Skip to main content

Connect Snowflake to Claude, ChatGPT and Copilot

Snowflake is where many companies keep their governed analytics data: finance marts, product events, CRM and ERP copies, and the models built on them. Nexatron answers over your Snowflake tables with read-only queries on your warehouse, run as the Snowflake user who asks.

Nexatron's hosted MCP server is listed in Claude's connector directory. ChatGPT and Microsoft 365 Copilot add the same server as a custom MCP connector. Connect Snowflake to your Nexatron workspace once, then ask from whichever assistant you use.

What you can ask​

  • What was net revenue by region last fiscal quarter, using the finance mart?
  • Which customers' monthly active users dropped more than 20% month over month?
  • How many orders shipped late last week, by warehouse and carrier?
  • Which product events in the raw JSON stream carry an error code this month?
  • Which warehouses consumed the most credits last month, and for which workloads?
  • What is the 90-day retention of customers acquired in each quarter of last year?

Questions read the databases, schemas, tables and views your data team publishes, including secure views, semi-structured VARIANT, OBJECT and ARRAY columns, and ACCOUNT_USAGE views where the person's role can read them. Queries are read-only SELECTs, checked before they run.

Prerequisites​

  • A Nexatron workspace admin (the tenant_admin role) to add the connection.
  • A Snowflake administrator. The generated script needs USERADMIN and SECURITYADMIN; the sign-in integration and the optional query-history grant need ACCOUNTADMIN.
  • A warehouse for Nexatron (the setup script grants USAGE on it). A dedicated one with a resource monitor is recommended.
  • For single sign-in through your identity provider: your identity team, for Okta or Microsoft Entra ID.

Admin setup​

Nexatron uses two Snowflake identities. A setup user (TYPE = SERVICE, key pair, role NEXATRON_SETUP) reads metadata and profiles values so Nexatron can learn the database. It never answers anyone's question. Each person's own Snowflake login answers their questions.

  1. In Nexatron, go to Knowledge ▸ Sources ▸ New connection and choose Snowflake. Paste your Snowflake URL as the account, and enter the database and warehouse. Keep the username NEXATRON_SVC: it is the setup user the script creates.
  2. Select Generate a key for me. Nexatron fills in the setup script. Copy it, or select Download .sql and send it to your Snowflake administrator. You can save the connection before they run it, then select Check again on its page.
  3. The Snowflake administrator runs the script: a role and service user, read grants on what exists and what is created later, and optionally SNOWFLAKE.GOVERNANCE_VIEWER so setup can detect row access and masking policies and learn from query history.
  4. Set up people's sign-in on the connection's page, under Snowflake sign-in. Choose Snowflake OAuth (people sign in on Snowflake's page; needs only your Snowflake admin) or your identity provider (External OAuth through Okta or Microsoft Entra ID, scope session:role-any plus offline_access). Select Show the statement, have the Snowflake admin run it as ACCOUNTADMIN, paste the client ID and secret, and select Save and turn on sign-in.
  5. Under Who can use it, choose Everyone or selected groups and people, and select Save access. A new connection is on for no one until you do.

The exact grants, network policy and key rotation are in Connect Snowflake. The Pilot quick start walks through the same steps for a first pilot.

How each person signs in​

Each person opens Knowledge ▸ Sources ▸ Your sign-ins and selects the Sign in with button. It names where they sign in: Snowflake, or your company's Okta or Microsoft page. The card then shows which Snowflake user they are connected as. With Snowflake OAuth a person stays signed in for up to 90 days.

There is no shared login and no "view as". Linking a person to another Snowflake user is for development and test only; a production workspace refuses it.

First question to try​

After you add Nexatron in Claude, ChatGPT or Copilot, ask:

What was net revenue by region last fiscal quarter, using the finance mart?

Every answer shows its SQL, so your data team can run the same statement in Snowsight.

Permissions and masking​

Questions run under the person's Snowflake default role and grants, with their default secondary roles under Snowflake OAuth. Row access policies, masking policies and secure views apply exactly as they do in Snowsight. ACCOUNTADMIN, SECURITYADMIN and ORGADMIN are blocked for sign-in, so give people a non-privileged default role with USAGE on the connection's warehouse.

Setup keeps no values from a table with a row access policy or a masked column, beyond counts.

Nexatron's own rules under Settings ▸ Workspace ▸ Access (Access) apply on top: row rules limit rows and column masking hides a column's values. They narrow what Snowflake allows and never widen it. A question that would total, average or count a masked column is refused in words, and an answer that ran under rules says so in its evidence.

Troubleshooting​

SymptomCause and fix
Object does not exist or not authorizedThe role lacks USAGE on the database, schema or warehouse, or SELECT on the object. For a person, check their own role, not NEXATRON_SETUP.
JWT token is invalid for the setup userThe key Nexatron uses is in neither key slot (compare fingerprints with DESC USER), or the signing clock is skewed.
Incoming request with IP/Token ... is not allowedA network policy does not include Nexatron's egress IP addresses. People's OAuth sessions connect from Nexatron's servers too.
A person's sign-in or question fails with a role errorTheir default role is one of the blocked roles, or is not granted to them.
External OAuth: user not foundThe mapping claim does not equal the person's LOGIN_NAME, or the issuer or audience does not match the token exactly.
Setup keeps no values from some tablesThose tables have row access or masking policies. This is expected.
Last updated on