Snowflake’s agent SDK makes long-running work resumable—but local tools move the security boundary

Snowflake has put its Cortex Agent SDK into public preview for Python and TypeScript, giving application developers a supported way to run Cortex Agents and Cortex Code, preserve conversations, observe durable turns and reconnect to long-running work. The release matters less as a new chatbot wrapper than as an attempt to make agent state and recovery explicit application primitives. Snowflake’s release note dates the preview to October 13.

Durable work becomes a first-class object

The SDK can stream text, tool calls, tool results, citations and status events to an application. It also supports persistent threads across turns and application sessions, plus background runs that clients can disconnect from and later resume by run ID. Those capabilities address a practical production problem: an agent request can outlive a browser connection or web request, and operators still need an inspectable record of what happened. The SDK exposes both conversation-oriented helpers and lower-level run, thread and saved-agent resources, according to the product documentation.

Snowflake says inline or saved agents can use Cortex Analyst, Cortex Search and custom tools against governed Snowflake data. The initial packages require Python 3.10 or later or Node.js 22.22 or later. Authentication options include programmatic access tokens, OAuth, key-pair JWTs, Snowflake session tokens and custom authenticators; the client asks the authenticator for headers before each request attempt and can invoke a refresh callback after recognized token expiry.

The execution boundary is the key design choice

The documentation separates two coding modes that should not be treated as equivalent. A managed coding agent runs durable turns inside Snowflake. The Cortex Code CLI, by contrast, is launched by the SDK on the application host and can access local files, commands, hooks and MCP servers. That makes deployment architecture a security decision: granting the local CLI access to a workspace or command runner extends the agent’s effective boundary beyond governed warehouse data.

Teams evaluating the preview should therefore test more than answer quality. They should verify which identity each tool uses, what local paths and commands are reachable, how streamed tool events enter audit systems, whether interrupted runs reconnect idempotently, and how credentials refresh during long jobs. They should also account for the preview’s regional limitation: Snowflake says the feature is available to all accounts except those in the People’s Republic of China.

The SDK supplies useful mechanics for durable agent applications. It does not remove the need to define where execution happens, which tools cross that boundary and how a resumed run is authorized after the original client has gone away.