ServiceNow MCP Server — per-user delegated access via OAuth 2.0
概览
Secure, enterprise-ready MCP server for ServiceNow where every action runs as the authenticated user. No shared service accounts. No ACL bypass. Full audit-trail fidelity. Instead of funneling every request through a shared service account, this server executes actions as the actual human user. Because it uses , ServiceNow still enforces: - each user's ACLs and roles, - their approval authority, - and native user-level audit logging. Result: safer automation, cleaner compliance, fewer permission hacks.
README
以下为原文 README 节选，完整内容请查看原文。
ServiceNow MCP Server
Secure, enterprise-ready MCP server for ServiceNow where every action runs as the authenticated user.
No shared service accounts. No ACL bypass. Full audit-trail fidelity.
⚡ Why This Exists
Instead of funneling every request through a shared service account, this server executes actions as the actual human user.
Because it uses per-user OAuth tokens, ServiceNow still enforces:
- each user’s ACLs and roles,
- their approval authority,
- and native user-level audit logging.
Result: safer automation, cleaner compliance, fewer permission hacks.
🔥 Core Capabilities
- MCP-spec OAuth 2.0 with PKCE — clients like Claude Code auto-discover and re-auth natively
- Per-user OAuth delegation to ServiceNow (Authorization Code flow + refresh)
- AES-256-GCM encrypted token storage in Redis
- Streamable HTTP MCP transport with per-session lifecycle
- Bearer token auth on every MCP request (
Authorization: Bearer) - Tool-level identity protections for sensitive operations
- Per-user rate limiting via Redis token bucket
- Input validation + normalized error responses
- Per-tool/per-user usage metrics in Redis with an optional token-gated
/metrics/usageendpoint - CI-enforced build + test + coverage gate
🚀 Quick Start
npm install
cp .env.example .env
npm run generate-key # paste into TOKEN_ENCRYPTION_KEY
npm run dev
Health check: curl -s http://localhost:8080/health
For full setup instructions including ServiceNow OAuth configuration, see the Getting Started guide.
📚 Documentation
Comprehensive documentation lives in docs/:
- Getting Started — Prerequisites, local dev, OAuth setup, first tool call
- Architecture — System design, session lifecycle, request flow, Redis schema
- Authentication — OAuth flow, token storage, refresh
- Security — Identity enforcement, input validation, rate limiting, error handling
- Tools (74) — All tools: incidents, change requests, knowledge, update sets, scheduled jobs, flow logs, CMDB, platform metadata, form rules, access control, on-call, and more
- Resources (5) — MCP resources for direct record access
- Prompts (7) — Guided workflows for incidents, change requests, knowledge, and catalog
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"servicenow": {
"type": "streamablehttp",
"url": "https://your-host:8080/mcp"
}
}
}