servicenow-api
Verified Safeby Knuckles-Team
Overview
The ServiceNow MCP Server acts as a Model Context Protocol (MCP) endpoint, wrapping ServiceNow APIs as tools for consumption by LLMs and multi-agent systems, enabling automated interaction with ServiceNow for tasks like incident management, change management, and CMDB queries.
Installation
docker run -d --name servicenow-mcp -p 8004:8004 -e HOST=0.0.0.0 -e PORT=8004 -e TRANSPORT=http -e AUTH_TYPE=none -e EUNOMIA_TYPE=none -e SERVICENOW_INSTANCE=https://yourinstance.servicenow.com -e SERVICENOW_USERNAME=user -e SERVICENOW_PASSWORD=pass -e SERVICENOW_CLIENT_ID=client_id -e SERVICENOW_CLIENT_SECRET=client_secret -e SERVICENOW_VERIFY=False knucklessg1/servicenow:latestEnvironment Variables
- SERVICENOW_INSTANCE
- SERVICENOW_USERNAME
- SERVICENOW_PASSWORD
- SERVICENOW_CLIENT_ID
- SERVICENOW_CLIENT_SECRET
- SERVICENOW_VERIFY
- HOST
- PORT
- TRANSPORT
- AUTH_TYPE
- OIDC_CONFIG_URL
- OIDC_CLIENT_ID
- OIDC_CLIENT_SECRET
- OIDC_BASE_URL
- ENABLE_DELEGATION
- SERVICENOW_AUDIENCE
- DELEGATED_SCOPES
- EUNOMIA_TYPE
- EUNOMIA_POLICY_FILE
- FASTMCP_SERVER_AUTH_JWT_ALGORITHM
- FASTMCP_SERVER_AUTH_JWT_PUBLIC_KEY
- FASTMCP_SERVER_AUTH_JWT_REQUIRED_SCOPES
- OPENAPI_FILE
- OPENAPI_BASE_URL
Security Notes
The server supports robust authentication mechanisms like JWT, OAuth, and OIDC proxies, and integrates with Eunomia for policy-based access control, which are strong positives. However, it allows explicit disabling of SSL verification (`SERVICENOW_VERIFY=False`), which is a critical security risk (Man-in-the-Middle attacks). The `api_request` tool allows arbitrary HTTP requests to any ServiceNow endpoint, which could be exploited if Eunomia authorization is disabled or misconfigured. Sensitive credentials must be securely managed via environment variables and never hardcoded.
Similar Servers
mcpo
Exposes Model Context Protocol (MCP) tools as OpenAPI-compatible HTTP servers.
mcp-context-forge
Converts web content (HTML, PDF, DOCX, etc.) and local files from a URL into high-quality Markdown format. It supports multiple conversion engines, content optimization, batch processing, and image handling.
mcpstore
Orchestrate Microservice Context Protocol (MCP) services and adapt them for integration with various AI frameworks like LangChain, managing tools and their lifecycle.
agentor
Build and deploy scalable AI agents that can interact with various tools and communicate via A2A and MCP protocols.