Securely connecting Gemini Enterprise to Snowflake data

Google Cloud describes a method to connect its Gemini Enterprise AI to Snowflake data warehouses using the Model Context Protocol (MCP) and the Google Agent Development Kit (ADK). This setup allows enterprise agents to translate natural language queries into SQL via Snowflake Cortex and execute them with user-level permissions, ensuring data governance and security remain intact throughout the process.

The integration leverages Snowflake’s governed boundary by delegating both query generation and execution to a Snowflake Cortex Agent exposed through an MCP server. This approach prevents raw SQL exposure to clients, reduces risks of schema hallucinations, and ensures deterministic text-to-SQL translation aligned with corporate semantic definitions, as illustrated in the provided execution flow diagrams.

Security is enforced through OAuth 2.0 user impersonation, with a dedicated Snowflake role and confidential OAuth client to protect credentials. The ADK agent code requires the endpoint URL of the Snowflake-managed MCP server, which is retrieved using a Snowflake worksheet query and structured in a specific URL format before deployment.

Developers deploy the ADK agent using the Google Agents CLI, which packages the code and handles the deployment pipeline, outputting a unique project resource path. The agent is then registered in Google Cloud Console, linking the configuration and OAuth parameters to enable secure, governed AI-driven data interactions within enterprise environments.