Snowflake Launches Cortex AI Gateway as Control Point for Enterprise AI

A single endpoint for many models

Snowflake argues that the enterprise AI stack has become fragmented. Vector databases, monitoring systems, coding agents, embedded agents and Model Context Protocol (MCP) servers are adopted by different teams on different timelines, which the company says can create a management and governance gap that affects security. Few enterprises, it says, can answer basic questions: which models are being called, by whom, what actions they take and at what cost.

Cortex AI Gateway is meant to close that gap with one endpoint. According to Snowflake, it implements the Chat Completions API for OpenAI, Grok, GLM, Gemini, Llama, Mistral and DeepSeek models, and the Messages API for Claude. Streaming, tool calling, structured output, prompt caching, image input and reasoning work as they do natively, so an existing client needs only a different base URL and a token. Support for the OpenAI Responses API is coming very soon.

Access control relies on Snowflake's existing role-based access control (RBAC) framework, and an admin can limit which models are available through the gateway. The Snowflake CLI is also set to handle gateway setup for coding agents. Snowflake says launching OpenCode through the gateway comes down to running snow ai opencode.

Dynamic routing aims to cut token use

Snowflake says many teams use a single frontier model for everything, which is easy to start with but expensive at scale. Dynamic model routing, coming soon to private preview, selects the most affordable available model that can confidently complete the task at each step of agent execution. The company says the router was fine-tuned by its research team, sending repetitive, lower-complexity work to efficient models and work needing deeper reasoning to frontier models.

In an internal evaluation, Snowflake reports, the router completed a dbt pipeline workload with up to 3x greater token efficiency than a frontier-model-only approach at comparable quality. In a separate coding test, engineering teams held pull-request throughput steady while using roughly 25% fewer tokens.

Routing follows the same rules as manual selection: only approved models are used, existing data residency settings are respected, and every routing decision is logged so compliance teams can see which model handled which request.

Snowflake also highlighted open source models. On ADE-bench, using Snowflake CoCo as the agent harness, DeepSeek-V4-Flash scored 74.4%, which the company says is ahead of the leading proprietary model it tested. GLM-5.3 is coming soon to private preview, while its predecessor GLM-5.2 scored 66% with the lowest token footprint of any model in the benchmark. These models are served inside the Snowflake perimeter, next to governed data.

Governing what agents can do

The gateway also targets MCP tool use. Snowflake describes unmanaged MCP servers as a form of shadow IT in which unauthorized software can read production databases and modify records in enterprise SaaS. A tool gateway, it says, must decide whether a given agent may perform a specific tool call on behalf of a specific user at that moment.

Tools in Cortex AI Gateway, built following Snowflake's acquisition of Natoma, is in private preview. It ships with a curated catalog of more than 100 MCP servers, each with OAuth handled for the user. Administrators can enable specific tools, all currently published tools, or all current and future tools. Tools that are not enabled are not visible to the client and cannot be invoked.

Tool calls can be logged, and they emit spans into the same trace table as inference, so one trace covers both the reasoning and the actions. Snowflake says this record is a defense against tool poisoning, tool shadowing and rug pulls, where an approved server quietly changes a tool's definition.

What it means for enterprises

Snowflake frames restriction as an unworkable response to AI sprawl, arguing that blocking employees only pushes them toward unsanctioned tools. The gateway is its answer: central visibility, governance and cost attribution, while application teams build against one endpoint. The company lists six elements it considers essential: governed inference, dynamic model routing, MCP and tool governance, central observability, security policies and guardrails, and cost governance.

Availability is staggered. The gateway is in public preview, tool governance is in private preview, and dynamic routing and GLM-5.3 are expected in private preview soon. The performance figures come from Snowflake's own evaluations, so customers will want to test them on their own workloads.