Learn how ChatGPT workspace admins and ChatGPT Plus or Pro users can connect ChatGPT to a Snowflake-managed MCP server.

Use this guide if you are a ChatGPT workspace admin or a ChatGPT Plus or Pro user who wants to connect ChatGPT to Snowflake through a Snowflake-managed MCP server.

Most of the setup happens in Snowflake. After Snowflake is ready, complete the Snowflake template connection in ChatGPT, then enable the Snowflake plugin that uses that template.

What you are setting up

You are creating a Snowflake-managed MCP server that acts as the connector endpoint for ChatGPT. The MCP server defines:

Which actions ChatGPT can use
Which Snowflake data or objects those tools can access.
Which Snowflake role each user authorizes with.
Which Snowflake database, schema, and MCP server name identify the endpoint.

You then configure Snowflake - Official Template in ChatGPT with the full managed MCP server URL. The template setup screen may show the URL as four separate fields:

Snowflake host prefix.
Database.
Schema.
MCP server name.

ChatGPT can only discover and use tools exposed by the MCP server and allowed by the Snowflake role that the user authorizes with.

Before you start

You need:

ChatGPT workspace admin or owner access, or ChatGPT Plus or Pro access.
Snowflake access that can create MCP server objects and grant permissions.
The Snowflake database and schema where the MCP server will live.
A decision about what ChatGPT should be allowed to do, such as Cortex Search, Cortex Analyst, read-only SQL, or a specific procedure or function.
A least-privilege Snowflake role that users will use when authorizing the app.
The Snowflake account host prefix, including any region or cloud suffix.

If your Snowflake account restricts access through a network policy or IP allowlist, ask a Snowflake admin to allow inbound connections from the current ChatGPT connector egress IP ranges. The list is dynamic and should be kept up to date.

Values to prepare

Snowflake host prefix: everything before .snowflakecomputing.com in the Snowflake account URL.
Database: the database containing the MCP server.
Schema: the schema containing the MCP server.
MCP server name: the Snowflake MCP server object name.
Full managed MCP server URL, if the ChatGPT setup screen asks for a URL.
Snowflake role: the role users should use when authorizing the app.
Tool list: the Snowflake objects and actions you want ChatGPT to use.

Decide what ChatGPT can do

Pick only the capabilities you want to expose. Common options include:

Search with Cortex Search to find answers in indexed Snowflake data or content.
Q&A with Cortex Analyst through an approved semantic view.
Read-only SQL for controlled query access.
A Snowflake Agent, stored procedure, or UDF for a specific workflow.

If you enable SQL, keep it read-only unless your organization has reviewed and approved write access.

Open a Snowflake worksheet

Sign in to the Snowflake app.
Switch to a role that can create the MCP server and grant access.
Go to Workspaces.
Create a workspace with a SQL file.
Set the workspace context to the database and schema where the MCP server will be created.

Create the Snowflake MCP server

In Snowflake, sign in with a role that can create the MCP server and grant access. Open a worksheet in the database and schema where the MCP server should be created.

Run a statement like the following example. Replace the names with your own Snowflake database, schema, services, views, warehouse, and server name.

CREATE MCP SERVER CHATGPT_SNOWFLAKE_MCP
FROM SPECIFICATION $$
tools:
- name: "support-search"
type: "CORTEX_SEARCH_SERVICE_QUERY"
identifier: "CHATGPT_APPS.TOOLS.SUPPORT_SEARCH_SERVICE"
title: "Support Search"
description: "Search support content for relevant customer issues."
- name: "revenue-analyst"
type: "CORTEX_ANALYST_MESSAGE"
identifier: "CHATGPT_APPS.TOOLS.REVENUE_SEMANTIC_VIEW"
title: "Revenue Analyst"
description: "Answer revenue questions using the approved semantic view."
- name: "sql-readonly"
type: "SYSTEM_EXECUTE_SQL"
title: "Read-only SQL"
description: "Run read-only SQL queries against approved Snowflake data."
config:
read_only: true
query_timeout: 600
warehouse: "CHATGPT_WH"
$$;

Snowflake result confirming that the MCP server was successfully created.

The tool names and Snowflake objects in this statement are examples:

support-search exposes the specified Cortex Search service.
revenue-analyst exposes the specified semantic view. Add tools for other views as needed.
sql-readonly exposes read-only SQL with the specified warehouse.

Use stable, descriptive tool names so ChatGPT can choose the right tool. Creating the MCP server does not automatically grant access to the underlying Snowflake objects.

For additional specification options, see: Create a Snowflake-managed MCP server.

Grant the right Snowflake permissions

Choose the Snowflake role users will authorize with, then grant that role access to

The database and schema.
The MCP server.
Every underlying object used by the tools, such as a search service, semantic view, or warehouse.

Example:

GRANT USAGE ON DATABASE CHATGPT_APPS TO ROLE CHATGPT_CONNECTOR_ROLE;
GRANT USAGE ON SCHEMA CHATGPT_APPS.TOOLS TO ROLE CHATGPT_CONNECTOR_ROLE;
GRANT USAGE ON MCP SERVER CHATGPT_APPS.TOOLS.CHATGPT_SNOWFLAKE_MCP TO ROLE CHATGPT_CONNECTOR_ROLE;

GRANT USAGE ON CORTEX SEARCH SERVICE CHATGPT_APPS.TOOLS.SUPPORT_SEARCH_SERVICE TO ROLE CHATGPT_CONNECTOR_ROLE;
GRANT SELECT ON SEMANTIC VIEW CHATGPT_APPS.TOOLS.REVENUE_SEMANTIC_VIEW TO ROLE CHATGPT_CONNECTOR_ROLE;
GRANT USAGE ON WAREHOUSE CHATGPT_WH TO ROLE CHATGPT_CONNECTOR_ROLE;

If the MCP server exposes a UDF, stored procedure, or Cortex Agent, grant the required permissions for that object too.

Verify Snowflake is ready

Run:

SHOW MCP SERVERS IN SCHEMA CHATGPT_APPS.TOOLS;

Then run:

DESCRIBE MCP SERVER CHATGPT_APPS.TOOLS.CHATGPT_SNOWFLAKE_MCP;

Confirm:

The server exists in the expected database and schema.
The tool list is what you intended.
Each tool's identifier points to the right Snowflake object.
The connecting role has USAGE on the MCP server.
The connecting role has the needed permissions on each underlying object.

Enter the Snowflake server details in ChatGPT

In ChatGPT, switch to the account or workspace where the app should be available.
Open Settings. For a workspace-wide setup, open Workspace settings as a workspace admin.
Go to Plugins.
Search for Snowflake.
Enable Snowflake - Official Template.
Open Snowflake - Official Template, enter a clear connection name, and select Connect.
Enter the full managed MCP server URL:

https://<snowflake_host_prefix>.snowflakecomputing.com/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{server}

Example:

https://myorg-myaccount.azure.snowflakecomputing.com/api/v2/databases/CHATGPT_APPS/schemas/TOOLS/mcp-servers/CHATGPT_SNOWFLAKE_MCP

ChatGPT Snowflake Template connection form with name, managed MCP server URL, and OAuth settings.

If the setup screen shows the Snowflake configuration as separate fields, use the same values from the URL:

Snowflake host prefix

Use everything before .snowflakecomputing.com in your Snowflake account URL, including any region or cloud suffix.

For example, if the account URL starts with:

https://myorg-myaccount.azure.snowflakecomputing.com

The host prefix is:

myorg-myaccount.azure

Database

Enter the database containing the MCP server, such as:

CHATGPT_APPS

Schema

Enter the schema containing the MCP server, such as:

TOOLS

MCP server name

Enter the Snowflake MCP server object name, such as:

CHATGPT_SNOWFLAKE_MCP

Configure the OAuth client

You need a Client ID and Client Secret from Snowflake to connect.

When you use session:role:all, Snowflake uses each user's default role. The default role must be permitted by the OAuth integration's role allowlist, if configured, and must not be blocked. Having another approved role does not automatically select it.

In the ChatGPT setup modal, open Advanced OAuth settings, select User-Defined OAuth Client, and copy the Callback URL shown in ChatGPT.
Create a custom OAuth security integration with OAUTH_CLIENT_TYPE = 'CONFIDENTIAL' and OAUTH_REDIRECT_URI set to that exact callback URL.
Run the following statement in Snowflake, using the integration name in uppercase:
SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('YOUR_INTEGRATION_NAME');
From the JSON result, paste oauth_client_id into OAuth client ID and oauth_client_secret into OAuth client secret in ChatGPT.
Set Token endpoint auth method to client_secret_basic.

Connect and manage Snowflake

In the same ChatGPT setup modal, select Continue, sign in to Snowflake, and authorize the connection.
For a workspace setup, configure the plugin installation policy and role or group access for the members who should use it. Verify that both Snowflake and Snowflake - Official Template are enabled.
Workspace admins are responsible for configuring User access for the roles that should use Snowflake.
Workspace admins are responsible for reviewing Action control for the exposed tools.
Workspace admins are responsible for reviewing App permissions to choose when ChatGPT asks members before using the app.

These app permissions apply to ChatGPT conversations. Workspace Agents use per-agent controls set by the agent's builder to determine which app actions are available and when end users are asked to approve them. For agent behavior, see: ChatGPT Workspace Agents for Enterprise and Business.

Test the app

Open a chat, select Snowflake, and test the connection.
Confirm that ChatGPT discovers the tools you configured.
Run a low-risk read action first, such as a search or read-only query against approved data.
Confirm Snowflake permissions prevent access outside the approved role and objects.
For a workspace setup, test with allowed non-admin members who have different default Snowflake roles. A successful admin connection does not confirm that every member can connect.

For workspace admins, enabling only Snowflake is not sufficient. If Snowflake - Official Template has not been enabled and connected, the plugin may appear disabled to members.

MCP server URL and OAuth behavior

ChatGPT connects to the full Snowflake-managed MCP server URL:

https://<snowflake_host_prefix>.snowflakecomputing.com/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{server}

ChatGPT uses the Snowflake host prefix from that URL to resolve these Snowflake OAuth endpoints:

Authorization: https://<snowflake_host_prefix>.snowflakecomputing.com/oauth/authorize
Token: https://<snowflake_host_prefix>.snowflakecomputing.com/oauth/token-request

Do not paste a Snowsight URL, the Snowflake account root URL by itself, or a URL with extra path segments. The MCP URL must include /api/v2/databases/{database}/schemas/{schema}/mcp-servers/{server} and match your Snowflake objects exactly.

Troubleshooting

Snowflake is enabled for an admin but disabled for a member

Confirm that both Snowflake and Snowflake - Official Template are enabled in Workspace settings > Plugins.
Open Snowflake - Official Template and complete its Connect flow. Enabling the template without connecting it is not sufficient.
Open Snowflake and confirm that the template appears as its required app.
Confirm that the affected member's role or group is allowed by the plugin installation policy.

MCP server not found

Re-check the full MCP server URL, or the four template fields if your setup screen asks for them.
Confirm that the MCP server exists in that exact database and schema.

No tools appear in ChatGPT

Confirm that the MCP server specification includes tools.
Confirm that the role has USAGE on the MCP server.

A tool appears but fails when used

Confirm that the role has the required permission on the underlying Snowflake object, such as the search service, semantic view, warehouse, procedure, or UDF.

SQL tool fails

Confirm that the warehouse name is correct and that the warehouse is running.
Confirm that the role has USAGE on the warehouse.
Confirm that read_only: true is set if you intended read-only access.

The role ALL requested has been explicitly blocked

Ask your Snowflake admin to compare your default role with the OAuth integration's allowed and blocked roles. Having another allowed role does not automatically select it. If appropriate, change the default role to an approved role and reconnect. Changing your default role also affects your Snowflake sessions outside ChatGPT.

Authorization fails

Confirm that the user can sign in to Snowflake.
When using session:role:all, confirm that the user's default role is permitted by the OAuth integration.
Confirm that the setup uses the Snowflake-managed MCP OAuth flow.
Confirm that the Client ID and Client Secret match the Snowflake OAuth integration and that its redirect URI matches the Callback URL shown in ChatGPT.

Snowflake network policy or IP allowlist blocks the connector

Ask a Snowflake admin to update the Snowflake network policy or access rules.
Allow inbound connections from the current ChatGPT connector egress IP ranges.
Configure this allowlisting in Snowflake. It is separate from ChatGPT workspace IP allowlisting.
Automate updates from the published JSON when possible because the ranges can change.

Hostname connection issue

Use the correct Snowflake host prefix. Snowflake hostnames with underscores can cause issues; prefer hyphens.

Set up the Snowflake app template in ChatGPT