user and private key. Pick tables and invite your team.

In Codex:

[mcp_servers.contextflo]
url = "https://mcp.contextflo.com/mcp"

codex mcp login contextflo

Use codex mcp list to check it. Contextflo runs SELECT only, and the role stays read-only underneath.

Which one to use

Just you, with a Snowflake admin on hand: Option 1.

Your team asks too: Contextflo. It generates table and column descriptions, your team saves the definitions they agree on, access is per person, and you get an audit trail of prompts and the SQL that ran. QUERY_HISTORY alone only shows the service user.

On Claude? See Claude with Snowflake.

You do the modeling, we do the rest. Connect Snowflake free.

FAQ

Can I use ACCOUNTADMIN to connect Codex to Snowflake's MCP server? No. Snowflake's OAuth cannot use ACCOUNTADMIN. Create a dedicated role for the connection and grant it only what the agent should read.

Why can't Codex see my new Snowflake tables in Contextflo? Usually the grants are missing the FUTURE clause. Grant SELECT on ALL and FUTURE tables and views in the schema, otherwise tables created later stay invisible.

What does Snowflake's QUERY_HISTORY show for Codex queries? The SQL, under the service user. It does not show which person asked. Contextflo keeps an audit trail of prompts and the SQL that ran, per person.

Does Contextflo keep a Snowflake warehouse running? The setup uses an XSMALL warehouse with AUTO_SUSPEND = 60, so it suspends after 60 seconds of inactivity.