S
MCP server · Data warehouse
Govern the Snowflake MCP server.
The Snowflake MCP server runs queries against your warehouse. Allow reads on marts, cap result size, and deny grants and DDL.
Per-tool policy
An MCP server is a bag of tools. Enable them one at a time.
Connect Snowflake once; HiveKey gates each tool per role. Read-only by default, writes on purpose, destructive ops denied.
mcp / snowflake governed
run_query (SELECT marts) allow
list_databases allow
run_query (raw PII) deny
create_warehouse / GRANT deny
Read curated marts with a row cap; deny raw-PII reads, grants, and warehouse DDL.
In the path
HiveKey sits between the agent and Snowflake.
Agent
wants a tool call
HiveKey
scope · guard · log
Snowflake MCP
only allowed tools
Put the Snowflake MCP server under one policy.
Connect Snowflake, gate each tool per role, and log every call — across your whole agent fleet.