LABSCO SUMMARY

Two layers of read-only instead of one.

You could get the same guarantee from a Snowflake role with no write grants, and you should still do that — but roles get edited and reused, and a keyword filter in the server is a second lock that does not depend on someone else's decision. The narrowing on table names is the same instinct applied to injection. What you give up is anything that needs a temp table or a session setting, which is the honest price of the restriction.

What it is

A Snowflake client for assistants that only reads. The restriction is enforced in the server rather than left to the warehouse role: a list of SQL keywords is rejected outright, and table names are constrained to alphanumerics, underscores and dots. Connection details go in as a single JSON string on the command line.

What you get

Read-only query access to a Snowflake database, warehouse, schema and role you specify
A rejected-keyword list covering INSERT, UPDATE, DELETE, DROP, TRUNCATE, ALTER, CREATE, GRANT, REVOKE, COMMIT and ROLLBACK
Table names restricted to alphanumeric characters, underscores and dots
Docker and uvx launch paths

Requirements

Snowflake credentials passed as a --connection JSON string containing account, user, password, warehouse, database, schema and role. Run it with uvx mcp-snowflake-reader (package mcp-snowflake-reader). The connection string carries a password in your client config, so protect that file the way you would any credential store.

Setup effort

Add the configuration to your client

See installation options

USE CASES

01

Letting an analyst ask the warehouse questions directly

Run SELECT queries against the database and schema you scoped it to.

02

Exploring a schema you did not build

Read the tables and columns before writing anything against them.

03

Connecting a model to production data without a write path

Rely on the blocked-keyword list alongside a read-only Snowflake role.

BEFORE YOU INSTALL

What to know first

Requires

uvx on PATH

Where it runs

Both documented clients run the server on your machine.

INSTALLATION

Connect your client

MCP Clients

Cursor, Claude Desktop

JSON

{
  "mcpServers": {
    "mcp-snowflake-reader": {
      "command": "uvx",
      "args": [
        "mcp-snowflake-reader",
        "--connection",
        "{\"account\":\"<YOUR_ACCOUNT>\",\"user\":\"<YOUR_USER>\",\"password\":\"<YOUR_PASSWORD>\",\"warehouse\":\"<YOUR_WAREHOUSE>\",\"database\":\"<YOUR_DATABASE>\",\"schema\":\"<YOUR_SCHEMA>\",\"role\":\"<YOUR_ROLE>\"}"
      ]
    }
  }
}

MCP Snowflake Reader