73
/ 100
14 days ago
glama

mfa-servicenow-mcp

An MCP server for ServiceNow that supports multi-factor authentication via real browser (Playwright) and provides tools for reading, writing, and managing ServiceNow artifacts with safety guards.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 4 credentials: SERVICENOW_PASSWORD, SERVICENOW_CLIENT_SECRET, SERVICENOW_API_KEY, SERVICENOW_BROWSER_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configMCP_TOOL_PACKAGEAdd the server to your client's config file — pick yours below. Only two env vars are required; defaults to standard, so leave it out unless you need a different package.
configSERVICENOW_BROWSER_DEBUG
configPLAYWRIGHT_BROWSERS_PATH"$HOME/apps/servicenow-mcp/ms-playwright" python -m playwright install chromium
configSERVICENOW_INSTANCE_URL"": "https://your-instance.service-now.com",
configLOG_FILE
configSERVICENOW_DEBUGdebug false Enable debug logging
configSERVICENOW_TIMEOUTtimeout 30 HTTP request timeout (seconds)
configSERVICENOW_MCP_TRANSPORTtransport stdio MCP transport: stdio or http
configSERVICENOW_MCP_HTTP_HOSThttp-host 127.0.0.1 Host for --transport http
configSERVICENOW_MCP_HTTP_PORThttp-port 8000 Port for --transport http
configSERVICENOW_MCP_HTTP_PATHhttp-path /mcp Streamable HTTP endpoint path
configSERVICENOW_MCP_HTTP_ALLOWED_HOSTShttp-allowed-hosts loopback hosts Comma-separated Host allowlist for DNS rebinding protection
configSERVICENOW_AUTH_TYPE"": "browser"
configSERVICENOW_USERNAME"": "your-username",
🔐 secretSERVICENOW_PASSWORD"": "your-password"
configSERVICENOW_CLIENT_ID
🔐 secretSERVICENOW_CLIENT_SECRETclient-secret
configSERVICENOW_TOKEN_URL
🔐 secretSERVICENOW_API_KEYapi-key —
configSERVICENOW_API_KEY_HEADERapi-key-header X-ServiceNow-API-Key
configSERVICENOW_BROWSER_USERNAME
🔐 secretSERVICENOW_BROWSER_PASSWORD
configSERVICENOW_BROWSER_LOGIN_URLbrowser-login-url — Custom login page URL
configSERVICENOW_BROWSER_PROBE_PATH
configSERVICENOW_BROWSER_HEADLESS"": "false",
configSERVICENOW_BROWSER_TIMEOUTbrowser-timeout 120 Login timeout in seconds
configSERVICENOW_BROWSER_USER_DATA_DIRbrowser-user-data-dir — Override the Chromium profile path. Rarely needed — see the sandbox note below before setting it.
configSERVICENOW_BROWSER_SESSION_TTLbrowser-session-ttl 30 Session TTL in minutes
configSCRIPT_EXECUTION_API_RESOURCE_PATHscript-execution-api-resource-path
configTOOL_PACKAGE_CONFIG_PATH
configSERVICENOW_DEP_MAX_DEPTHTransitive dependency depth. Cross-scope deps resolve 2 passes deep by default (conservative). Raise with (clamped to 1–6) to chase longer A→B→C→D chains.
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/jshsakura-mfa-servicenow-mcp-1looa5)](https://m8ven.ai/mcp/jshsakura-mfa-servicenow-mcp-1looa5)
commit: 5a15d9b92820bb5021396fb72ca233005044fe0c
code hash: dd84e569cd9269b4c45587dbb25e810ca4de81b3070e33164037ac1e87c265f0
verified: 6/22/2026, 1:09:53 PM
view raw JSON →