--- schema_version: "1" id: 3d1999cbdbe8cae2a05de4902f812383586b5809e8f9fc5a376faaecdb5f490f title: Adding a Scanner for Snowflake Cortex AI collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/exchange/adding-snowflake-cortex-ai-scanner.md canonical_url: https://docs.mulesoft.com/exchange/adding-snowflake-cortex-ai-scanner source_site: docs.mulesoft.com content_type: documentation content_hash: 8a2fb7c4c9a48b0d7bce01f8fd5a58e155a9d14d40cd9652a10999732f300b76 description: MuleSoft Documentation Site latest: true --- --- product: Exchange --- # Adding a Scanner for Snowflake Cortex AI > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Add a scanner to discover, import, and sync agents from Snowflake Cortex AI into Exchange. Then you can govern the agents and consume them in other applications. ## Before You Begin Before adding the scanner, verify that you have these prerequisites: - Exchange Administrator permission - Snowflake Enterprise edition account with Cortex agents enabled - Snowflake user with the ACCOUNTADMIN role for one-time setup - Snowflake account URL - Snowflake programmatic access token (PAT) generated during one-time setup ## Set Up Snowflake for the Scanner Complete these steps once in Snowflake before adding the scanner. After setup, the scanner authenticates as a service user with a least-privilege custom role. Use the ACCOUNTADMIN role only for the initial grants in this section. 1. Create a custom scanner role and grant it access to Cortex agents. Sign in to Snowflake as a user with the ACCOUNTADMIN role and run: ```sql USE ROLE ACCOUNTADMIN; CREATE ROLE ANYPOINT_SCANNER_ROLE; GRANT DATABASE ROLE SNOWFLAKE.CORTEX_AGENT_USER TO ROLE ANYPOINT_SCANNER_ROLE; ``` 2. Create or reuse a warehouse for the scanner. - To create a new warehouse: ```sql CREATE WAREHOUSE COMPUTE_WH WITH WAREHOUSE_SIZE = 'XSMALL' AUTO_SUSPEND = 60 INITIALLY_SUSPENDED = TRUE; GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE ANYPOINT_SCANNER_ROLE; ``` - To reuse an existing warehouse, grant usage on it: ```sql GRANT USAGE ON WAREHOUSE TO ROLE ANYPOINT_SCANNER_ROLE; ``` 3. Create a service user for the scanner and assign the scanner role. ```sql CREATE USER ANYPOINT_SCANNER TYPE = SERVICE DEFAULT_ROLE = ANYPOINT_SCANNER_ROLE DEFAULT_WAREHOUSE = COMPUTE_WH; GRANT ROLE ANYPOINT_SCANNER_ROLE TO USER ANYPOINT_SCANNER; ``` 4. Grant the scanner role read access to the databases and schemas that contain Cortex agents you want to scan. Run this block for each database and schema you want to scan, replacing `` and ``: ```sql GRANT USAGE ON DATABASE TO ROLE ANYPOINT_SCANNER_ROLE; GRANT USAGE ON SCHEMA . TO ROLE ANYPOINT_SCANNER_ROLE; GRANT USAGE ON ALL AGENTS IN SCHEMA . TO ROLE ANYPOINT_SCANNER_ROLE; GRANT USAGE ON FUTURE AGENTS IN SCHEMA . TO ROLE ANYPOINT_SCANNER_ROLE; ``` 5. Restrict the service user to the scanner’s egress IP ranges. This step reduces the service user’s attack surface. Replace `` with the CIDR blocks that MuleSoft provides: ```sql CREATE NETWORK RULE ANYPOINT_SCANNER_NR MODE = INGRESS TYPE = IPV4 VALUE_LIST = (''); CREATE NETWORK POLICY ANYPOINT_SCANNER_NP ALLOWED_NETWORK_RULE_LIST = (ANYPOINT_SCANNER_NR); ALTER USER ANYPOINT_SCANNER SET NETWORK_POLICY = ANYPOINT_SCANNER_NP; ``` 6. Generate a programmatic access token (PAT) for the service user. 1. In Snowsight, click **Governance & security** 2. Click **Users & roles**. 3. Open the `ANYPOINT_SCANNER` user. 4. Click **Programmatic access tokens** 5. Click **Generate new token**. 6. In **Name**, enter `anypoint_scanner`. 7. In **Expires in**, set an expiry that follows your secret-rotation policy. The Snowflake maximum is 365 days. 8. For **Role**, select **One specific role**, and then select `ANYPOINT_SCANNER_ROLE`. 9. Click **Generate**, and copy the token immediately. Snowflake displays the token only once. Use this token in the **Programmatic Access Token** field when you add the scanner. ## Add a Scanner for Snowflake Cortex AI 1. Verify that you are in the business group where you want to add the scanner. 2. From the sidebar in Exchange, click **Scanners**. 3. Enter a name for the scanner. 4. From **Scanner Run Configuration**, complete these fields or options:

Field/Option	Value
Run Schedule	Select a frequency and time.
Sync Review	Select an option: Auto-resolve or Ask to review.

5. From **Connection Configuration**, complete these fields:

Field	Value
Provider	Select Snowflake.
Platform	Select Cortex AI.
Service Type	Agents is selected by default.
Authentication Method	Service Account selected by default.
Account URL	Enter the account URL.
Programmatic Access Token	Enter the programmatic access token.
Database Filter	To filter by database, enter the database name, or a comma-separated list of database names.
Schema Filter	To filter by schema, enter the schema name, or a comma-separated list of schema names.

6. Click **Test Connection**. If the connection fails, review the **Connection Configuration** settings. Update the settings, and then test the connection again. 7. To send email notifications: 1. Select **Advanced Settings** and turn on **Send Email Notifications**. 2. Enter an email address. 8. Click **Add Scanner**. ## See Also - [Amazon Scanners](https://docs.mulesoft.com/exchange/aws-scanners) - [Discovering and Cataloging External Services with Scanners](https://docs.mulesoft.com/exchange/discovering-and-importing-external-agents) - [Managing Scanners In Exchange](https://docs.mulesoft.com/exchange/managing-scanners)