MCP servers for Databricks, Snowflake, BigQuery and Fabric

Databricks, Snowflake, BigQuery and Microsoft Fabric each host their own MCP servers now, so Claude, ChatGPT, Cursor or an agent you build can work with your data with no server of your own to run. They come in 2 kinds, and the kind matters more than the platform. Some answer a question through the platform's own semantic layer: Databricks' Genie One, a Snowflake Cortex Agent, a Fabric data agent. Others give your agent a SQL tool and leave the writing of the query to it: Databricks SQL, Snowflake's SQL execution tool, BigQuery, Fabric's Data Warehouse server.

Databricks says it plainly in its docs: answers grounded in its semantic layer are more accurate than an agent writing SQL directly against raw tables, because the layer already knows what "active customer" means. Snowflake gives the same advice for its Cortex Agents. BigQuery's server has no question-answering tool, so there the quality of the answers rests on how well your tables and columns are named and described.

The servers, by job

Snowflake is the odd one out in how it works. Its server is an object you create in a schema, with a YAML list of tools, so 2 teams can publish 2 servers with different tools and roles. The others host fixed servers, and you control them with grants and identity.

Pick a platform and a job to see the server, its address, the access it needs and the catch:

Try itWhich MCP server, and what it needs

Platform

·Databricks·Snowflake·BigQuery·Microsoft Fabric

The agent should

Answer questionsRun SQLManage the platform

Status

Generally available since 25 September 2026

Address

https://<workspace>/ai-gateway/mcp-services/system.ai.genie_one_mcp

Access

A grant on the MCP, which is a Unity Catalog securable, plus the caller's own rights on the data

Watch for

The old Beta address /api/2.0/mcp/genie stops on 31 October 2026

Connecting Claude Code, and the other clients

Each maker documents its own route, and they differ in who registers the OAuthOAuthThe standard way to let one app act for you at another service without giving it your password; the app gets a limited, revocable access token instead. MCP servers use it to let AI agents sign in. client.

Databricks ships ready OAuth clients for Claude Code, Claude, ChatGPT, Codex and Cursor (generally available since 27 October 2026), so no admin has to create one, and one command adds a server:

claude mcp add --transport http --scope user \
  --client-id https://claude.ai/oauth/claude-code-client-metadata \
  --callback-port 3118 \
  databricks-genie \
  "https://<workspace-hostname>/ai-gateway/mcp-services/system.ai.genie_one_mcp?o=<workspace-id>"

Then type /mcp in Claude Code and sign in with your Databricks account. Databricks' ug command (ug mcp add --agents claude) does the same and keeps the credentials fresh. If you used Genie over MCP during its Beta, move now: the old address, /api/2.0/mcp/genie, stops working on 31 October 2026.

Snowflake needs 2 things first: the MCP server object and an OAuth security integration. For Claude Desktop, create the integration as a public client (PKCE, no secret) with the redirect address https://claude.ai/api/mcp/auth_callback, then add a custom connector with the server's address and the client id; clients that can store a secret, such as VS Code or Cursor, use a confidential client with the id and secret; Cursor takes the same in mcp.json. One detail breaks connections: write the account's hostname with hyphens, not underscores.

BigQuery works through Google's OAuth. For Claude Code and Claude Desktop, Google's docs say to create an OAuth client of type Web application with the redirect address https://claude.ai/api/mcp/auth_callback, then add https://bigquery.googleapis.com/mcp as a custom connector with that client id and secret.

Fabric signs you in with Microsoft Entra ID in the browser. Its Data Warehouse server, for one, is a single entry in VS Code's MCP settings:

{
  "servers": {
    "fabric-warehouse": {
      "type": "http",
      "url": "https://api.fabric.microsoft.com/v1/mcp/dataPlane/sqlEndpoint"
    }
  }
}

Whatever the client, test with a tool call, not a chat answer: ask the agent to list the server's tools and run one read. A fluent answer without a tool call does not prove the server is connected. If you are still choosing the client, our Claude Code vs Cursor vs Codex comparison covers how each handles MCP, and the Claude Code MCP guide covers scopes and sign-in.

Whose permissions run the query

None of these servers has rights of its own. Each acts as the person, or the service identity, that signed in. That is good news for governance, and a trap if the person who signs in is an admin.

The Snowflake row is the one to read twice. Claude requests the session:role:all scope, so the session uses whatever the user's default role is. If that is ACCOUNTADMIN, so is the agent. Snowflake's advice is a dedicated, least-privileged MCP access role, granted only to the people who need it and named in the OAuth integration's ALLOWED_ROLES_LIST, never PUBLIC.

Guardrails to set on the first day

1. Keep SQL tools read-only. Snowflake's SQL tool is read-only unless you set read_only: false. BigQuery has a read-only tool and a read-write one, and execute_sql is the only one that can change data: block it with an IAM deny policy unless the agent truly needs it.
2. Separate answering from raw SQL. Snowflake recommends a Cortex Agent as the only tool on a server for business questions, with raw SQL on a second server with a smaller role; otherwise the client can go around the semantic views. The same thinking applies to Genie One beside system.ai.dbsql.
3. Watch the management servers. Fabric Core can create and delete workspaces and change who has access. Microsoft warns that a misconfigured client can do destructive things; keep your client's approval prompt on for it.
4. Tag and trace. BigQuery tags every query the MCP server runs with goog-mcp-server:true, so you can find them in job history. Databricks' system.ai servers go through Unity Gateway, which traces each call; the legacy workspace addresses do not.
5. Know where answers go. Microsoft says a Fabric data agent's replies may leave Fabric's compliance boundary and region once an outside MCP client receives them. That holds for every platform here: the answer ends up in the client's model provider.

Before adding any third-party server beside these, read how to vet an MCP server: Snowflake's own docs warn of tool poisoning and tool shadowing when servers are mixed without checking.

Limits worth knowing before you build

The row limits shape what an agent can do. An agent that pulls 3,000 rows into its context to add them up has already gone wrong: the sum belongs in the SQL. Say so in your instructions to the agent: aggregate in the warehouse and bring back only the answer.

Which to start with

If your company already defines its metrics in a semantic layer, start with the server that answers through it: Genie One on Databricks, a Cortex Agent on Snowflake, a data agent on Fabric (Fabric IQ gives the agent read-only DAX tools on Power BI models, but the agent writes the query). The Semantic LayerSemantic LayerOne shared definition of business terms and metrics, such as revenue or active customer, that reports, dashboards and AI assistants all read instead of writing their own. is what makes those answers consistent, and Genie, Genie One and Genie Code explains the Databricks side in more depth.

If you want an engineer's assistant that writes and runs queries, a SQL tool is the right kind: BigQuery's server, system.ai.dbsql or Snowflake's SQL tool, with a read-only role. Expect it to make the mistakes of Text-to-SQLText-to-SQLA model turning a question in plain words into a database query, so people can ask the data directly. It is only as right as its knowledge of the tables and their meaning. on poorly described tables, and write column descriptions before you blame the model.

When none of these fits, build your own: how to build an MCP server in Python shows the steps, and the Model Context ProtocolModel Context ProtocolAn open standard for connecting AI applications to tools and data. A system offered once as an MCP server works in any application that speaks MCP. concept explains what a server can offer beyond tools.