Local terminal app · Open source alpha

Snowbeam

Your way into Snowflake.

Manage many Snowflake connections for many agents, across organizations and accounts.

Stay productive without taking shortcuts on who gets access.

Built first for Omarchy, with Linux and macOS support.

Install the alpha Source on GitHub

One person. Many agents.

In the age of AI, one person can build and manage many agents. When those agents do real work and submit real data in Snowflake, you also inherit a growing list of connections, identities, and credentials.

Don't give your agents your personal login.

If you're setting up agents, your Snowflake user likely has ACCOUNTADMIN, SYSADMIN, or another highly privileged role. Sharing your personal login can give an agent that authority: access to sensitive data, permission to change or delete objects, or control over users and grants. A mistake or compromised agent can then reach far beyond its assigned job.

Don't create one login for many agents.

Creating one shared key, token, password, or login is also the wrong shortcut. Every agent's work appears under the same user, making it harder to tell which agent acted. You cannot limit or revoke one agent's access independently through that shared identity.

Manage your agents like a human workforce.

A human workforce needs separation of duties, checks and balances, and attribution. Your agents do too. Give each autonomous agent its own Snowflake identity and credentials, with only the access its job needs. Where approval is required, separate the authority to prepare work from the authority to approve it. Keep a record of which agent did what.

Enforce those boundaries through Snowflake permissions and your approval process. Keep stored tokens and private keys in a password or secrets manager such as Bitwarden or 1Password. Snowbeam makes the growing inventory of connections, identities, and credentials easier to organize and maintain.

See Snowflake's guidance on access control, autonomous agent identities, and authentication methods.

Keep every connection in context.

Many organizations and accounts: Give organizations and accounts local aliases and notes: FLXH5C4T can appear as Acme Accounting LLC. Keep the real Snowflake identifiers for connections, and label individual identities by client, owner, and runtime.
Individual access, repeatable setup: Reuse account-bound templates for roles and policies while giving agents individual tokens, key pairs, or workload identities. Review a plan before creating, rotating, or revoking managed credentials.
Keep up as the inventory grows: See token expiry, disabled credentials, policy changes, and failed or stale checks. Optional desktop reminders help you keep up with access that needs attention.

A terminal app you can inspect.

Move between connections, identities, tokens, and attention. Read the evidence behind an identity before deciding what to change.

Snowbeam's identity inventory showing an organization tree, client, account, runtime, and security status columns, and details for the selected identity. — A capture of the working app with synthetic demo data. Open full size.

Local control. Explicit responsibilities.

Snowbeam keeps connection metadata, policy evidence, vault references, and an operation journal on your machine. It works through Snowflake CLI and has no Snowbeam server or remote sync.

A local SQLite database keeps the inventory available between refreshes and preserves your aliases and notes across upgrades. Choose a refresh interval for each connection; failed checks back off while retaining the last result. Routine inventory checks use that connection's configured user. Keep secret values in your vault.

Snowflake: Authenticates identities and enforces access, roles, and policies.
1Password or Bitwarden: Holds managed tokens and private keys. Snowbeam's persistent inventory records references, not their secret values.
Your agent runtime: Runs the agent with its own identity. Operating-system isolation and vault or cloud access remain your responsibility.

Snowbeam works independently of Airlock. Airlock governs submitted business work inside Snowflake; Snowbeam manages local connections and identity setup.

Install Snowbeam.

Snowbeam is an MIT-licensed alpha. Start with the synthetic demo; it needs no Snowflake credentials.

macOS · Homebrew

With Homebrew installed:

brew install reunionstudio/tap/snowbeam
snowbeam --demo

In a Homebrew installation, open Updates to check for a newer release. Update and restart installs it after your click and reopens the app. Automatic release checks are optional; they never install an update on their own. Homebrew may also update dependencies.

Mac installation, upgrades, and uninstall

Omarchy and Linux · uv

With uv installed, run this command. It downloads the release directly; no checkout or build step is needed.

uv tool install https://github.com/reunionstudio/snowbeam/releases/download/v0.2.0a3/snowbeam-0.2.0a3-py3-none-any.whl
snowbeam --demo
snowbeam desktop install

The optional desktop command adds the pixel icon and terminal launcher. Linux wheel upgrades currently require downloading and reinstalling the new wheel. An AUR package and an Omarchy updater action are planned; actual Omarchy desktop validation is pending.

Omarchy and Linux instructions · User guide · Downloads and release notes

Live inventory requires Snowflake CLI and your configured connections. Vault workflows require the chosen vault CLI and authorization. No DMG is provided.

Help shape Snowbeam.

The source and alpha downloads are public. Use a dedicated test account to evaluate managed credential changes.

Local tests use isolated, synthetic data. Hosted Linux CI and end-to-end validation with live Snowflake accounts, vault providers, cloud workload identities, and an Omarchy desktop are still pending.

Managing several clients or setting up agents with individual Snowflake access? Tell us what you need.

Ask about Snowbeam