Skip to main content

Connect the Snowflake MCP connector to Fin

Use this article to connect Intercom's Fin AI agent to a Snowflake MCP (Model Context Protocol) server. Once set up, Fin can run read-only SQL lookups against your Snowflake tables and — if configured — use Cortex Search, Cortex Analyst, and custom tools.

Written by Tobias Ignatzek

Fin can connect directly to an MCP server running inside your Snowflake account. Once connected, Fin can run read-only SQL lookups against your tables and — if configured — use Snowflake Cortex Search, Cortex Analyst, and your own custom tools. Everything runs under a Snowflake role you choose, so your existing permissions, masking, and row access policies apply to everything Fin does.

Note: This feature is currently in closed beta. This setup requires admin access in both Intercom (to configure Data connectors) and Snowflake (ACCOUNTADMIN or SYSADMIN role, or equivalent). Your Snowflake admin must complete the Snowflake-side steps first. To request access to the beta, contact your Intercom account team.

Before you start: set up an MCP server in Snowflake

This part happens entirely in your Snowflake account and you may need support from a technical user with sufficient access rights in Snowflake (typically ACCOUNTADMIN or SYSADMIN):

  1. Create a role scoped to just what Fin should see, and grant it USAGE/SELECT on the tables you want Fin to be able to query.

  2. Optionally, write UDFs (user-defined functions) that query across your tables and expose them as tools with input parameters. This could be a lookup function that takes a customer's email address and returns a matching order, ticket or other data.

  3. Grant the role USAGE on each function you want to expose.

  4. Create the MCP server object (CREATE MCP SERVER) and grant that role USAGE on it.

  5. Create a Snowflake OAuth (Open Authorization) security integration (CREATE SECURITY INTEGRATION ... TYPE = OAUTH) with OAUTH_CLIENT = CUSTOM and OAUTH_CLIENT_TYPE = 'CONFIDENTIAL', and set OAUTH_REDIRECT_URI to the value below for your Intercom region.

  6. Retrieve the client ID (DESCRIBE SECURITY INTEGRATION <name>) and client secret (SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<name>')).

Note: Running CREATE OR REPLACE MCP SERVER resets all existing grants on the server object. If you redeploy your MCP server at any point, re-run the GRANT USAGE statement on the new object.

The table below shows the OAUTH_REDIRECT_URI value to enter when creating your Snowflake OAuth security integration (step 5). Use the URI that matches your Intercom account region.

Your Intercom region

Redirect URI to set in Snowflake

US

https://app.intercom.com/auth/mcp/callback

EU

https://app.eu.intercom.com/auth/mcp/callback

AU

https://app.au.intercom.com/auth/mcp/callback

For the exact SQL and object model, see Snowflake's own documentation:

Note: In order to isolate Fin from your production account entirely, you can host the MCP server in a Snowflake Reader Account instead and share only the data you choose into it via Secure Data Sharing.

Once you have the client ID and secret from step 6, you're ready to complete the connection in Intercom.

Connect Fin to your Snowflake MCP server

  1. Go to Settings → Integrations → Data connectors.

  2. In the data connector gallery, click the Snowflake tile.

  3. Fill in the setup form using the values from your Snowflake admin:

    • Name — what to call the connector in Fin.

    • Account URL - your Snowflake account's web address, e.g. https://xy12345.snowflakecomputing.com. Only standard *.snowflakecomputing.com addresses are recognized as Snowflake.

    • MCP endpoint path — the address of the MCP server object inside your account, e.g. /api/v2/databases/<DB>/schemas/<SCHEMA>/mcp-servers/<SERVER_NAME>.

    • Client ID and Client Secret — from the OAuth security integration your Snowflake admin created.

    • Role — the Snowflake role the connection acts as. This decides exactly which data and tools Fin can reach.

  4. Click Connect. You'll be sent through Snowflake's sign-in approval.

  5. On success, Fin asks the server which tools it offers and shows them to you.

Choose which tools Fin can use

Fin never gets a tool you haven't explicitly added:

  1. From the discovered tools list, check the ones you want to enable (e.g. SQL execution, Cortex Search, a custom tool).

  2. Each enabled tool is added as its own Data connector, which you can configure like any other connector. See How to set up Data connectors for more information.

Technical limits and behavior

You're in control of the Snowflake side

If a tool isn't showing up or a connection won't complete, it's usually worth double-checking the role, grants, and server object in Snowflake as the MCP server configuration lives in your Snowflake account.

Answer size limit

Each response from Snowflake is capped at 250 KB (roughly a few hundred rows).

FAQ

Do I need to give Fin full access to my Snowflake account?

No. The connection only ever acts as the single Snowflake role you assign to it, and only uses the tools you've explicitly enabled.

Can I connect Fin to Snowflake without deploying my own server?

Yes. Snowflake Cortex provides a managed alternative to building a fully custom MCP server; you still create the MCP server object and OAuth integration, but Cortex handles the AI capabilities.

My tools list is empty or a tool call fails. What should I check?

This is almost always a Snowflake configuration issue: confirm the MCP server object exists, and that the role you connected with has been granted USAGE on it. CREATE OR REPLACE MCP SERVER discards existing grants, so re-run the GRANT USAGE statement after any redeploy.

💡Tip

Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts

Related Articles
Did this answer your question?