[BUG] Can't specify OAuth scope for Snowflake MCP
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
When using a Snowflake-managed MCP server with OAuth authentication, Claude Code requests the scope session:role:all by default. However, in my company, the Snowflake OAuth is configured to disallow this, and instead, requires a specific Snowlfake role called out in that request (e.g. session:role:ANALYST_ROLE).
What Should Happen?
Users should be able to specify a custom OAuth scope in the MCP server configuration, e.g.:
{
"mcpServers": {
"snowflake": {
"type": "http",
"url": "https://...",
"oauth": {
"scope": "session:role:ANALYST_ROLE"
}
}
}
}Error Messages/Logs
Steps to Reproduce
I added the Snowflake-managed MCP like this:
MCP_CLIENT_SECRET="..." \
claude mcp add --transport http --scope user \
--client-id "..." \
--client-secret \
--callback-port 6274 \
snowflake \
https://[account].snowflakecomputing.com/api/v2/databases/[db]/schemas/[schema]/mcp-servers/[mcp-server]Snowflake OAuth has been configured like this:
CREATE OR REPLACE SECURITY INTEGRATION oauth_claude_code_localhost
TYPE = OAUTH
OAUTH_CLIENT = CUSTOM
ENABLED = TRUE
OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
OAUTH_REDIRECT_URI = 'http://localhost:6274/callback'
OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE // required for non-TLS localhost redirect endpoint
OAUTH_USE_SECONDARY_ROLES = NONE // this disables session:role:all
PRE_AUTHORIZED_ROLES_LIST = ([roles allowed for MCP use, most users have multiple roles])
BLOCKED_ROLES_LIST = ('SYSADMIN', 'USERADMIN', [a bunch of roles]);When attempting to authenticate this Snowflake-managed MCP Server with OAuth via /mcp interface, Claude Code opens this URL:
https://[ACCOUNT-NAME].snowflakecomputing.com/oauth/authorize?response_type=code&client_id=...&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Fcallback&state=...&scope=session%3Arole%3Aall&resource=...
Since this scope is disabled from Snowflake side, I get the following error:
The role ALL requested has been explicitly blocked for use with this application by an administrator. Please try logging in with a different role, or contact your administrator.
Manually editing the authorization URL during the OAuth flow to replace session:role:all with session:role:<specific_role> results in successful authentication, confirming this is purely a scope configuration issue.
https://[ACCOUNT-NAME].snowflakecomputing.com/oauth/authorize?response_type=code&client_id=...&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Fcallback&state=...&scope=session%3Arole%3AANALYST_ROLE&resource=...
Claude Model
Sonnet (default)
Is this a regression?
I don't know
Last Working Version
_No response_
Claude Code Version
2.1.81
Platform
AWS Bedrock
Operating System
macOS
Terminal/Shell
iTerm2
Additional Information
Why this matters: Least privilege principle. Without this scope configurability, Claude Code can't use MCPs in security-conscious environments.
13 Comments
Found 2 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
I don't see how #7744 is a duplicate.
Snowflake OAuth doesn't support dynamic client registration so #4540 isn't quite a duplicate. There's a recent post suggesting the addition of a
scopekey underoauth. I think that's more incidental than not. So, I believe my issue is not a duplicate.To add to this issue -- Snowflake misrepresents supported scopes of their MCP server in the resource metadata.
The resource metadata shows the wrong, possibly hard-coded, supported scope. Yes, Snowflake should fix this, but Claude Code should still also allow an override:
BTW, their noted authorization server doesn't offer
scopes_supported:Claude Code documentation claims that the OAuth metadata endpoints can be overridden. From this snippet, I thought it'd override both the Protected Resource Metadata and the authorization server metadata:
I've tried adding:
"scopes_supported": ["session:role:SPECIFIC_ROLE"]to the auth server metadata override (
authServerMetadataUrl), but it gets ignored, according to the following snippet in the debug log:Claude Code's offered explanation was that the
authServerMetadataUrlonly overrides the authorization server metadata, not the protected resource metadata, and the latter's scope prevails over the former. I'm only human, but I think the docs may be slightly misleading.bump -- it's still an issue
@davidlee-ca the issue I reported related to the
authServerMetadataUrlbeing a fallback instead of an override I believe is being addressed. This should ideally let you override the scopes with theauthServerMetadataUrlsetup after that gets released.@davidlee-ca give claude code
2.1.108a try with theauthServerMetadataUrlsetupThanks for describing this issue @davidlee-ca . I'm facing the same issue on my side.
I'd like to test the
authServerMetadataUrlfix, but I struggle to understand how to change the snowflake mcp oauth server metadata and to which value set the claude codeauthServerMetadataUrlvalue.Would you mind explaining or pointing me to documentation that explains how to add
"scopes_supported": ["session:role:SPECIFIC_ROLE"]to the MCP oauth server metadata?@tielur it works!! Thank you for the nudge. This is with Claude v2.1.109:
So, this works! Very happy to see that. I'll close the issue now.
@Simonmaignan
Run this in a terminal, with your account identifier:
curl https://[account].snowflakecomputing.com/.well-known/oauth-authorization-server/oauthThen you get something like this:Add
"scopes_supported" : [ "session:role:SPECIFIC_ROLE" ], save this as a JSON, and make it available from a public https endpoint (has to be https, http won't work per documentation on overriding oauth discovery). The easiest way to do this is through a secret gist (https://gist.github.com/) and get the raw URI.Then, create the MCP with that override. I created the following json as
snowflake-mcp-claude-code-config.json:then run in command:
claude mcp add-json snowflake "$(jq -c . snowflake-mcp-claude-code-config.json)" --client-secretHappy to follow up!
@davidlee-ca , I'm not sure if I was blind, tired or hallucinating during the last few days where I went through the Claude Code MCP documentation multiple time or if this OAuth scopes section was added recently, but this solved my issue.
Here is my
~/.claude.jsonSnowflake managed MCP entry(the OAuth client secret is stored in my Claude credentials)
This configuration sets up Claude to open the following Authorization URL and my authentication was successful out of the box.
According to Claude Code Changelog, this OAuth
scopesfeature was not added recently so I'm not sure why I missed this info during the past few days.no way, i've been woodshedding for days putting that override together...
You were not hallucinating,
scopesargument was not supported when I wrote this upThis issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.