Snowflake-Labs/sfutils-plugins

Snowflake-Labs/sfutils-plugins

Description: CoCo plugin: Snowflake utility skills (PAT, networks, external volumes)

Language: Shell

License: Apache-2.0

Stars: 0

Forks: 0

Open issues: 0

Created: 2026-06-26T02:42:47Z

Pushed: 2026-06-26T06:11:37Z

Default branch: main

Fork: no

Archived: no

README:

sfutils

Setting up a service account PAT, network policy, or external volume in Snowflake means juggling 5-12 SQL statements across multiple docs pages, getting the dependency order right, and hoping you didn't fat-finger an IAM ARN. One mistake and you start over.

sfutils is a Cortex Code plugin that turns those multi-step setup tasks into single-intent conversations with dry-run previews, automatic dependency resolution, and a TOML manifest you can replay or share with your team.

Quickstart

cortex plugin install https://github.com/Snowflake-Labs/sfutils-plugins

Then in the CoCo chat panel:

set up a programmatic access token for my CI pipeline

That single sentence creates a service user, network policy, auth policy, and PAT token. You get a dry-run preview before anything executes.

How this complements bundled skills

Bundled CoCo skills are great for working with individual Snowflake objects: configuring an auth policy, creating a single network rule, or troubleshooting an external volume. sfutils picks up where they leave off, orchestrating the multi-object workflows that tie those pieces together:

• PAT: creates the service user, network policy, auth policy, and

token in one pass. Supports rotate, verify, and remove.

• Network: resolves provider IPs (GitHub Actions, Google, custom

CIDRs), creates rules, attaches policies, builds EAIs.

• External Volume: provisions the S3 bucket, IAM role with trust

policy, and Snowflake volume. Verifies storage access end-to-end.

Every action gets a dry-run first. Everything is tracked in a manifest you can export, replay on another account, or hand to a teammate.

Usage

Describe what you need in the CoCo chat panel:

set up a programmatic access token for my CI pipeline
create a network rule allowing GitHub Actions
create an external volume for Iceberg on S3

Or invoke a skill directly:

$sfutils:pat
$sfutils:network
$sfutils:extvolume

Skills

| Skill | Purpose | | --------- | -------------------------------------------------- | | pat | PAT lifecycle: service user, auth policy, tokens | | network | Ingress/egress rules, policies, EAIs | | extvolume | S3 external volume with IAM trust for Iceberg |

Prerequisites

• Cortex Code
• Snowflake CLI (snow) with a configured connection
• Python 3.12+ and uv
• AWS credentials (for extvolume skill)

CLI backends

Each skill delegates to a dedicated CLI tool, installed automatically via uv on first use.

| Package | Repository | Version | | ------------------ | ----------------------------------------------------------------------- | ------- | | sfutils-pat | Snowflake-Labs/sfutils-pat | v0.4.1 | | sfutils-networks | Snowflake-Labs/sfutils-networks | v0.2.2 | | sfutils-extvolumes | Snowflake-Labs/sfutils-extvolumes | v0.2.2 |

Design philosophy

sfutils follows the Infrastructure-as-Intent pattern: you declare the desired outcome, the system resolves the dependency chain and execution order. One intent expression maps to 10+ underlying operations, an Intent Compression Ratio high enough to qualify as an architectural partner, not just an automation wrapper. Dry-run previews and manifest tracking keep it Glass Box: full observability with safe retry.

Contributing

Follow conventional commit format. See AGENTS.md for full conventions.

License

Apache 2.0. See LICENSE.