ServiceNow

Give an agent access to ServiceNow with OAuth, and which of its tools write data as soon as they are called.

Required permissions

Tool	Required Permission	Description
search_records	read	Search for records in ServiceNow using a query.
get_record	read	Get a specific record by sys_id.
natural_language_search	read	Search for records using natural language.
create_incident	write	Create a new incident in ServiceNow.
update_incident	write	Update an existing incident in ServiceNow.
comment_incident	write	Add a comment to an incident (customer visible).
add_incident_notes	write	Add work notes to an incident (internal).
create_case	write	Create a new case in ServiceNow.
update_case	write	Update an existing case in ServiceNow.
comment_case	write	Add a comment to a case (customer visible).
add_case_notes	write	Add work notes to a case (internal).

The create_*, comment_* and add_*_notes tools change data in ServiceNow as soon as the agent calls them — they are not held back for approval. Only enable the tools you actually want the agent to use, and restrict the ServiceNow account's write access accordingly.

Create OAuth application and credentials

Using the ServiceNow MCP server requires OAuth 2.0 application credentials (Client ID and Client Secret).

Option 1: Create OAuth Application via ServiceNow UI

1

Log in to your ServiceNow instance as an administrator

2

Navigate to System OAuth → Application Registry (or search for "Application Registry" in the filter navigator)

3

Click New to create a new OAuth application

4

Fill in the application details:

• Name: Enter a name (e.g., "ilert-mcp-agent")
• Client ID: This will be auto-generated (or you can specify a custom one)
• Client Secret: Click Generate to create a client secret
• Redirect URL: Leave blank or enter a placeholder (not required for API access)
• Active: Check this box

5

Configure OAuth Configuration:

• Grant Types: Select Client Credentials (for server-to-server authentication)
• Access Token Lifespan: Set appropriate value (e.g., 3600 seconds)

6

Configure Scopes (API access):

• Click Add in the Scopes section
• Add the following scopes:

  • user_impersonation - Required for API access
  • Or create custom scopes with read permissions for specific tables:

    • incident.read
    • change_request.read
    • problem.read

7

Click Submit to save the application

8

Copy the Client ID and Client Secret immediately

9

Store these credentials securely. You will need both when setting up the ServiceNow MCP server in ilert.

Option 2: Create OAuth Application via ServiceNow API

Alternatively, you can create an OAuth application using the ServiceNow REST API:

curl -X POST "https://your-instance.service-now.com/api/now/table/oauth_entity" \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic YOUR_BASE64_CREDENTIALS" \
  -d '{
    "name": "ilert-mcp-agent",
    "grant_type": "client_credentials",
    "active": true,
    "access_token_lifespan": 3600
  }'

After creation, retrieve the Client ID and Client Secret from the response or via the UI.

Create user and assign role

The OAuth application needs to be associated with a user that has appropriate permissions:

1

Navigate to User Administration → Users (or search for "Users" in the filter navigator)

2

Create a new user or select an existing user:

• User ID: Enter a unique user ID (e.g., "ilert.agent")
• First Name: Enter first name
• Last Name: Enter last name
• Email: Enter email address
• Password: Set a secure password

3

Assign appropriate roles to the user:

• itil - ITIL role for incident and change management access
• sn_incident.read - Read access to incidents
• sn_change_request.read - Read access to change requests
• sn_problem.read - Read access to problems
• Or create a custom role with specific table read permissions

4

Link the OAuth application to the user:

• Go back to System OAuth → Application Registry
• Open your OAuth application
• In the User field, select the user you created/selected
• Click Update

Alternative: Use Basic Authentication (Not Recommended)

If OAuth is not available, you can use basic authentication:

1. Create a user in ServiceNow with appropriate roles (as described above)
2. Use the username and password when configuring the ServiceNow MCP server
3. Note: Basic authentication is less secure and not recommended for production use

Verify OAuth credentials

Before configuring the MCP server, verify that your OAuth credentials work:

# Test OAuth token generation
curl -X POST "https://your-instance.service-now.com/oauth_token.do" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET"

# Test API access with the access token
curl -X GET "https://your-instance.service-now.com/api/now/table/incident?sysparm_limit=1" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Accept: application/json"

Replace:

• YOUR_CLIENT_ID with your OAuth Client ID
• YOUR_CLIENT_SECRET with your OAuth Client Secret
• YOUR_ACCESS_TOKEN with the access token from the first request
• your-instance with your ServiceNow instance name

Security Recommendations:

• Use OAuth 2.0 Client Credentials flow for server-to-server authentication
• Regularly rotate Client Secrets
• Use the principle of least privilege - only grant access to tables and fields that are necessary
• Monitor OAuth application usage in ServiceNow audit logs
• Consider using IP restrictions if your ServiceNow instance supports it

Note:

• You'll need your ServiceNow instance URL (e.g., https://your-instance.service-now.com) when configuring the MCP server
• The instance URL format may vary for different ServiceNow deployments (e.g., custom domains)
• Ensure the user associated with the OAuth application has the necessary roles and permissions

Connect ServiceNow with agent

To connect ServiceNow with your AI SRE agent:

1

Navigate to Agents in the ilert navigation menu

2

Open the agent detail view for the agent you want to configure

3

Go to the Tools tab

4

Under the ilert hosted MCP servers section, locate the ServiceNow card

5

Click Connect on the ServiceNow card

6

In the connection dialog that appears:

• Select connector: Choose "Create new connector" (or select an existing connector if you have one)
• Type: Select OAuth 2.0 or Basic Auth from the dropdown (depending on your ServiceNow authentication method)
• Secret name: Enter a name for your connector (e.g., "ServiceNow Production" or "ServiceNow Main")
• Secret value: For OAuth 2.0, enter your Client ID and Client Secret (format: client_id:client_secret). For Basic Auth, enter username:password
• Host URL: Enter your ServiceNow instance URL (e.g., https://your-instance.service-now.com)

7

Click Connect to complete the connection

8

After connecting, you can enable or disable specific tools needed for alert investigation, such as:

• search_records - Search for records in ServiceNow using a query
• get_record - Get a specific record by sys_id
• natural_language_search - Search for records using natural language
• create_incident - Create a new incident in ServiceNow
• update_incident - Update an existing incident in ServiceNow
• comment_incident - Add a comment to an incident (customer visible)
• add_incident_notes - Add work notes to an incident (internal)
• create_case - Create a new case in ServiceNow
• update_case - Update an existing case in ServiceNow
• comment_case - Add a comment to a case (customer visible)
• add_case_notes - Add work notes to a case (internal)

The ServiceNow integration is now connected and ready to use for root cause analysis.