diff --git a/guides/snowflake/external.md b/guides/snowflake/external.md index e1d36ee..b9d6626 100644 --- a/guides/snowflake/external.md +++ b/guides/snowflake/external.md @@ -4,7 +4,7 @@ setup_version: 1 # Snowflake setup -Use a Snowflake role/security administrator account to create and assign a non-privileged runtime role. You also need `ACCOUNTADMIN`, or an organization-approved delegated role with global `CREATE INTEGRATION`, for the OAuth integration only. Obtain the connecting usernames, default warehouse, approved MCP server object names, and an existing Cortex Agent's database, schema, name, and complete agent-tool grants from the security, application, and agent owners. Sign in at `https://app.snowflake.com`. +Use a Snowflake role/security administrator account to create and assign a non-privileged runtime role. You also need `ACCOUNTADMIN`, or an organization-approved delegated role with global `CREATE INTEGRATION`, for the OAuth integration only. Obtain the connecting usernames, default warehouse, approved MCP server object names, and an existing Cortex Agent's database, schema, name, and complete agent-tool grants from the security, application, and agent owners. You need an existing, approved MCP database and schema, or a Snowflake object or security owner who can create them. Obtain a server-creator role with `CREATE MCP SERVER` on the target schema, `USAGE` on the target database and schema, and `USAGE` on the existing Cortex Agent and its database and schema. Sign in at [app.snowflake.com](https://app.snowflake.com). Snowflake-managed MCP servers and Cortex Agents are unavailable in the People's Republic of China. Snowflake-managed MCP servers are also unsupported in government regions. @@ -13,7 +13,7 @@ Snowflake-managed MCP servers and Cortex Agents are unavailable in the People's 1. Select **Projects** > **Workspaces**. 2. Select **+** beside a folder, or select **+ Add New** on first use. 3. Select **SQL File**. -4. Select the organization-approved role for the statement group you are running. +4. In the workspace context controls, select the organization-approved role for the statement group you are running. 5. Select an available warehouse. 6. Before pasting any SQL from this guide, replace every complete angle-bracket placeholder, including the `<` and `>` characters, with the corresponding value supplied by the named owner. 7. Paste each completed statement into the blank SQL file. @@ -120,17 +120,19 @@ When a code block contains multiple statements, select and run each completed st ``` 11. Retain the exact MCP database, schema, and server name. -12. Select your user name. -13. Select **Connect a tool to Snowflake**. -14. In the **Account Details** dialog, copy **Account/Server URL**. -15. For ``, use the hostname from the copied value without the leading `https://` or a trailing `/`. -16. Form the account-specific MCP Server URL: +12. Ask the account or network security owner whether the Snowflake account uses PrivateLink. +13. Select your user name. +14. Select **Connect a tool to Snowflake**. +15. In the **Account Details** dialog, copy **Account/Server URL**. +16. If the account uses PrivateLink, have the account or network security owner confirm that the copied Account/Server hostname is the public hostname, not the PrivateLink hostname. +17. For ``, use the confirmed public Account/Server hostname from the copied value without the leading `https://` or a trailing `/`. `USE_PRIVATELINK_FOR_AUTHORIZATION_ENDPOINT = TRUE` affects browser authorization, not the public MCP Server URL. +18. Form the account-specific MCP Server URL: ``` https:///api/v2/databases//schemas//mcp-servers/ ``` -17. Retain the URL for the Speakeasy AI Control Plane setup. +19. Retain the URL for the Speakeasy AI Control Plane setup. diff --git a/guides/snowflake/meta.yaml b/guides/snowflake/meta.yaml index ca0ace2..f6053f4 100644 --- a/guides/snowflake/meta.yaml +++ b/guides/snowflake/meta.yaml @@ -43,104 +43,104 @@ provenance: locator: https://docs.snowflake.com/llms.txt name: Snowflake Documentation index classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/snowflake-cortex/llms.txt name: Snowflake Cortex documentation index classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp name: Snowflake-managed MCP server classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/sql/create-mcp-server name: CREATE MCP SERVER classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-setup name: Cortex Agents access control and authentication classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-manage name: Create and manage Cortex Agents classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/oauth-custom name: Configure Snowflake OAuth for custom clients classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/oauth-snowflake-overview name: Snowflake OAuth overview classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-oauth-snowflake name: CREATE SECURITY INTEGRATION (Snowflake OAuth) classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/functions/system_show_oauth_client_secrets name: SYSTEM$SHOW_OAUTH_CLIENT_SECRETS classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/querying-semistructured name: Querying semi-structured data classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/sql/create-role name: CREATE ROLE classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/sql/grant-role name: GRANT ROLE classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/sql/grant-database-role name: GRANT DATABASE ROLE classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/sql-reference/sql/grant-privilege name: GRANT privileges to role classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/ui-snowsight/workspaces name: Workspaces classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/ui-snowsight/workspaces-working name: Working with workspaces classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/admin-account-identifier name: Account identifiers classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-documentation locator: https://docs.snowflake.com/en/user-guide/gen-conn-config name: Configure a third-party application to connect to Snowflake classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: provider-quickstart locator: https://quickstarts.snowflake.com/guide/getting-started-with-snowflake-mcp-server/index.html name: Getting Started with Managed Snowflake MCP Server classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" - source: repository-doctrine locator: doctrine/speakeasy-setup.md name: Speakeasy setup canonical section classification: official - observed_at: "2026-07-28T23:57:42Z" + observed_at: "2026-08-11T18:36:01Z" diff --git a/guides/snowflake/pipeline.lock.json b/guides/snowflake/pipeline.lock.json index b521bc0..1b70f67 100644 --- a/guides/snowflake/pipeline.lock.json +++ b/guides/snowflake/pipeline.lock.json @@ -2,14 +2,14 @@ "schema_version": 1, "slug": "snowflake", "persona": "it-admin", - "runtime": "cursor-sdk", - "updated_at": "2026-07-29T00:01:51Z", + "runtime": "pi", + "updated_at": "2026-08-11T18:44:34Z", "steps": { "research": { - "input_digest": "sha256:716081a8071ba7fe66f05a033e13b3365e27070ebd2632f3d6237ec4be81e074", + "input_digest": "sha256:614d4e11f34097e887de369cec17ed3908a8cc0f82f88947ef50063dd0bbbb78", "inputs": { - "model": "gpt-5.6-sol", - "prompt_digest": "sha256:3b79ac335ee0b509b454301f3d8eb1d9665aea3729404aa00d65e08433e6b4e5", + "model": "openrouter/openai/gpt-5.6-sol", + "prompt_digest": "sha256:255c60266361ff6711b0b04829329485020218f5a0460f70aa30f30d9c1711fc", "reading_list": [ { "path": "doctrine/glossary.md", @@ -21,36 +21,36 @@ }, { "path": "doctrine/roles/technical-research.md", - "digest": "sha256:f82583e4ba9e92f061b09e6685b3a2640a1826f6fbc27ddac52e0db68387acaf" + "digest": "sha256:88f093f873c705128a0a31eb38be298a2ee11f4d50815552739925337f8ac3ad" }, { "path": "doctrine/speakeasy-setup.md", - "digest": "sha256:8715948a90f95187a2e093e3dfbaccb2870423ee7c90aed4eeba5c418c0bb85e" + "digest": "sha256:9f173facc7f63e450eb7e4d693c67c0a88e9ff68f0a381cfcbae413a8d47dd16" } ], "artifacts": [], "params": { "provider": "snowflake", - "notes": "Snowflake Cortex Agents MCP only; OAuth per https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp#set-up-oauth-authentication. Speakeasy MCP Catalog out of scope—no Pulse com.pulsemcp.mirror/gram-snowflake, no Mcp-Account-Identifier or forced catalog URL. Custom remote only (remotes[].tenanted: true): paste account-specific URL https:///api/v2/databases//schemas//mcp-servers/ from External setup. Before CREATE MCP SERVER, form as ... Decision 1 hedge: before namespace grants/SQL, reader must have an existing approved MCP database and schema or create them—soft wording if exact Snowflake UI unverified. Omit Speakeasy outbound IP allowlist unless verified.\n\nSpeakeasy MCP Catalog: overridden-tenanted" + "notes": "Refresh the existing guide due to lockfile drift; rerun research, draft, fidelity review, and achievability review under the pi runtime.\n\nSpeakeasy MCP Catalog: overridden-tenanted" } }, "outputs": [ { "path": "research.md", - "digest": "sha256:bffc3018db32b3cb8f6c1d36d297353bb5299f65318bbca9323ee761e8f9cd0b" + "digest": "sha256:edd4575a672cbb42e2fc138f6e4f7cc8953c75c360be5a1aa1afba012d82d903" }, { "path": "meta.yaml", - "digest": "sha256:9868ed58fc2b07ba320eb0be3a5ee13fa108f7bfceb7b0f81c8073cfedf7ab12" + "digest": "sha256:910ba19996924d9041a213bcd99ce530c62bc0b96ab12233daa804b06a66a32d" } ], - "completed_at": "2026-07-29T00:01:51Z" + "completed_at": "2026-08-11T18:44:34Z" }, "draft": { - "input_digest": "sha256:5dc6e0e2999383319fe07404230c605e30b3d1be72bfa7f7c34561b797e1d329", + "input_digest": "sha256:4a22791b04d0013fd066819f48b766373169405f3ce90c3945ee66cf7c7d53cf", "inputs": { - "model": "gpt-5.6-sol", - "prompt_digest": "sha256:bd455424d5c087fd914297fad0cf7749459452dbd94d00bd4e20e977e9fbb92b", + "model": "openrouter/openai/gpt-5.6-sol", + "prompt_digest": "sha256:ad649d12e8bf3882a1593555c0c4d31681ac50aa891177b1a8f766a563d85d6c", "reading_list": [ { "path": "doctrine/glossary.md", @@ -62,46 +62,46 @@ }, { "path": "doctrine/roles/writer.md", - "digest": "sha256:7b88b10bd5ce607985054abbdce5e6b742acc7074c1461f08d34321523e17799" + "digest": "sha256:4214af68feea7dfc68fab1058e1d5d35e6238d5b51fd9b10db421ebafc49a3cc" }, { "path": "doctrine/personas/it-admin.md", - "digest": "sha256:b76dc61236fa5c56390354a0d51d5b5ee666395bb65a2e993b79bd9aa9c1fd0d" + "digest": "sha256:38c1356b43c9e5f92527f9b73e8561a62cb2eb636b675796af49d0b6015dd9be" } ], "artifacts": [ { "path": "research.md", - "digest": "sha256:bffc3018db32b3cb8f6c1d36d297353bb5299f65318bbca9323ee761e8f9cd0b" + "digest": "sha256:edd4575a672cbb42e2fc138f6e4f7cc8953c75c360be5a1aa1afba012d82d903" }, { "path": "meta.yaml", - "digest": "sha256:9868ed58fc2b07ba320eb0be3a5ee13fa108f7bfceb7b0f81c8073cfedf7ab12" + "digest": "sha256:910ba19996924d9041a213bcd99ce530c62bc0b96ab12233daa804b06a66a32d" } ], "params": { "provider": "snowflake", - "notes": "Snowflake Cortex Agents MCP only; OAuth per https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp#set-up-oauth-authentication. Speakeasy MCP Catalog out of scope—no Pulse com.pulsemcp.mirror/gram-snowflake, no Mcp-Account-Identifier or forced catalog URL. Custom remote only (remotes[].tenanted: true): paste account-specific URL https:///api/v2/databases//schemas//mcp-servers/ from External setup. Before CREATE MCP SERVER, form as ... Decision 1 hedge: before namespace grants/SQL, reader must have an existing approved MCP database and schema or create them—soft wording if exact Snowflake UI unverified. Omit Speakeasy outbound IP allowlist unless verified.\n\nSpeakeasy MCP Catalog: overridden-tenanted", + "notes": "Refresh the existing guide due to lockfile drift; rerun research, draft, fidelity review, and achievability review under the pi runtime.\n\nSpeakeasy MCP Catalog: overridden-tenanted", "persona": "it-admin" } }, "outputs": [ { "path": "external.md", - "digest": "sha256:a2a37655c927c5307c9cbee84b3e8a4dae6e33bc6f4b0d7b9cdc813e965ef9da" + "digest": "sha256:05acdfe85b8d73e9c8b0762bed43f0b03e11e544e0940b3056ed710b6806184e" }, { "path": "speakeasy.md", - "digest": "sha256:9651c37085d01c1dd98e2c4f96e7a7b16a848265b03bbf7ad4d52d2bafa65268" + "digest": "sha256:eedeee79459220cdf53676503297b1aa20e63759ec884f3e80d80af6d98ea494" } ], - "completed_at": "2026-07-29T00:01:51Z" + "completed_at": "2026-08-11T18:44:34Z" }, "review.fidelity": { - "input_digest": "sha256:9141cb5e7bf62967749df56e4991d8fa47bb45cdcddb6325b5a72e361b7c7936", + "input_digest": "sha256:d994310d3544276bbc67e96a632b17274d755b3211079b8934405f80dda20647", "inputs": { - "model": "gpt-5.6-sol", - "prompt_digest": "sha256:cb91cacc0c50621e5c913643f99937071ea75c9a7c0856ff8c6cc70fc568d861", + "model": "openrouter/openai/gpt-5.6-sol", + "prompt_digest": "sha256:2885ba720bba92fbed782f1ac13fdbd065c3f1a294302ee85792fc4f61866e1f", "reading_list": [ { "path": "doctrine/glossary.md", @@ -113,30 +113,30 @@ }, { "path": "doctrine/roles/fidelity.md", - "digest": "sha256:472ec8a2db648c822d126dea857d3f79e9c97a8e9b5fe6a997170bef3c8d2c22" + "digest": "sha256:f1c64906d2702d25c5db118f0a1a471b4962333a506c235ffebccf67413aa7f3" } ], "artifacts": [ { "path": "research.md", - "digest": "sha256:bffc3018db32b3cb8f6c1d36d297353bb5299f65318bbca9323ee761e8f9cd0b" + "digest": "sha256:edd4575a672cbb42e2fc138f6e4f7cc8953c75c360be5a1aa1afba012d82d903" }, { "path": "meta.yaml", - "digest": "sha256:9868ed58fc2b07ba320eb0be3a5ee13fa108f7bfceb7b0f81c8073cfedf7ab12" + "digest": "sha256:910ba19996924d9041a213bcd99ce530c62bc0b96ab12233daa804b06a66a32d" }, { "path": "external.md", - "digest": "sha256:a2a37655c927c5307c9cbee84b3e8a4dae6e33bc6f4b0d7b9cdc813e965ef9da" + "digest": "sha256:05acdfe85b8d73e9c8b0762bed43f0b03e11e544e0940b3056ed710b6806184e" }, { "path": "speakeasy.md", - "digest": "sha256:9651c37085d01c1dd98e2c4f96e7a7b16a848265b03bbf7ad4d52d2bafa65268" + "digest": "sha256:eedeee79459220cdf53676503297b1aa20e63759ec884f3e80d80af6d98ea494" } ], "params": { "provider": "snowflake", - "notes": "Snowflake Cortex Agents MCP only; OAuth per https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp#set-up-oauth-authentication. Speakeasy MCP Catalog out of scope—no Pulse com.pulsemcp.mirror/gram-snowflake, no Mcp-Account-Identifier or forced catalog URL. Custom remote only (remotes[].tenanted: true): paste account-specific URL https:///api/v2/databases//schemas//mcp-servers/ from External setup. Before CREATE MCP SERVER, form as ... Decision 1 hedge: before namespace grants/SQL, reader must have an existing approved MCP database and schema or create them—soft wording if exact Snowflake UI unverified. Omit Speakeasy outbound IP allowlist unless verified.\n\nSpeakeasy MCP Catalog: overridden-tenanted", + "notes": "Refresh the existing guide due to lockfile drift; rerun research, draft, fidelity review, and achievability review under the pi runtime.\n\nSpeakeasy MCP Catalog: overridden-tenanted", "persona": "it-admin", "dimension": "fidelity" } @@ -144,20 +144,20 @@ "outputs": [ { "path": "external.md", - "digest": "sha256:a2a37655c927c5307c9cbee84b3e8a4dae6e33bc6f4b0d7b9cdc813e965ef9da" + "digest": "sha256:05acdfe85b8d73e9c8b0762bed43f0b03e11e544e0940b3056ed710b6806184e" }, { "path": "speakeasy.md", - "digest": "sha256:9651c37085d01c1dd98e2c4f96e7a7b16a848265b03bbf7ad4d52d2bafa65268" + "digest": "sha256:eedeee79459220cdf53676503297b1aa20e63759ec884f3e80d80af6d98ea494" } ], - "completed_at": "2026-07-29T00:01:51Z" + "completed_at": "2026-08-11T18:44:34Z" }, "review.achievability": { - "input_digest": "sha256:827b40987fe36d2caea235ed8e115192b96f8f7252366a8f76ca3ab3a38a44c8", + "input_digest": "sha256:9b83534c57e62988ae99e4442f7c5927bc5c382205474203f2b619b46fcaf98e", "inputs": { - "model": "gpt-5.6-sol", - "prompt_digest": "sha256:5da0cf6dfcf7d6cc8a083825cd048f87c4d0ce7442683b67981efb98b8a97ca3", + "model": "openrouter/openai/gpt-5.6-sol", + "prompt_digest": "sha256:0b287f892ece7611416030973e4b1952db4c173e3023930bf238685d39b79cdf", "reading_list": [ { "path": "doctrine/glossary.md", @@ -173,30 +173,30 @@ }, { "path": "doctrine/personas/it-admin.md", - "digest": "sha256:b76dc61236fa5c56390354a0d51d5b5ee666395bb65a2e993b79bd9aa9c1fd0d" + "digest": "sha256:38c1356b43c9e5f92527f9b73e8561a62cb2eb636b675796af49d0b6015dd9be" } ], "artifacts": [ { "path": "research.md", - "digest": "sha256:bffc3018db32b3cb8f6c1d36d297353bb5299f65318bbca9323ee761e8f9cd0b" + "digest": "sha256:edd4575a672cbb42e2fc138f6e4f7cc8953c75c360be5a1aa1afba012d82d903" }, { "path": "meta.yaml", - "digest": "sha256:9868ed58fc2b07ba320eb0be3a5ee13fa108f7bfceb7b0f81c8073cfedf7ab12" + "digest": "sha256:910ba19996924d9041a213bcd99ce530c62bc0b96ab12233daa804b06a66a32d" }, { "path": "external.md", - "digest": "sha256:a2a37655c927c5307c9cbee84b3e8a4dae6e33bc6f4b0d7b9cdc813e965ef9da" + "digest": "sha256:05acdfe85b8d73e9c8b0762bed43f0b03e11e544e0940b3056ed710b6806184e" }, { "path": "speakeasy.md", - "digest": "sha256:9651c37085d01c1dd98e2c4f96e7a7b16a848265b03bbf7ad4d52d2bafa65268" + "digest": "sha256:eedeee79459220cdf53676503297b1aa20e63759ec884f3e80d80af6d98ea494" } ], "params": { "provider": "snowflake", - "notes": "Snowflake Cortex Agents MCP only; OAuth per https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp#set-up-oauth-authentication. Speakeasy MCP Catalog out of scope—no Pulse com.pulsemcp.mirror/gram-snowflake, no Mcp-Account-Identifier or forced catalog URL. Custom remote only (remotes[].tenanted: true): paste account-specific URL https:///api/v2/databases//schemas//mcp-servers/ from External setup. Before CREATE MCP SERVER, form as ... Decision 1 hedge: before namespace grants/SQL, reader must have an existing approved MCP database and schema or create them—soft wording if exact Snowflake UI unverified. Omit Speakeasy outbound IP allowlist unless verified.\n\nSpeakeasy MCP Catalog: overridden-tenanted", + "notes": "Refresh the existing guide due to lockfile drift; rerun research, draft, fidelity review, and achievability review under the pi runtime.\n\nSpeakeasy MCP Catalog: overridden-tenanted", "persona": "it-admin", "dimension": "achievability" } @@ -204,14 +204,14 @@ "outputs": [ { "path": "external.md", - "digest": "sha256:a2a37655c927c5307c9cbee84b3e8a4dae6e33bc6f4b0d7b9cdc813e965ef9da" + "digest": "sha256:05acdfe85b8d73e9c8b0762bed43f0b03e11e544e0940b3056ed710b6806184e" }, { "path": "speakeasy.md", - "digest": "sha256:9651c37085d01c1dd98e2c4f96e7a7b16a848265b03bbf7ad4d52d2bafa65268" + "digest": "sha256:eedeee79459220cdf53676503297b1aa20e63759ec884f3e80d80af6d98ea494" } ], - "completed_at": "2026-07-29T00:01:51Z" + "completed_at": "2026-08-11T18:44:34Z" } } } diff --git a/guides/snowflake/research.md b/guides/snowflake/research.md index 58c4875..f57e114 100644 --- a/guides/snowflake/research.md +++ b/guides/snowflake/research.md @@ -1,7 +1,7 @@ --- research_version: 1 slug: snowflake -researched_at: 2026-07-28T23:57:42Z +researched_at: 2026-08-11T18:36:01Z --- # Snowflake — Research Dossier @@ -110,9 +110,11 @@ Registration, so the manually registered client ID and secret are required. - Select **Projects** > **Workspaces**. - Select **+** beside a folder (or **+ Add New** on first use), then select **SQL File**. This opens a blank SQL file as an editor tab. -- Select an available warehouse and the organization-approved role for each - statement group below. Do not leave `ACCOUNTADMIN` selected after creating - the OAuth integration. +- Use the workspace context controls to select an available warehouse and the + organization-approved role for each statement group below. Snowflake's + public Workspaces documentation does not publish a stable label or path for + the role selector. Do not leave `ACCOUNTADMIN` selected after creating the + OAuth integration. - For every SQL statement below, replace each complete angle-bracket placeholder, including the `<` and `>` characters, with the corresponding owner-supplied value. Paste the completed statement into the SQL file, @@ -237,11 +239,17 @@ Registration, so the manually registered client ID and secret are required. - Retain the exact MCP database, schema, and server name. Snowflake's endpoint shape is `https:///api/v2/databases//schemas//mcp-servers/`. +- Before obtaining the account URL, ask the account or network security owner + whether the Snowflake account uses PrivateLink. If it does, have that owner + confirm that the **Account/Server URL** you will copy is the public hostname, + not the PrivateLink hostname. - To obtain the account URL in Snowsight, select your user name, select **Connect a tool to Snowflake**, and locate the **Account Details** dialog. - Copy **Account/Server URL**. For ``, use the hostname from that - copied value without the leading `https://` or a trailing `/`; the MCP - endpoint template already supplies the scheme. + Copy **Account/Server URL**. For ``, use the confirmed public + Account/Server hostname without the leading `https://` or a trailing `/`; + the MCP endpoint template already supplies the scheme. + `USE_PRIVATELINK_FOR_AUTHORIZATION_ENDPOINT = TRUE` affects the browser + authorization endpoint, not the public MCP Server URL. - Form the account-specific MCP Server URL from that hostname and the retained MCP database, schema, and server name, then retain it for {#add-server-in-speakeasy}. @@ -370,8 +378,9 @@ provider's catalog entry. From the server's **Overview**, open **Settings**. Under **Authentication**, click **Configure Manually**. In the **Attach Remote Identity Provider** -sheet, set **Client Type** to **Manual**. Confirm the displayed -**Redirect URI** matches the callback registered in Snowflake. Paste the +sheet, set **Client Type** to **Manual**. The sheet displays the +**Redirect URI** with a copy button. Confirm that URI matches the callback +registered in Snowflake. Paste the values from {#copy-oauth-credentials} into **Client ID** and **Client Secret (optional)**, then click **Attach Identity Provider**. @@ -388,7 +397,10 @@ limits — see Snowflake's MCP documentation at ## Open questions -None. +- Snowflake's public Workspaces documentation shows role and warehouse context + controls but does not publish a stable label or navigation path for the role + selector. The walkthrough therefore refers conceptually to the workspace + role context control rather than inventing a UI label. ## Provenance @@ -405,7 +417,8 @@ None. - **Indexes:** `https://docs.snowflake.com/llms.txt` and `https://docs.snowflake.com/en/user-guide/snowflake-cortex/llms.txt`. -All sources were observed at `2026-07-28T23:57:42Z`. +All sources were re-observed at `2026-08-11T18:36:01Z`. The official +pages and indexes remained reachable, and the setup facts above were unchanged. - `https://docs.snowflake.com/llms.txt` — documentation-property inventory and account URL guidance. diff --git a/guides/snowflake/speakeasy.md b/guides/snowflake/speakeasy.md index 7e10336..39bd0a5 100644 --- a/guides/snowflake/speakeasy.md +++ b/guides/snowflake/speakeasy.md @@ -10,17 +10,18 @@ This creates the hosted MCP server and opens its **Overview** page. - + ### Connect your credentials {#connect-speakeasy-credentials} 1. From the server's **Overview**, open **Settings**. 2. Under **Authentication**, click **Configure Manually**. 3. In the **Attach Remote Identity Provider** sheet, set **Client Type** to **Manual**. -4. Confirm that the displayed **Redirect URI** matches the `{{ gram.oauth.callback_url }}` value registered in [Create the OAuth integration](external.md#create-oauth-integration). -5. Paste the [**Client ID**](external.md#copy-oauth-credentials) into **Client ID**. -6. Paste the [**Client Secret**](external.md#copy-oauth-credentials) into **Client Secret (optional)**. -7. Click **Attach Identity Provider**. +4. Locate the displayed **Redirect URI** and its copy button. +5. Confirm that the displayed **Redirect URI** matches the `{{ gram.oauth.callback_url }}` value registered in [Create the OAuth integration](external.md#create-oauth-integration). +6. Paste the [**Client ID**](external.md#copy-oauth-credentials) into **Client ID**. +7. Paste the [**Client Secret**](external.md#copy-oauth-credentials) into **Client Secret (optional)**. +8. Click **Attach Identity Provider**. diff --git a/retro/runs/2026-08-11T18:36:01Z-snowflake.json b/retro/runs/2026-08-11T18:36:01Z-snowflake.json new file mode 100644 index 0000000..7c07ac6 --- /dev/null +++ b/retro/runs/2026-08-11T18:36:01Z-snowflake.json @@ -0,0 +1,89 @@ +{ + "slug": "snowflake", + "provider": "snowflake", + "persona": "it-admin", + "timestamp": "2026-08-11T18:36:01Z", + "started_at": "2026-08-11T18:36:01Z", + "finished_at": "2026-08-11T18:44:34Z", + "runtime": "pi", + "status": "converged", + "rounds": 3, + "nits": [], + "open_questions": [], + "history": [ + { + "round": 1, + "blockers": [ + { + "severity": "blocker", + "target": "external", + "where": "create-cortex-agent-mcp-server", + "problem": "The Dossier specifies that SaaS clients must use the public MCP URL, but the External setup does not distinguish the required public account hostname from a PrivateLink hostname when forming the URL.", + "suggestion": "In the URL-forming steps, explicitly direct PrivateLink-account readers to use the public Account/Server hostname for the MCP Server URL and clarify that the PrivateLink integration property affects browser authorization rather than the MCP URL.", + "dimension": "fidelity" + }, + { + "severity": "blocker", + "target": "research", + "where": "Speakeasy setup > Connect your credentials", + "problem": "The transcluded manual OAuth skeleton omits the canonical fact that the Attach Remote Identity Provider sheet displays the Redirect URI with a copy button.", + "suggestion": "Update the Dossier's Speakeasy credential section to carry the current manual OAuth skeleton from doctrine/speakeasy-setup.md, including the Redirect URI copy-button fact, while retaining Snowflake-specific field origins.", + "dimension": "fidelity" + } + ], + "nits": [ + { + "severity": "nit", + "target": "research", + "where": "Open questions / external.md#open-snowflake-workspace", + "problem": "The guide repeatedly tells the reader to select or switch Snowflake roles without recording the exact role-selector control or documenting that Snowflake's public documentation does not publish a stable label for it.", + "suggestion": "Record the documented role-switching control label and path in the Research Dossier, or add an open question noting public-docs silence and render a concise conceptual hedge in the workspace section.", + "dimension": "achievability" + } + ], + "revision_notes": "Blocker (external/create-cortex-agent-mcp-server): clarified in research.md and external.md that PrivateLink accounts must use the public Account/Server hostname for the MCP Server URL, and that USE_PRIVATELINK_FOR_AUTHORIZATION_ENDPOINT affects browser authorization rather than the MCP URL. Blocker (research/Speakeasy credentials): updated the Research Dossier’s manual OAuth flow to record that the Attach Remote Identity Provider sheet displays Redirect URI with a copy button, then rendered that fact in speakeasy.md. Nit (research/open-snowflake-workspace): recorded public-documentation silence about a stable role-selector label/path as an open question and added a concise conceptual workspace-context hedge in research.md and external.md. Existing anchors, titles, ordering, Custom-remote-only path, and provenance timestamp were preserved.", + "disputed": [], + "skipped": [] + }, + { + "round": 2, + "blockers": [ + { + "severity": "blocker", + "target": "external", + "where": "Opening prose beneath “# Snowflake setup”", + "problem": "The opening prose omits the required existing MCP database and schema—or an owner who can create them—and a server-creator role with delegated MCP creation privileges recorded in the Dossier and Metadata.", + "suggestion": "Add these prerequisites to the opening prose, including the need for `CREATE MCP SERVER` on the target schema and namespace and Cortex Agent access for the creator role.", + "dimension": "fidelity" + }, + { + "severity": "blocker", + "target": "external", + "where": "create-cortex-agent-mcp-server, steps 14–17", + "problem": "The reader must choose a public hostname before the guide tells them to ask whether the account uses PrivateLink, so an administrator who does not already know the network configuration can form the wrong MCP Server URL.", + "suggestion": "Before forming the URL, instruct the reader to ask the account or network security owner whether PrivateLink is enabled and, when it is, have that owner confirm that the copied Account/Server hostname is the public hostname rather than the PrivateLink hostname.", + "dimension": "achievability" + } + ], + "nits": [], + "revision_notes": "Opening prose: added the existing approved MCP database/schema prerequisite (or an owner who can create them) and the server-creator role’s required CREATE MCP SERVER, namespace, and Cortex Agent access. PrivateLink ordering: updated the Dossier and external walkthrough to ask the account/network security owner about PrivateLink before copying or forming the URL, and to require owner confirmation that a copied hostname is public rather than PrivateLink.", + "disputed": [], + "skipped": [] + }, + { + "round": 3, + "blockers": [], + "nits": [] + } + ], + "research_change": { + "method": "judge", + "unchanged": false, + "notes": "operator notes changed since lock; keeping AFTER and treating as changed for skip. judge: AFTER is draft-equivalent to BEFORE. Anchors, credential flow, remote URL and transport, tenanted Custom remote server path, prerequisites, Speakeasy setup facts, and provenance-backed claims are unchanged. Differences are limited to researched_at/observed_at timestamp refreshes and a provenance note confirming the sources remained reachable and setup facts unchanged." + }, + "notes_digest": "sha256:ffc943311a21d826614a53709fcfdd912146ca217296218253c307dfc3eeca17", + "setup_churn": { + "external_md_lines": 0, + "speakeasy_md_lines": 0 + } +}