ServiceNow MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SERVICENOW_PASSWORD | No | Password for basic auth | |
| SERVICENOW_USERNAME | No | Username for basic auth | |
| SERVICENOW_AUTH_TYPE | Yes | Authentication type: 'basic' or 'oauth' | |
| SERVICENOW_CLIENT_ID | No | OAuth client ID (required if auth type is 'oauth') | |
| SERVICENOW_INSTANCE_URL | Yes | ServiceNow instance URL (e.g., https://your-instance.service-now.com) | |
| SERVICENOW_CLIENT_SECRET | No | OAuth client secret (required if auth type is 'oauth') |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": true
} |
| resources | {
"subscribe": false,
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_recordsB | List records from any ServiceNow table with optional filtering, field selection, and pagination |
| get_recordA | Get a single record from a ServiceNow table by sys_id. If this is refused (401) while list_records works, call list_records with query="sys_id=<sys_id>" and limit=1 instead. |
| create_recordB | Create a new record in any ServiceNow table |
| update_recordC | Update an existing record in a ServiceNow table |
| delete_recordB | Delete a record from a ServiceNow table by sys_id |
| aggregate_recordsA | Aggregate records using COUNT, AVG, MIN, MAX, SUM with optional GROUP BY via the Stats API. If the Stats API is refused (401) while list_records works, count with list_records instead: the same query, fields="sys_id", limit=1000, paging with offset. |
| list_ciB | List CMDB configuration items with optional class and query filtering |
| get_ciB | Get a single CMDB configuration item by sys_id |
| create_ciA | Create a new CMDB configuration item |
| update_ciC | Update a CMDB configuration item |
| get_ci_relationshipsB | Get relationships for a CMDB configuration item (parent and child) |
| get_system_propertiesC | Query ServiceNow system properties |
| get_current_userA | Get the authenticated user's identity and directly assigned, active roles |
| get_table_schemaA | Get the data dictionary (field definitions) for a ServiceNow table, including inherited fields |
| find_referencesA | Where-used for a table or one of its fields: the business rules, client scripts, UI policies, ACLs, script includes and reference fields that touch it. Returns names, sys_ids and flags only, never script, condition or ACL bodies. Script matches (script includes; business rules and client scripts in field mode) are text matches, so expect false positives. Only this exact table is matched: run it again for a parent table (get_table_schema's hierarchy) to find rules and ACLs defined there. A source this identity can't read (403, or a 401 from an access policy that leaves its table out) is listed in not_assessable (under OAuth each such source costs one token refresh). Under basic auth the first 401 is an error (a refused password looks the same), and so is a refused OAuth secret; rows hidden by an ACL are simply missing. complete=false means the source hit the limit. |
| list_update_setsB | List update sets with optional state and query filtering |
| get_update_setA | Get details of a specific update set by sys_id |
| create_update_setA | Create a new update set for tracking customizations |
| set_current_update_setA | Set an update set as the current active update set |
| list_update_set_changesC | List all customer updates (changes) within an update set |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| instance_info | Instance URL, build and release family, default time zone, and the logged-in user with roles and time zone; unavailable names each value this identity can't read, and why |
| current_update_set | Currently active update set name, sys_id, and state |
| cmdb_classes | CMDB CI class hierarchy — class names, labels, and parent classes |
| query_syntax_help | ServiceNow encoded query operators reference — prevents hallucinated query syntax |
| reviewing-update-sets/SKILL.md | Reviewing, analyzing, and comparing ServiceNow update sets before promotion, singly or in batches. Shows changes, risks, dependencies, and conflicts. Use when the user mentions update sets, customizations, promotion, code review, change tracking, pre-deployment review, sys_update_xml, customer updates, 'what changed in this update set', or 'is this safe to promote'. |
| reviewing-update-sets/_manifest | File listing for reviewing-update-sets |
| reviewing-update-sets/references/update-set-fields.md | File from reviewing-update-sets skill |
| analyzing-access/SKILL.md | Reviewing who holds which ServiceNow roles and explaining access denials. Lists admin and security_admin holders, roles granted directly instead of through groups, roles left on inactive or long-absent users, and diagnoses 401/403 errors, empty results and missing fields. Joins users, groups and roles through dot-walks: team rosters, role holders with their groups, how many people hold a role. Use when the user asks who has admin, a role or access review, least privilege, user or group hygiene, who is in a group, why a query returned nothing, why a field is missing, 'why did I get a 403', 'why can't user X see Y', or ACLs. |
| analyzing-access/_manifest | File listing for analyzing-access |
| analyzing-access/references/access-errors.md | File from analyzing-access skill |
| analyzing-access/references/acl-evaluation.md | File from analyzing-access skill |
| servicenow-cmdb/SKILL.md | Auditing the CMDB as a data model: CI class hierarchy, raw relationships, CMDB health scorecards, data quality (duplicates, orphans, staleness, missing fields) and CSDM 5 conformance. Use when the user mentions CMDB health, CMDB audit, data quality, duplicates, orphaned or stale CIs, CI classes, relationships in cmdb_rel_ci, CSDM, service taxonomy, Data Foundations, compliance scores, or 'how clean is our CMDB'. |
| servicenow-cmdb/_manifest | File listing for servicenow-cmdb |
| servicenow-cmdb/references/cmdb-tables.md | File from servicenow-cmdb skill |
| servicenow-cmdb/references/csdm5.md | File from servicenow-cmdb skill |
| exploring-tables/SKILL.md | Exploring any ServiceNow table: schema, field types, sample records, relationships, data patterns, a record's history (work notes, comments, field changes), and what touches a table or field (business rules, client scripts, UI policies, ACLs, script includes). Use when the user mentions tables, schemas, fields, data dictionary, sys_dictionary, sys_db_object, table structure, 'what fields does X have', a record's work notes, comments, journal or audit trail, where a table or field is used, what would break if it changed, or wants to understand a ServiceNow table they haven't worked with before. |
| exploring-tables/_manifest | File listing for exploring-tables |
| exploring-tables/references/history-and-references.md | File from exploring-tables skill |
| exploring-tables/references/query-syntax.md | File from exploring-tables skill |
TDQS
Scored across 20 tools
The generic record tools overlap substantially with the CI-specific tools: create_record/create_ci, update_record/update_ci, list_records/list_ci, and get_record/get_ci all target the CMDB table in different ways. Descriptions clarify the CMDB intent, but an agent must still decide whether to use the generic or specialized tool for the same underlying table.
All tool names use consistent snake_case and a verb_noun pattern such as create_record, list_records, get_update_set, and delete_record. The few compound names like set_current_update_set and get_ci_relationships remain predictable and readable.
Twenty tools is at the high end for a single MCP server and feels heavy, though the broad ServiceNow surface area (records, CMDB, update sets, metadata) explains much of the count. It is reasonable but not tightly scoped.
Core record CRUD is complete, and CMDB plus update-set workflows are mostly covered with schema, references, aggregation, and current-user tools. Minor gaps exist, such as no dedicated delete_ci or broader update-set lifecycle operations, but generic record tools can cover some of these.