Runtime APICLIMCPSDK (coming soon)Partly coming soon

Data warehouse and analytics: evaluate in the driver, not on the network

In a warehouse, SQL comes from notebooks, services, BI tools and, more and more, AI agents. Snowflake has no TCP wire protocol a proxy could intercept, so Vericto evaluates each statement before it runs, with the Runtime API, and checks the SQL of models and migrations with the CLI, the Validation API and MCP. Evaluation in the driver, with the SDK, is coming soon.

Partly coming soon. Available today: the Snowflake dialect, with rules VERICTO-091 to 097, in the Runtime API (dialect: snowflake), the Validation API, the CLI and MCP. Coming soon: the Python and Node SDKs, which will wrap snowflake.connector and snowflake-sdk; they are not published yet. Snowflake has no proxy.

Talk to sales Snowflake rules
Diagram: Snowflake data warehouse with VerictoA Python or Node service or agent asks the Runtime API with dialect snowflake before running each statement, and runs it on Snowflake only if it is not BLOCKED. The Vericto SDK, which will wrap the Snowflake connector and make that check for you, is coming soon. BI tools connect directly to Snowflake with their own driver and do not go through Vericto.check before executionif not BLOCKEDdirect connection: no VerictoService or agentPython or NodeVericto SDKwraps the connectorComing soonRuntime APIdialect: snowflakeEvaluates hereSnowflakewarehouseBI toolsTableau, LookerDiagram: Snowflake data warehouse with VerictoA Python or Node service or agent asks the Runtime API with dialect snowflake before running each statement, and runs it on Snowflake only if it is not BLOCKED. The Vericto SDK, which will wrap the Snowflake connector and make that check for you, is coming soon. BI tools connect directly to Snowflake with their own driver and do not go through Vericto.if not BLOCKEDdirect connection: no VerictoService or agentPython or NodeVericto SDKwraps the connectorComing soonRuntime APIdialect: snowflakeEvaluates hereSnowflakewarehouseBI toolsTableau, Looker
  • SQL statement path
  • Path Vericto does not evaluate
  • Where Vericto evaluates
  • Vericto component that does not evaluate
  • Coming soon: not available yet
Above, a service or agent asks the Runtime API with dialect: snowflake before running, and runs on Snowflake only if the answer is not BLOCKED. The SDK that will make that call from the connector is coming soon. Below, BI tools, which connect directly with their own driver and stay outside Vericto.

What it protects

The Snowflake rules only read what its parser records, so they never fire on another dialect. They add to the standard rules, such as DELETE and UPDATE without WHERE or DROP TABLE:

Latency and availability

Each statement adds one HTTP call to the Runtime API before it runs. There are no published figures for that round trip or for parsing analytics SQL, which tends to be longer than an application's: we will publish them once they are measured.

The Runtime API, the Validation API and MCP run in Vericto Cloud, with a 99.5% SLA on Builder and 99.9% on Team and Enterprise (99.95% and 99.99% with a dedicated deployment). Service status is on the status page.

How to implement it

  1. Register the database with the Snowflake dialect and create an API key with the Runtime API scope (proxy:evaluate).
  2. Before running each statement, call the Runtime API with dialect: snowflake and run it only if the answer is 200.
  3. Check models and migrations in CI with the CLI and the Snowflake dialect, and let your coding agent check the SQL with MCP: see data pipelines.
  4. Coming soon: in Python, wrapping snowflake.connector with the Vericto SDK; in Node, snowflake-sdk. The SDK will make the Runtime API call before every execute; it is not published yet.

When not to use this option

  • BI tools and anything that uses its own driver. It cannot be routed through Vericto, because Snowflake has no proxy. Use Snowflake's native controls: roles, masking policies and row access policies.
  • Analytics on Postgres or MySQL, such as a read replica: the TCP proxy is available today. See web application.
  • Other warehouses. They are not supported today.

Plan availability

FeatureFreeBuilderTeamEnterprise
Snowflake: dialect and rules VERICTO-091 to 097YesYesYesYes
Python and Node SDKs (LangChain, LlamaIndex)Coming soon
Runtime APIYesYesYesYes
CLI and MCP validations1K per month10K per monthUnlimitedUnlimited

Prices and every limit on Pricing.

Using Snowflake?

Start today with the Runtime API, the CLI or MCP and the Snowflake dialect. If you want to try the SDK, which is not published yet, write to us.

Talk to sales Start free