Cortex Code

Cortex Code Integration Skill

Install

# Install via npm skills ecosystem (works with Claude Code, Cursor, Codex, and 40+ agents)
npx skills add snowflake-labs/subagent-cortex-code --copy

# Prerequisite: Cortex Code CLI must be installed and configured
# See: https://docs.snowflake.com/en/user-guide/cortex-code
which cortex  # verify installation

This skill enables your coding agent to leverage Cortex Code's specialized Snowflake expertise by intelligently routing Snowflake-related operations to Cortex Code CLI in headless mode.

Architecture Overview

Routing Principle: ONLY Snowflake operations → Cortex Code. Everything else → your coding agent.

Key Components:

• Dynamic skill discovery at session initialization
• LLM-based semantic routing (not keyword matching)
• Security wrapper with approval modes (prompt/auto/envelope_only)
• Stateless Cortex execution with context enrichment
• Hybrid memory management
• Audit logging for compliance

Security

The skill includes a security wrapper around Cortex execution with three approval modes:

Approval Modes

1. prompt (default): High security

• User shown approval prompt with predicted tools and confidence
• User must approve before execution
• No audit logging required
• Best for: Interactive sessions, untrusted prompts, production

1. auto: Medium security

• All operations auto-approved
• Mandatory audit logging
• Envelopes still enforced
• Best for: Automated workflows, trusted environments

1. envelope_only: Medium security

• No tool prediction (faster)
• Auto-approved with audit logging
• Relies on envelope blocklist only
• Best for: Trusted environments, low latency needs

Configuration: Set in config.yaml in the skill's install directory, or via organization policy.

IMPORTANT — `config.yaml` is optional. The skill ships only config.yaml.example as a template. If no config.yaml exists, the Python scripts apply safe defaults (approval_mode: prompt, default_envelope: RO). Do not search, glob, or `ls` for `config.yaml` before executing — ConfigManager handles this internally. Only read/create config.yaml if the user explicitly asks to change settings.

Built-in Protections

• Prompt Sanitization: Automatic PII removal and injection detection
• Credential Blocking: Prevents routing when credential paths detected
• Secure Caching: SHA256-validated cache in ~/.cache/cortex-skill/
• Audit Logging: Structured JSONL logs (mandatory for auto/envelope_only)
• Organization Policy: Enterprise override via ~/.snowflake/cortex/claude-skill-policy.yaml

Fast Path for Repeat Queries

Session state is cached — do not re-run initialization steps on every query.

Skip the following steps if they've already run in the current session:

• discover_cortex.py — output cached to ~/.cache/cortex-skill/cortex-capabilities.json
• route_request.py — for obvious Snowflake queries (user says "Snowflake", "Cortex", "databases", "warehouse", etc.), you can skip routing and go straight to execution
• cortex connections list — the active connection doesn't change within a session; reuse it
• Any config.yaml / org-policy inspection — ConfigManager handles this (see note above)

Minimal flow for a follow-up Snowflake query (after the first query in a session):

1. (If approval_mode: prompt) ask user for approval
2. Call execute_cortex.py with the enriched prompt and envelope
3. Return results

That's it. Three steps — no re-discovery, no re-routing, no config inspection.

Session Initialization

When this skill is first loaded:

Step 1: Discover Cortex Capabilities

PYTHON=$(command -v python3 2>/dev/null || command -v python 2>/dev/null || echo python3)
$PYTHON scripts/discover_cortex.py

This script:

1. Runs cortex skill list to enumerate all available Cortex skills
2. Reads each skill's SKILL.md frontmatter and trigger patterns
3. Caches capabilities with CacheManager in the configured cache directory
4. Returns structured data about what Cortex can handle

Expected output: JSON mapping of skill names to their trigger patterns and capabilities.

Step 2: Load Routing Context

The discovered capabilities are loaded into memory to inform routing decisions throughout the session.

Workflow: Handling User Requests

Step 1: Analyze Request with LLM-Based Routing

Before taking any action, analyze the user's request:

PYTHON=$(command -v python3 2>/dev/null || command -v python 2>/dev/null || echo python3)
$PYTHON scripts/route_request.py --prompt "USER_PROMPT_HERE"

This script:

1. Loads Cortex capabilities from cache
2. Uses LLM reasoning to classify the request
3. Returns routing decision with confidence score

Routing Logic:

• Route to Cortex if request involves:
• Snowflake databases, warehouses, schemas, tables
• SQL queries specifically for Snowflake
• Cortex AI features (Cortex Search, Cortex Analyst, ML functions)
• Snowpark, dynamic tables, streams, tasks
• Data governance, data quality, or security in Snowflake context
• User explicitly mentions "Cortex" or "Snowflake"

• Route to your coding agent if request involves:
• Local file operations (reading, writing, editing local files)
• General programming (Python, JavaScript, etc. not Snowflake-specific)
• Non-Snowflake databases (PostgreSQL, MySQL, MongoDB, etc.)
• Web development, frontend work
• Infrastructure/DevOps unrelated to Snowflake
• Git operations, GitHub, version control

Step 2: Execute Based on Routing Decision

If routing is coding_agent (handle locally):

Handle the request directly using your agent's built-in capabilities. No Cortex involvement.

If routed to Cortex Code:

Proceed to Step 3.

Step 3: Choose Security Envelope and Handle Approval

Before executing Cortex, the security wrapper handles approval based on configured mode.

Step 3a: Check Approval Mode

security_wrapper.py reads approval_mode from config.yaml internally — do not inspect the config file yourself. If config.yaml doesn't exist, the default is prompt mode.

• prompt mode (default): Requires user approval
• auto mode: Auto-approve with audit logging
• envelope_only mode: Auto-approve, no tool prediction

Step 3b: Handle Approval (if prompt mode)

If using prompt mode:

PYTHON=$(command -v python3 2>/dev/null || command -v python 2>/dev/null || echo python3)
$PYTHON scripts/security_wrapper.py \
  --prompt "ENRICHED_PROMPT" \
  --envelope "RW"

This will:

1. Predict required tools using LLM
2. Display approval prompt to user: ``` Cortex Code needs to execute the following tools:

• snowflake_sql_execute • Read • Write

Envelope: RW Confidence: 85%

Approve execution? [yes/no]

3. If approved, proceed to Step 3c
4. If denied, abort execution

#### Step 3c: Determine Security Envelope

Determine the appropriate security envelope based on the operation:
- **RO** (Read-Only): For queries and read operations - blocks Edit, Write, destructive Bash
- **RW** (Read-Write): For data modifications - allows most operations, blocks destructive Bash
- **RESEARCH**: For exploratory work - read access plus web tools
- **DEPLOY**: For deployment operations - blocks destructive Bash commands
- **NONE**: Custom blocklist via --disallowed-tools

### Step 4: Enrich Context for Cortex

Build an enriched prompt that includes:

**Claude Conversation Context**:
- Last 2-3 relevant exchanges from current Claude session
- Any Snowflake-specific details already discussed

**Recent Cortex Session Context**:

PYTHON=$(command -v python3 2>/dev/null || command -v python 2>/dev/null || echo python3) $PYTHON scripts/read_cortex_sessions.py --limit 3