Governed AI agents on Snowflake: what Cortex Tools means for your team
As of October 20, 2026
What it is
On October 19, 2026, Snowflake announced the preview of Cortex Tools, a part of Cortex AI Gateway. It connects the AI clients your organization uses to the business tools your work already lives in, using the Model Context Protocol (MCP).
Governed MCP servers can be used from Cortex Code (CoCo Desktop and CoCo CLI), Claude, and Cursor. The curated catalog includes servers for Atlassian, GitHub, Google Workspace, Salesforce, Slack, and Snowflake. A custom MCP server that is not in the catalog can be added by URL. Complete any provider-specific setup before enabling a server. In Snowsight, the entry point is AI & ML, then AI Gateway, then MCP & Tools.
Why governance matters for agents
An agent that can call business tools needs a boundary. An administrator chooses which MCP servers users can reach, and which tools each server exposes. You can allow read-only tools and leave write and delete tools unavailable. That is an allowlist per server.
Tool-call activity is reviewed in the customer's Snowflake account with the AGENT_TRACE_TABLE table function, or in the Activity catalog. The allowlist and that audit trail are the governance record, and that data stays in the customer's account.
Caveats
- Preview. Cortex Tools is in preview as of the October 19, 2026 release note. Do not plan on it as a generally available feature.
- Only ACCOUNTADMIN can administer it. As of that release note, only users with the
ACCOUNTADMINrole can administer MCP servers in Cortex Tools. Plan role design and least privilege before you enable servers. Administration and use are not the same grant: to distribute access, grant theSNOWFLAKE$OPS.MCP$USERdatabase role to each account role that should reach an enabled server. Users still complete any required authorization with the third-party service. - Test in non-prod. Try the servers and the allowlist in a non-prod Snowflake account before you enable them for a production role.
Rollout checklist
- Inventory the agents and tools teams want. List the clients (Cortex Code, Claude, and Cursor) and the MCP servers those teams expect to call, including any custom server you would add by URL.
- Start with a minimal allowlist. Enable one server, and expose only the tools that the team needs. Prefer read-only tools until a write is an explicit decision.
- Review AGENT_TRACE_TABLE regularly. Use the
AGENT_TRACE_TABLEtable function, or the Activity catalog, to see which tools were called. - Manage the configuration as code. Keep the server and tool configuration in Terraform, and promote it through CI/CD such as Azure DevOps Pipelines or GitHub Actions.
- Run in non-prod first. Confirm the allowlist and the audit trail in a non-prod Snowflake account before the same configuration reaches production.
- Align with existing governed semantic views. When an agent also answers from warehouse data, keep those answers on the governed semantic views the account already uses, so tools and metrics share the same definitions.
MyOrgLab builds governed AI and analytics in the customer's account. That work still sits on sound data infrastructure: Terraform, CI/CD, dbt, agile delivery, Azure DevOps, GitHub Actions, and Airflow.
Sources
Snowflake and Cortex are trademarks of Snowflake Inc.; MyOrgLab is not affiliated.