Snowflake CoWork

Snowflake connects to CARTO through an external MCP server configured as an MCP Connector. You can create the connector from the Snowflake UI or with SQL.

Once configured, the connector can be added to a Cortex Agent. Snowflake also supports MCP Connectors in Snowflake CoWork.

CoWork is Snowflake's chat surface, where CARTO is reached through an agent you create and publish. For Snowflake CoCo, the coding agent, CARTO is configured differently: MCP, the CARTO CLI and the Agent Skills all apply there.

Requirements

Before you start, you need:

• ACCOUNTADMIN access to the Snowflake account.

• Your CARTO MCP Server URL.

You also need a CARTO SPA OAuth Client. The client must be confidential and have a Client Secret. Snowflake does not support public or PKCE-only clients for this integration, and static API tokens are not supported.

Connect via OAuth

OAuth is the authentication method used for the CARTO MCP connection.

1. Create a CARTO SPA OAuth Client

In CARTO, create a SPA OAuth Client under Developers > Credentials > SPA OAuth Clients.

• Configure the client as confidential so that it has a Client Secret.

• Keep the Client ID and Client Secret. You will need them when configuring the Snowflake MCP Connector.

Before continuing, register Snowflake's OAuth callback URL with the client.

In the SPA OAuth Client, disable Use default logout/callback URLs and Origins and add:

https://identity.snowflake.com/oauth2/callback

2. Create the MCP Connector

You can create the connector from the Snowflake UI or with SQL. Both create the same Snowflake objects.

Snowflake UI

Go to Settings > MCP connectors > Add MCP Connector

Fill in:

Field	Value
Location	A real database and schema.
Name	Anything, for example carto_mcp_server
Description	What the connector is for. Snowflake shows this to the agent
API Integration	Standard OAuth
Server URL	Your MCP Server URL
Authorization endpoint	https://auth.carto.com/authorize
Token endpoint	https://auth.carto.com/oauth/token
OAuth Client ID/Secret	From your SPA client
Scopes	openid,profile,email,read:workflows,write:workflows

Do not use the Dynamic Client Registration (DCR) tab. Select Standard OAuth and enter the CARTO OAuth credentials manually.

For more information, see Snowflake's MCP Connector documentation.

SQL

Run the following as ACCOUNTADMIN.

Create the API Integration:

CREATE API INTEGRATION CARTO_MCP_OAUTH2
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://<region>.api.carto.com')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH2
    OAUTH_GRANT = AUTHORIZATION_CODE
    OAUTH_CLIENT_ID = '<your SPA client id>'
    OAUTH_CLIENT_SECRET = '<your SPA client secret>'
    OAUTH_TOKEN_ENDPOINT = 'https://auth.carto.com/oauth/token'
    OAUTH_AUTHORIZATION_ENDPOINT = 'https://auth.carto.com/authorize'
    OAUTH_CLIENT_AUTH_METHOD = CLIENT_SECRET_BASIC
    OAUTH_ALLOWED_SCOPES = ('openid','profile','email','read:workflows','write:workflows'))
  ENABLED = TRUE;

Then create the external MCP server:

CREATE EXTERNAL MCP SERVER CARTO_MCP_SERVER
  WITH DISPLAY_NAME = 'CARTO MCP'
  URL = 'https://<region>.api.carto.com/mcp/<account_id>'
  API_INTEGRATION = CARTO_MCP_OAUTH2;

Replace <region> and <account_id> with the values from your CARTO MCP Server URL.

OAUTH_GRANT = AUTHORIZATION_CODE is required for this configuration because the CARTO SPA client uses the authorization-code flow.

CREATE OR REPLACE is not supported for this API integration type. To change the integration, drop it and create it again.

3. Grant access

The role that creates and uses the agent needs USAGE on the following objects:

• the API integration

• the external MCP server

• the database

• the schema

If you created the connector in the UI, use the following command to find the generated objects:

SHOW EXTERNAL MCP SERVERS;

Then, as ACCOUNTADMIN, grant access to the role used by the agent:

GRANT USAGE ON INTEGRATION CARTO_MCP_OAUTH2 TO ROLE <agent_dev_role>;
GRANT USAGE ON EXTERNAL MCP SERVER CARTO_MCP_SERVER TO ROLE <agent_dev_role>;
GRANT USAGE ON DATABASE <db> TO ROLE <agent_role>;
GRANT USAGE ON SCHEMA <db>.<schema> TO ROLE <agent_role>;

You can also manage access to the agent from its Access tab.

See Snowflake's MCP Connector documentation for more information about permissions.

4. Add the MCP Connector to an Agent

In the Snowflake UI, go to:

Agents > open your agent > Configuration > MCP > Add to agent

Select the CARTO MCP Connector and complete the Connect consent flow. This signs you in to CARTO and authorizes the connection.

For the full agent configuration flow, see Snowflake's Cortex Agents documentation

5. Add the CARTO Agent Skills

This step is optional. CARTO Agent Skills are playbooks that teach an agent to drive CARTO idiomatically, and Snowflake agents can load them from a Git repository. The catalog is public, so no credentials are required.

Run the following as ACCOUNTADMIN:

CREATE OR REPLACE API INTEGRATION github_cartodb
  API_PROVIDER = git_https_api
  API_ALLOWED_PREFIXES = ('https://github.com/CartoDB')
  ENABLED = TRUE;

CREATE OR REPLACE GIT REPOSITORY <db>.<schema>.carto_agent_skills
  API_INTEGRATION = github_cartodb
  ORIGIN = 'https://github.com/CartoDB/agent-skills';

ALTER GIT REPOSITORY <db>.<schema>.carto_agent_skills FETCH;

GRANT READ ON GIT REPOSITORY <db>.<schema>.carto_agent_skills TO ROLE <agent_role>;

Then, in the agent's Configuration > Skills > Add skill, point at a skill folder in the repository:

@<db>.<schema>.carto_agent_skills/branches/master/skills/carto-create-builder-maps

Skills are added one at a time. There is no way to attach the whole catalog at once, so start with carto-create-builder-maps and carto-basics.

A Git repository is an internal stage, so it requires GRANT READ rather than GRANT USAGE.

6. Publish the agent to Snowflake CoWork

The agent is available in Snowflake CoWork once it is published and added to CoWork.

1. Select Save, then Publish. A draft agent does not appear in CoWork.

2. Next to the agent name, open the ⋮ menu and select Add to Snowflake CoWork.

3. In Snowflake CoWork, go to Capabilities > MCP Connectors and select Connect on the CARTO connector. This completes the OAuth consent and signs you in to CARTO. Each person who uses the agent does this once.

4. Start a New chat and select the agent.

Access is per user. Each person authorizes with their own CARTO account, and the agent inherits that account's CARTO permissions: the connections, maps and workflows that account can reach.

7. Test the connection

Snowflake can create the API integration and external MCP server even if the OAuth credentials are invalid. The integration may appear healthy until the agent actually connects to CARTO.

Always run the agent before considering the setup complete.

Ask the agent to use a CARTO tool or describe the tools available to it.

If you see an error such as:

Insufficient privileges to operate on Integration

check the USAGE grants on the API integration and external MCP server.

For information about MCP tools and how clients discover and invoke them, see the MCP Tools specification.

Maps do not render inside Snowflake. Inline rendering requires MCP Apps support, which is available on a subset of platforms. The agent creates the map and returns its URL, which you open in CARTO Builder.