Connecting Grok to Snowflake: managed MCP server or Contextflo

Grok can query Snowflake through a custom connector. One route is a Snowflake-managed MCP server that you create in your account and sign in to with OAuth. The other is Contextflo, which connects to Snowflake with a read-only role and hands Grok a single URL.

If the people asking are on the business side, the second route usually saves a lot of back and forth. Nobody has to learn what a security integration is.

Option 1: Snowflake's managed MCP server in Grok

Snowflake lets you create an MCP server as a schema object. You define it with CREATE MCP SERVER ... FROM SPECIFICATION and give it a SYSTEM_EXECUTE_SQL tool. Its URL follows this pattern:

https://<account-identifier>.snowflakecomputing.com/api/v2/databases/<DB>/schemas/<SCHEMA>/mcp-servers/<NAME>

Sign-in uses OAuth through a SECURITY INTEGRATION ... TYPE = OAUTH, set up with the redirect URI of the client you are connecting. OAuth can't use ACCOUNTADMIN, so create a role for it.

The full walkthrough, with the SQL, is in Claude and Snowflake semantic views. The Snowflake side is the same for any client. Only the redirect URI changes.

Then in Grok:

1. Open grok.com/connectors.
2. Choose New Connector, then Custom.
3. Enter your MCP server URL.
4. Complete the sign-in.

The Snowflake hostname is public, so Grok can reach it. Grok cannot run a local server, so any stdio MCP package for Snowflake is not an option here.

Option 2: Contextflo

Contextflo reaches Snowflake with a role you create once.

On the Snowflake side:

• A role, CONTEXTFLO_ROLE, and a user, CONTEXTFLO_USER.
• An XSMALL warehouse with AUTO_SUSPEND = 60.
• USAGE on the database and schema, and SELECT on ALL and FUTURE tables and views.
• Key-pair auth: ALTER USER CONTEXTFLO_USER SET RSA_PUBLIC_KEY='...'.

Do not skip the FUTURE grants. Without them, any table created later is invisible.

In Contextflo: go to Data Sources, then Add data source, and pick Snowflake. Enter the account identifier, warehouse, role, user and private key. Pick tables and invite your team.

In Grok: add a custom connector at grok.com/connectors with:

https://mcp.contextflo.com/mcp

Everyone signs in with their own account. Contextflo runs SELECT only.

Which one to use

Just you and comfortable with Snowflake admin: option 1. Your team asks too: Contextflo. The Claude version of this setup is in connecting Claude to Snowflake.

You do the modeling, we do the rest. Connect Snowflake free.

FAQ

Does Snowflake have an MCP server Grok can use? Yes. Snowflake can host an MCP server as a schema object, with a URL on your account's snowflakecomputing.com domain. Because it is on the public internet, a Grok custom connector can reach it once OAuth is set up.

Why can't I use ACCOUNTADMIN to sign in to the Snowflake MCP server? OAuth can't use ACCOUNTADMIN, so create a dedicated role for the connection and grant it only what the MCP server needs.

Why do new Snowflake tables not show up in Contextflo? Usually the FUTURE grants are missing. Grant SELECT on ALL and FUTURE tables and views in the schema, or tables created after the grant stay invisible.

Will Snowflake's QUERY_HISTORY show who asked the question in Grok? No. QUERY_HISTORY shows the SQL under the service user. Contextflo keeps an audit trail of the prompt and the SQL that ran for each person.