Open iT / ServiceNow MCP Pilot

This repository contains a deliberately small remote MCP server scaffold for an Open iT / ServiceNow SAM Pro pilot. It exposes one read-only tool over Streamable HTTP and uses deterministic mock inventory data; it does not call Open iT or ServiceNow APIs.

What it exposes

• MCP endpoint: http://127.0.0.1:8000/mcp

• Public health endpoint: http://127.0.0.1:8000/health

• Tool: find_products_without_entitlements

The MCP endpoint is stateless and returns JSON responses, which keeps it suitable for horizontally scaled or serverless hosting later. api/index.py exposes the same ASGI application as a future Vercel entry point; no Vercel deployment configuration or deployment is included.

Related MCP server: SentinelScan Cloud MCP Server

Run locally

Python 3.11 or newer is required.

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e ".[dev]"
$env:OPENIT_MCP_API_KEY = "local-dev-key"
openit-mcp

For bash/zsh, activate with source .venv/bin/activate and configure the key with:

export OPENIT_MCP_API_KEY="local-dev-key"

The server intentionally returns 503 from /mcp when OPENIT_MCP_API_KEY is unset. Clients should send the key as a bearer token:

Authorization: Bearer local-dev-key

X-API-Key: local-dev-key is also accepted as a convenience for pilot clients. The health endpoint does not require authentication.

Check health:

Invoke-RestMethod http://127.0.0.1:8000/health

In a second terminal with the same virtual environment and API key, run the included MCP client example:

python examples/invoke.py

You can also connect an MCP Inspector or other Streamable HTTP client to http://127.0.0.1:8000/mcp and configure the Authorization header shown above.

Tool contract

find_products_without_entitlements accepts:

It returns structured JSON in this shape:

{
  "count": 1,
  "items": [
    {
      "product_id": "PRD-1001",
      "product_name": "Acrobat Pro",
      "publisher": "Adobe",
      "version": "2024",
      "discovered_installations": 34
    }
  ],
  "explanation": "Found 1 product(s) for publisher 'Adobe' in the mock discovery inventory with no matching entitlement record; returning 1 item(s).",
  "generated_at": "2026-08-05T03:30:00+00:00"
}

Results are sorted by publisher, product name, and version before limit is applied.

Tests

pytest

The tests verify the published tool list, structured output, publisher filtering, deterministic limiting, public health endpoint, and fail-closed API key behavior.

Future hosted configuration

The MCP SDK restricts HTTP hosts to localhost by default. Before hosting, set OPENIT_MCP_ALLOWED_HOSTS to a comma-separated allowlist, for example:

OPENIT_MCP_ALLOWED_HOSTS=openit-mcp.example.com,openit-mcp.example.com:*

Restart the process after changing the host allowlist. Keep the API key in the hosting platform's secret/environment configuration and use HTTPS.

Before ServiceNow integration

This pilot still needs a real Open iT data adapter, agreement on the product/entitlement matching rules and response fields, ServiceNow remote MCP connection configuration, production authentication (preferably OAuth 2.1 rather than a shared key), HTTPS hosting, logging/monitoring, secret rotation, and end-to-end validation from AI Agent Studio.