Snowflake to acquire MCP-focused Natoma to boost governance for AI agents

Snowflake said it plans to acquire US-based startup Natoma to boost governance, security, and connectivity for AI agents operating across heterogeneous enterprise environments, amid growing efforts by organizations to move agentic AI workflows from pilots into production.

The cloud data platform provider is betting that enterprises will increasingly require centralized governance, identity controls, and auditability as AI agents begin interacting more deeply with internal applications, APIs, and business workflows through the emerging Model Context Protocol (MCP) standard, an area in which Natoma claims to specialize.

Natoma’s platform, which provides MCP-based tool access along with governance and observability capabilities, will be integrated into Snowflake to help enterprises securely connect Cortex Agents, Snowflake Intelligence, Cortex Code, and other AI platforms with enterprise systems spanning SaaS applications, cloud environments, VPCs, and on-premises infrastructure through MCP servers, the company said.

Essentially, Natomi will provide the control and governance fabric for these connections, it added.

Why governed MCP matters for CIOs

That control and governance fabric is increasingly becoming essential for CIOs, according to analysts, as real-time autonomous agentic workloads spanning multiple systems and environments get increasingly connected via MCP.

“MCP is becoming the connective tissue for enterprise agents, but without identity, policy, privileged access controls, and auditability, it can quickly become a shadow AI risk,” Phil Fersht, CEO of HFS Research, said.

“It is no longer enough to govern who can query a table. CIOs now need to govern what AI agents can see, which systems they can touch, what actions they can trigger, and how all of that gets audited,” Fersht added.

More so because “MCP is not foolproof” by itself, according to Robert Kramer, managing partner at KramerERP.

“MCP is a protocol, not a governance model by itself. It can standardize connections, but it can also standardize risk if access is too broad, tools are poorly governed, or agents are trusted too quickly,” Kramer said.

That rationale, precisely, is what Fersht feels could deliver value for enterprise customers: “The value is not saying simply that ‘we support MCP’, rather it is in providing governed MCP with verified servers, identity-aware authorization, policy enforcement, auditability, and gateway control.”

Enterprises are still not ready for large-scale MCP adoption

However, the analyst pointed out that while the acquisition could help CIOs build stronger governance and operational foundations for enterprise AI agents, most enterprises are still not fully prepared to consume services or tools via MCP.

“They want the productivity and context benefits, but their governance, identity, data classification, and access-control models are still catching up,” Fersht said.

“CIOs should be wary of treating MCP as a plug-and-play miracle. Agents can pull context from email, Slack, CRM, and internal systems, but that also means they can expose sensitive information, trigger the wrong action, or bypass established workflow controls if policies are weak,” Fersht added.

“The watchpoints are identity-aware permissions, least-privilege access, audit trails, human-in-the-loop approval for high-risk actions, data leakage controls, and clear ownership when an agent makes a bad decision,” the analyst further added.

Snowflake joins the race to own the AI control plane

For Constellation Research principal analyst Michael Ni, though, the acquisition reflects the cloud data platform provider’s efforts to own the AI control plane.

“Data platforms won the analytics era. Whoever governs agents, context, and autonomous actions wins the agentic era. Natoma gives Snowflake the missing layer between insight and execution,” Ni said.

Snowflake’s strategy also mirrors a wider industry push, with other enterprise technology vendors increasingly racing to establish themselves as the orchestration and governance layer for enterprise AI agents.

While SaaS vendors like Salesforce, ServiceNow, and Workday are embedding agentic orchestration capabilities into their offerings, hyperscalers such as Microsoft, AWS, and Google are consolidating their agentic development toolkits with similar tools and functions.

That broader industry shift also sets the context for Snowflake’s next challenge.

While its efforts currently appear well aligned with enterprise efforts to operationalize AI agents, the bigger test, analysts say, will be how seamlessly Snowflake can integrate Natoma’s governance capabilities into its offerings and whether CIOs can manage agent permissions, policies, and controls at scale without introducing yet another layer of complexity.

Snowflake did not disclose the financial terms of the acquisition or indicate when the deal is expected to close.