Snowflake

datarelix.ai connects to Snowflake through a read-only query service. All queries are validated and executed inside the MCP boundary — the LLM never sees credentials or executes raw SQL against your database.

Prerequisites

A Snowflake account.
A read-only role with USAGE on the warehouse, database, and schema, plus SELECT on the objects you want to analyze — see Snowflake access control.
A warehouse the role can use. An XS warehouse is usually sufficient. The warehouse must be resumable — Snowflake auto-suspends inactive warehouses; the role needs OPERATE privilege on the warehouse to resume it, otherwise the first query will fail with “Warehouse is suspended.”
A Snowflake user that can assume the role.
Network reachability. If the account has a network policy, add datarelix.ai’s egress IPs to its allowed list, or logins are rejected. Accounts locked to AWS/Azure PrivateLink (a *.privatelink.snowflakecomputing.com URL) accept connections only over the private endpoint and aren’t reachable from the hosted service.

Auth modes

Username & password

A Snowflake username and password authenticate the connection. The password is stored encrypted. Recommended path for service accounts.

Key-pair and OAuth auth are planned for a later release.

Setup — create a read-only role and user

Connect as an accountadmin or securityadmin and run:

-- Create the role
CREATE ROLE datarelix_reader;

-- Grant warehouse access (resume + use)
GRANT USAGE ON WAREHOUSE your_warehouse TO ROLE datarelix_reader;
GRANT OPERATE ON WAREHOUSE your_warehouse TO ROLE datarelix_reader;

-- Grant database and schema access
GRANT USAGE ON DATABASE your_database TO ROLE datarelix_reader;
GRANT USAGE ON SCHEMA your_database.your_schema TO ROLE datarelix_reader;

-- Grant SELECT on existing and future tables
GRANT SELECT ON ALL TABLES IN SCHEMA your_database.your_schema TO ROLE datarelix_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA your_database.your_schema TO ROLE datarelix_reader;

-- Create the user and assign the role
CREATE USER datarelix_reader
  PASSWORD = 'choose-a-strong-password'
  DEFAULT_ROLE = datarelix_reader
  DEFAULT_WAREHOUSE = your_warehouse;
GRANT ROLE datarelix_reader TO USER datarelix_reader;

The GRANT SELECT ON FUTURE TABLES ensures new tables added after the connection is created remain visible without a manual re-grant.

Where to find your credentials

Field	Where to get it
Account identifier	Snowsight UI → Admin → Accounts → copy the Account column value (preferred `orgname-account_name` form), or read it from your Snowflake web URL
Warehouse	Snowsight → Admin → Warehouses — copy the warehouse name
Database	Snowsight → Data → Databases — copy the database name
Role	The role you created above (e.g. `DATARELIX_READER`)
Schema	The schema you granted access to (e.g. `PUBLIC`)
Username	The user you created above
Password	The password you set in `CREATE USER`

Finding the account identifier

Snowflake supports two account identifier formats. The preferred modern form is orgname-account_name (e.g. myorg-prod1); the legacy form is <locator>[.<region>][.<cloud>]:

Cloud / region	Example	Notes
AWS US West (Oregon)	`xy12345`	No region segment — legacy exception.
AWS, any other region	`xy12345.us-east-2.aws`	Region + `.aws`.
Azure, any region	`xy12345.east-us-2.azure`	Region + `.azure`.
GCP, any region	`xy12345.us-central1.gcp`	Region + `.gcp`.

Both forms work in the connection form. Find yours under Admin → Accounts in Snowsight or from your Snowflake web URL (<locator>.<region>.snowflakecomputing.com).

What to enter

Account identifier:  myorg-prod1          (or legacy: xy12345.us-east-1.aws)
Warehouse:           YOUR_WAREHOUSE
Database:            YOUR_DATABASE
Role:                DATARELIX_READER
Schema:              PUBLIC
Username:            datarelix_reader
Password:            ••••••••

Scope semantics

The Schema field sets the connection’s allowed schema. datarelix.ai introspects and queries only inside that schema. If left blank, the connection defaults to PUBLIC.

To analyze multiple schemas in the same database, create one connection per schema.

Discovery

Fully supported. The introspector reads from <database>.information_schema to surface tables, columns, primary keys, and declared foreign keys.

Foreign keys are declaration-only. Snowflake does not enforce FK constraints on standard tables — they’re informational metadata. Discovery returns an empty relationship graph if your warehouse was created without declared FKs; that’s expected, not a discovery failure.

Snowflake SQL primer

Standard SQL with a few Snowflake-specific features the planner is aware of:

Identifiers — Unquoted identifiers fold to uppercase. Double-quote case-sensitive names.
Pagination — LIMIT n OFFSET m.
Window filters — Use QUALIFY, similar to HAVING for window functions.
Timestamps — TIMESTAMP_NTZ (no TZ), TIMESTAMP_LTZ (local), TIMESTAMP_TZ.
Semi-structured data — VARIANT, OBJECT, and ARRAY with LATERAL FLATTEN for unnesting.
Three-part names — DATABASE.SCHEMA.TABLE.

Limitations

Read-only — the validator rejects write and DDL statements at both the AST and text-keyword layers.
Multi-statement queries blocked — one SELECT/WITH/UNION per question. CTEs with multiple table references in a single WITH clause are fine.
System schemas blocked — INFORMATION_SCHEMA queries are allowed only during discovery; ACCOUNT_USAGE is always blocked.
Statement timeout — set per session (30 s default). Tune this if your warehouse routinely needs longer-running analytical queries.
Row limit — server-side cap of 5 000 rows by default.

Troubleshooting

Symptom	Likely cause	Fix
`390100: Incorrect username or password`	Bad credentials	Test from the Snowflake web UI first.
`Warehouse 'X' does not exist or not authorized`	Role missing `USAGE` on warehouse	`GRANT USAGE ON WAREHOUSE X TO ROLE Y`.
`Warehouse is suspended`	Role missing `OPERATE`	`GRANT OPERATE ON WAREHOUSE X TO ROLE Y`.
`Object does not exist` on discovery	Role missing `USAGE` on database/schema	`GRANT USAGE ON DATABASE`/`SCHEMA` to the role.
`IP ... is not allowed to access Snowflake`	Account network policy blocks the egress IP	Add datarelix.ai’s egress IPs to the account/user network policy allowed list.
`Statement timeout reached`	Query exceeded the session timeout	Narrow the question, add a `LIMIT`, or contact support to raise the timeout.
Discovery returns 0 tables	Role lacks `SELECT` on the schema’s objects	`GRANT SELECT ON ALL TABLES IN SCHEMA X TO ROLE Y` + `GRANT SELECT ON FUTURE TABLES IN SCHEMA X TO ROLE Y`.