snowflake-analytics-mcp-server 0.2.0 → 0.2.2

package/README.md

@@ -103,7 +103,7 @@ These are additive generative-AI tools (token-billed, higher latency than the SQ
 | `cortex_summarize` | `text` | Concise summary of a text |
 | `cortex_classify` | `text`, `categories[]` | Classify text into your categories via AI_CLASSIFY |
 | `cortex_translate` | `text`, `to_language`, `from_language?` | Translate text (source auto-detected when omitted) |
-
+| `SNOWFLAKE_PARTNER_CSID` | recommended | AnalyticsModel_MCP | Partner Connection String Identifier registered on SPN; sent as the Snowflake application tag for Connected-Application telemetry |
 `cortex_ask` generates SQL and always restricts it to read-only statements, regardless of `SNOWFLAKE_READ_ONLY`.
 
 **Cortex prerequisites:** the account must be in a region that supports Cortex, and the connecting role needs the `SNOWFLAKE.CORTEX_USER` database role plus the `USE AI FUNCTIONS` privilege. If a Cortex call fails on region or privileges, the tool returns a hint explaining what to grant.

package/dist/index.js

@@ -12,7 +12,7 @@ import { registerTools } from "./tools/index.js";
 async function main() {
     const server = new McpServer({
         name: "snowflake-analytics-mcp-server",
-        version: "0.2.0",
+        version: "0.2.1",
         title: "Snowflake Analytics MCP Server",
     });
     registerTools(server);

package/dist/snowflake.d.ts

@@ -15,6 +15,7 @@ export interface SnowflakeConfig {
     readOnly: boolean;
     cortexEnabled: boolean;
     cortexModel: string;
+    csid: string;
 }
 export declare function loadConfig(): SnowflakeConfig;
 export declare function getConfig(): SnowflakeConfig;

package/dist/snowflake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snowflake.d.ts","sourceRoot":"","sources":["../src/snowflake.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAUD,wBAAgB,UAAU,IAAI,eAAe,CA0C5C;AAKD,wBAAgB,SAAS,IAAI,eAAe,CAG3C;AAiCD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,OAAO,EAAO,GACpB,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CASR;AAMD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAchE;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWrF;AAKD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD"}
+{"version":3,"file":"snowflake.d.ts","sourceRoot":"","sources":["../src/snowflake.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAyDD,wBAAgB,UAAU,IAAI,eAAe,CAmD5C;AAKD,wBAAgB,SAAS,IAAI,eAAe,CAG3C;AAiCD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,OAAO,EAAO,GACpB,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CASR;AAMD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAchE;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWrF;AAKD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/snowflake.js

@@ -28,20 +28,65 @@ function req(name) {
     }
     return v.trim();
 }
+/**
+ * Validate the partner CSID before it's used as the `application` connection
+ * option. The snowflake-sdk validates this field itself (first character must
+ * be a LETTER, followed by letters/digits/`._-`, with a length cap), so we
+ * mirror that here to fail loudly with a clear message rather than a cryptic
+ * driver error at connect time.
+ *
+ * NOTE: confirm the exact bounds against your INSTALLED driver version — they
+ * can shift between releases:
+ *   grep -rn "application" node_modules/snowflake-sdk/lib/connection/connection_config.js
+ * Align this regex to whatever that shows, and also to section 4 of the
+ * Snowflake Native Connector Best Practice Guide (the CSID naming convention).
+ */
+function validateCsid(csid) {
+    if (!/^[A-Za-z][A-Za-z0-9._-]{0,49}$/.test(csid)) {
+        throw new Error(`Invalid SNOWFLAKE_PARTNER_CSID "${csid}". Must start with a letter, then ` +
+            `letters, digits, and . _ - (max 50 chars).`);
+    }
+    return csid;
+}
+/**
+ * Normalize a private key into valid PEM regardless of how it survived transport.
+ * Handles: proper multi-line PEM, PEM with literal `\n`, PEM flattened onto one
+ * line (newlines stripped by a single-line form field), and a bare base64 body
+ * with no header/footer at all. Preserves the header type (e.g. ENCRYPTED).
+ */
+function normalizePrivateKey(raw) {
+    let k = raw.trim().replace(/\\n/g, "\n");
+    const bodyMatch = k.match(/-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----([\s\S]*?)-----END [A-Z0-9 ]*PRIVATE KEY-----/);
+    let header = "PRIVATE KEY";
+    let body;
+    if (bodyMatch) {
+        header = bodyMatch[1].trim();
+        body = bodyMatch[2].replace(/\s+/g, "");
+    }
+    else {
+        // No header present — treat the whole value as the base64 body.
+        body = k.replace(/\s+/g, "");
+    }
+    const wrapped = body.match(/.{1,64}/g)?.join("\n") ?? body;
+    return `-----BEGIN ${header}-----\n${wrapped}\n-----END ${header}-----\n`;
+}
 export function loadConfig() {
-    const authenticator = (process.env.SNOWFLAKE_AUTHENTICATOR || "SNOWFLAKE")
+    const hasKey = !!(process.env.SNOWFLAKE_PRIVATE_KEY || process.env.SNOWFLAKE_PRIVATE_KEY_PATH);
+    // Auto-select key-pair auth when a private key is provided, so callers don't
+    // have to set SNOWFLAKE_AUTHENTICATOR explicitly. An explicit value still wins.
+    const authenticator = (process.env.SNOWFLAKE_AUTHENTICATOR || (hasKey ? "SNOWFLAKE_JWT" : "SNOWFLAKE"))
         .trim()
         .toUpperCase();
     let privateKey;
     if (authenticator === "SNOWFLAKE_JWT") {
         if (process.env.SNOWFLAKE_PRIVATE_KEY) {
-            privateKey = process.env.SNOWFLAKE_PRIVATE_KEY;
+            privateKey = normalizePrivateKey(process.env.SNOWFLAKE_PRIVATE_KEY);
         }
         else if (process.env.SNOWFLAKE_PRIVATE_KEY_PATH) {
-            privateKey = readFileSync(process.env.SNOWFLAKE_PRIVATE_KEY_PATH.trim(), "utf8");
+            privateKey = normalizePrivateKey(readFileSync(process.env.SNOWFLAKE_PRIVATE_KEY_PATH.trim(), "utf8"));
         }
         else {
-            throw new Error("SNOWFLAKE_AUTHENTICATOR=SNOWFLAKE_JWT requires SNOWFLAKE_PRIVATE_KEY or SNOWFLAKE_PRIVATE_KEY_PATH");
+            throw new Error("Key-pair auth requires SNOWFLAKE_PRIVATE_KEY or SNOWFLAKE_PRIVATE_KEY_PATH");
         }
     }
     return {
@@ -63,6 +108,9 @@ export function loadConfig() {
         // Cortex AI tools are on by default; set SNOWFLAKE_CORTEX_ENABLED=false to hide them.
         cortexEnabled: (process.env.SNOWFLAKE_CORTEX_ENABLED || "true").toLowerCase() !== "false",
         cortexModel: (process.env.SNOWFLAKE_CORTEX_MODEL || "llama3.1-8b").trim(),
+        // Partner Connection String Identifier registered on SPN. Override via
+        // SNOWFLAKE_PARTNER_CSID if it ever changes.
+        csid: validateCsid((process.env.SNOWFLAKE_PARTNER_CSID || "Analytics-model").trim()),
     };
 }
 let cfg = null;
@@ -78,7 +126,7 @@ function buildConnection(c) {
         username: c.username,
         authenticator: c.authenticator,
         clientSessionKeepAlive: true,
-        application: "AnalyticsModel_MCP",
+        application: c.csid,
     };
     if (c.password)
         opts.password = c.password;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snowflake-analytics-mcp-server",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Snowflake MCP server for the Analytics Model platform. Table discovery, SQL query, and Cortex AI tools over stdio, runnable via npx.",
   "type": "module",
   "main": "dist/index.js",