Model Context Protocol
    v2.0.0
    19 tools
    MIT License

    The USB-C of ServiceNow + AI

    One protocol. Every AI assistant. Access you actually control.

    Connect Claude, Codex, Cursor, VS Code, or any MCP-compatible client to your ServiceNow instances. 19 tools, named profiles per instance, and deny-by-default table access — so an assistant reaches exactly the tables you granted it and nothing else.

    Built by Brandon Wilson for OnlyFlows.

    View on npmStar on GitHub

    Related links

    Connect this product page to the wider OnlyFlows ecosystem, including trust/entity pages, editorial content, and adjacent ServiceNow AI tooling.

    About OnlyFlowsMeet Brandon WilsonRead the BlogWhat is MCP?
    Quick Answer

    What does the ServiceNow MCP Server enable?

    The ServiceNow MCP Server connects MCP-compatible AI clients to ServiceNow through a reusable protocol layer. Version 2.0.0 exposes 19 tools across CRUD, incident journals, analytics, schema, CMDB traversal, and ATF, and scopes every one of them to a named instance profile with deny-by-default table access. It is designed for teams that want vendor-agnostic AI connectivity with an access boundary they can point at in a review.

    Key Takeaways

    • 19 tools across CRUD, analytics, schema, CMDB, logs, code search, and ATF.
    • Named profiles per instance — every tool call selects one explicitly, with no default or session state.
    • Table access is deny-by-default, so a profile only reaches what you granted it.
    • Runs as a local stdio process: nothing listens on a port, and no client config holds a ServiceNow credential.
    • Works across MCP-capable clients instead of tying you to one AI interface.

    What is MCP?

    The Model Context Protocol is an open standard by Anthropic that lets AI assistants connect to external tools and data sources. Think of it as USB-C for AI — one universal plug that works everywhere.

    Universal Protocol

    One server works with Claude Desktop, Claude Code, Codex, Cursor, VS Code, Windsurf, and any MCP-compatible client. No vendor lock-in.

    Local stdio, no port

    Your client spawns the server and talks to it over that process's stdin and stdout. Nothing listens on a port, so nothing off your machine can reach it.

    Deny by default

    A profile with no rules denies every call. You grant the narrowest read and write set that does the job, and ServiceNow's own ACLs still apply on top.

    New in v2.0.0

    From a single connection to a governed one

    1.0 shipped 17 tools against one instance configured from environment variables. 2.0 adds named profiles, real authentication options, and an access boundary that fails closed.

    Multi-instance profiles

    Named connections for dev, test, prod, and PDI. Credentials are encrypted at rest with AES-256-GCM in an owner-only ~/.servicenow-mcp, or referenced from your secret manager.

    Deny-by-default table access

    A profile with no rules denies every call. You grant the narrowest set that does the job — in 1.0 a tool could reach any table the credential could.

    OAuth 2.0 and API keys

    client_credentials and password grants plus API-key auth, alongside basic. ServiceNow is phasing out inbound basic auth, so OAuth is the recommended path.

    Guided setup and a doctor

    servicenow-mcp-setup walks one connection end to end and verifies the credential against the instance before writing anything. doctor diagnoses an install and prints a remedy per failure.

    Append-only incident journals

    Comments and work notes moved to dedicated tools, so a generic update can never overwrite or replay a journal entry.

    Token-efficient responses

    Compact JSON, bounded default field selection, pagination metadata, response_format, and a max_response_bytes truncation guard.

    Read the full changelog

    Upgrading from 1.0

    Two changes apply to every install: name a profile on every tool call, and grant table access. Everything else only matters if you used the affected surface.

    • Every tool call must name a profile. There is no default, active, or session-selected profile — set SN_PROFILE_NAME if you configure from bare SN_* variables.

    • Table access is deny-by-default per profile. Grant it with servicenow-mcp-setup grant before your first call.

    • sn_attach no longer accepts host filesystem paths. Uploads take content_base64 and downloads return inline base64.

    • sn_script is withdrawn. It was never functional in 1.0 — use sn_query and sn_batch instead.

    • sn_update, sn_create, and sn_batch reject generic comments and work_notes, and point at the dedicated incident journal tools.

    • The transport is unchanged. A client entry that launched the package in 1.0 still launches it.

    Full migration guide

    19 Tools. Scoped to What You Grant.

    Everything from simple lookups to CMDB graph traversal — exposed as MCP tools that any AI assistant can call, each one against a profile you named.

    Core CRUD

    8 tools

    Read and write the tables a profile has been granted. Incident journals are split into dedicated append-only tools.

    Query

    Query an approved table with structured filters, field selection, pagination, and sorting. Raw encoded queries are opt-in per tool and table.

    sn_query

    Get Record

    Retrieve a single record by sys_id from an approved table, with bounded default field selection.

    sn_get

    Create

    Create an incident using only controlled, ordinary writable fields — journal fields are rejected by design.

    sn_create

    Update

    Update one incident selected by exact sys_id, using only controlled, ordinary writable fields.

    sn_update

    Add Comment

    Append one bounded customer-visible comment to an incident. Append-only — repeated calls append again.

    sn_incident_add_comment

    Add Work Note

    Append one bounded internal work note to an incident. Append-only — repeated calls append again.

    sn_incident_add_work_note

    Delete

    Delete a record on an approved write table. Requires an explicit confirm: true.

    sn_delete

    Batch

    Bulk update or delete behind a required structured filter. Dry-run by default; confirm: true to execute.

    sn_batch

    Analytics & Schema

    3 tools

    Turn the platform into answers without exporting a single row.

    Aggregate

    COUNT, AVG, MIN, MAX, and SUM with grouping — chart-ready analytics straight from conversation.

    sn_aggregate

    Schema

    Table field definitions, types, references, and choices, resolved from sys_dictionary including inherited fields.

    sn_schema

    Health

    Instance version, cluster nodes, stuck jobs, and key stats in a single call.

    sn_health

    CMDB & Operations

    5 tools

    The parts of the platform that ITSM-only integrations never reach.

    Relationships

    CMDB CI graph traversal — upstream, downstream, or both, with configurable depth.

    sn_relationships

    Attachments

    List attachments, download as inline base64, and upload inline base64 content. Never touches a host filesystem path.

    sn_attach

    System Logs

    Query system logs with severity, source, and time filters.

    sn_syslog

    Code Search

    Search business rules, script includes, client scripts, and the rest of the scripted surface.

    sn_codesearch

    Discover

    Discover tables, scoped apps, store apps, and plugins on the instance.

    sn_discover

    Testing & Automation

    2 tools

    Shipped, and deliberately conservative: execution paths fail closed until they can emit a complete typed access plan.

    ATF

    List ATF tests and suites and read their results. run and run-suite currently fail closed.

    sn_atf

    Natural Language

    Natural-language composition. Currently fails closed until it emits a complete typed access plan.

    sn_nl

    Profiles

    1 tool

    Inspect a connection without ever exposing its credential.

    Profile

    Inspect non-secret metadata for one explicitly named profile. Profile configuration stays operator-managed, out of band.

    sn_profile

    sn_script shipped in 1.0 as an unimplemented stub and is not published in 2.0 — it does not appear in tools/list.

    ServiceNow MCP FAQs

    Quick answers for teams evaluating MCP as their ServiceNow AI integration layer, and for anyone moving from 1.0 to 2.0.

    Quick Start

    One install and one wizard. Requires Node.js 20 or newer.

    1

    Install and run setup

    servicenow-mcp-setup walks through one connection end to end: instance, credential, live verification against that instance, table grants, profile write, and client registration. Nothing is written to the profile until ServiceNow accepts the credential.

    npm install -g @onlyflows/servicenow-mcp
    servicenow-mcp-setup
    or without a global install
    npx @onlyflows/servicenow-mcp@latest setup
    2

    Grant the tables you actually need

    Table access is deny-by-default. The wizard asks for grants inline; add or widen them later with:

    servicenow-mcp-setup grant --profile dev --read incident,problem --write incident
    3

    Register your MCP client

    Setup registers Claude Code and Codex automatically when their CLI is on PATH:

    claude mcp add servicenow-mcp -- servicenow-mcp

    For file-configured clients such as Claude Desktop, Cursor, VS Code, or Windsurf, the entry is just a command to spawn — no credentials in the file:

    {
  "mcpServers": {
    "servicenow-mcp": {
      "command": "servicenow-mcp",
      "args": []
    }
  }
}
    4

    Start talking to ServiceNow

    Restart your client and name the instance in the ask — “on dev, show me today's P1 incidents.” The client passes that profile on every tool call. If anything looks off, the doctor prints a specific remedy per failure:

    servicenow-mcp-setup doctor --profile dev

    Works With Your Favorite AI Tools

    MCP is a universal protocol. Every supported client speaks stdio natively, so each one is configured the same way: a command to spawn.

    Claude Code

    Registered automatically by setup when its CLI is on PATH

    Codex

    Registered automatically by setup when its CLI is on PATH

    Claude Desktop

    Anthropic's desktop app with native MCP support

    Cursor

    AI-powered code editor, configured by ~/.cursor/mcp.json

    VS Code

    Via .vscode/mcp.json with "type": "stdio"

    Windsurf

    Configured by ~/.codeium/windsurf/mcp_config.json

    Natural Language. Real Results.

    No encoded queries. No API docs. Just describe what you need — and which instance you mean.

    “On prod, show me all P1 incidents assigned to the Network team”

    Calls sn_query with profile: "prod" and structured filters — the profile must already grant reads on incident.

    “On dev, add a work note to INC0010001 explaining the rollback”

    Calls sn_incident_add_work_note with profile: "dev" — append-only, so nothing already on the journal can be overwritten.

    “On prod, how many incidents are grouped by priority?”

    Runs sn_aggregate with a COUNT and a groupBy — chart-ready data without exporting a single row.

    “On prod, show upstream dependencies for email-server-01”

    Walks the CMDB relationship graph with sn_relationships at a configurable depth.

    “On dev, find business rules that reference GlideRecord('incident')”

    Searches the scripted surface with sn_codesearch across business rules, script includes, and client scripts.

    Built for Enterprise ServiceNow

    An access boundary you can point at

    Per-profile read and write allowlists, sensitive field names refused for read, write, schema, and filtering, and ServiceNow's own per-user ACLs still deciding the rest.

    Dev, test, prod — side by side

    Named profiles per instance, each with its own credential and grants. Read-only on prod while dev stays writable, selected explicitly on every call.

    Any table you grant

    Not limited to ITSM. CMDB, ITOM, HR, CSM, and custom apps are all reachable — once a profile grants them, and never before.

    OAuth-first authentication

    OAuth 2.0 client_credentials and password grants, API keys, or basic. Tokens are cached, refreshed automatically, and never logged.

    Destructive work is deliberate

    Deletes require confirm: true, bulk operations run dry-run first, and unclassified composition simply does not run.

    Diagnosable installs

    doctor checks Node version, PATH resolution, file modes, profile completeness, credential resolution, and table access — and prints the fix.

    Open Source & Community Driven

    Free and open source under the MIT License. Built with the official MCP TypeScript SDK.

    Report Issues

    Found a bug or need a feature? Open an issue on GitHub.

    Pull Requests

    PRs welcome! Fork, branch from main, and submit.

    Community

    Share use cases and help shape the future of ServiceNow + AI.

    Star on GitHubView on npm

    Built by a ServiceNow CTA

    Created by OnlyFlows — backed by a Certified Technical Architect with deep platform expertise. We build the tools that ServiceNow teams actually need.

    Read the Blog Post

    Connect Your AI to ServiceNow

    One install. Any MCP client. 19 tools, scoped to what you grant.

    GitHub Repo

    Need custom MCP servers or ServiceNow AI strategy? Contact OnlyFlows →