ServiceNow MCP Server (schwarztim/servicenow-mcp) is an MCP server listed on the M8ven Trust Index. It scores 66 out of 100, grade C. It declares 116 tools. No publisher has claimed this listing.
Enables interaction with ServiceNow ITSM through browser-based SSO authentication, providing 80+ tools for incidents, changes, catalog, CMDB, and more via natural language.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
schwarztim
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
auth_browserLaunch browser for SSO authentication. Opens a browser window where you can log in with your enterprise SSO credentials. Cookies are captured and saved for subsequent API calls. Use this when you don't have API keys and need to use SSO.
auth_statusCheck current authentication status. Shows which auth method is configured and whether credentials/cookies are valid.
auth_import_cookiesImport authentication cookies from an external source. Use this when you already have an authenticated browser session (e.g., via Firefox DevTools) and want to transfer those credentials to the MCP. Extract cookies and x-usertoken from network request headers.
auth_refreshRefresh the current session by re-authenticating via browser. Uses the previously authenticated instance URL. Useful when session has expired.
my_contextGet current user's identity, groups, and roles. Returns cached user info including sys_id, name, email, department, group memberships, and roles. Use this first to understand who you're working as.
my_work_queueGet ALL actionable items for current user in a single call: assigned tasks, pending approvals, and unassigned group queue items. This is the recommended first tool to use when user asks 'what do I need to work on?' or 'what are my open tasks?'
incidents_listList incidents with optional filtering. Returns incident number, short description, state, priority, assigned_to.
incidents_getGet a single incident by sys_id or number
incidents_createCreate a new incident
incidents_updateUpdate an existing incident
incidents_add_commentAdd a work note or comment to an incident
incidents_resolveResolve an incident
changes_listList change requests with optional filtering
changes_getGet a single change request by sys_id or number
changes_createCreate a new change request
changes_tasksGet tasks associated with a change request
catalog_itemsList available service catalog items
catalog_getGet details of a catalog item including variables/questions
catalog_orderOrder/submit a catalog item request
requests_listList service requests (sc_request) for current user or with filter
requests_itemsList requested items (sc_req_item) with status
cmdb_searchSearch CMDB configuration items
cmdb_getGet configuration item details
cmdb_relationshipsGet relationships for a configuration item
problems_listList problem records
problems_getGet a problem record
problems_createCreate a problem record
knowledge_searchSearch knowledge base articles
knowledge_getGet a knowledge article
users_searchSearch for users
users_getGet user details
groups_listList groups
groups_membersGet members of a group
tasks_my_tasksGet tasks assigned to current user
tasks_updateUpdate a task
approvals_pendingGet pending approvals for current user with ENRICHED details from parent records. Returns number, short_description, opened_by, urgency, and stage - not just approval metadata. Supports keyword filtering.
approvals_approveApprove an approval request
approvals_rejectReject an approval request
attachment_listList attachments for a record
attachment_getGet attachment metadata by sys_id
attachment_downloadGet attachment content (returns base64 encoded for binary files)
attachment_uploadUpload an attachment to a record
attachment_deleteDelete an attachment
catalog_categoriesList service catalog categories
catalog_item_variablesGet variables/questions for a catalog item (required fields for ordering)
catalog_add_to_cartAdd a catalog item to the shopping cart
catalog_get_cartGet current shopping cart contents
catalog_submit_cartSubmit/checkout the shopping cart to create requests
catalog_order_nowOrder a catalog item immediately (skip cart, single-step order)
itsp_parse_urlParse an IT Service Portal (ITSP) URL to extract catalog item information. Extracts sys_id, table name, and instance URL from portal links like 'https://instance.service-now.com/itsp?id=sc_cat_item&sys_id=xxx'
itsp_get_item_detailsGet full catalog item details from an ITSP URL. Automatically parses the URL and fetches item name, description, variables/questions, and all metadata needed for ordering.
itsp_submit_requestSubmit a service request directly from an ITSP URL. Streamlined workflow: parses URL, validates variables, and submits the request in one step.
requests_get_detailsGet detailed information about a service request or requested item including status, variables, approval status, and activity history. Accepts REQ numbers (requests) or RITM numbers (requested items).
requests_get_my_recentGet recent service requests for current user with full details. Returns last 10 requests with status, items, and approval information.
record_producer_submitSubmit a Record Producer request. Record Producers create records directly (like incidents) without using the cart. Use this for incident creation, problem reporting, and other single-record submissions from the service catalog.
record_producer_get_detailsGet details about a Record Producer including its variables and target table. Helps understand what fields are needed before submission.
order_guide_submitSubmit an Order Guide request. Order Guides bundle multiple catalog items into a single request, creating multiple requested items (RITMs). Use this for requesting multiple related items at once.
order_guide_get_detailsGet details about an Order Guide including available items, categories, and variables. Helps understand what items can be included before submission.
catalog_detect_item_typeAutomatically detect the type of catalog item (Standard, Record Producer, Order Guide, or Content). Returns the item type and appropriate submission method to use.
import_set_loadLoad data into an import set staging table
import_set_load_multipleLoad multiple records into an import set staging table
import_set_statusGet status of an import set
batch_requestExecute multiple API requests in a single call
cmdb_classesList CMDB CI classes/types
cmdb_instance_listList CMDB instances by class (uses CMDB Instance API /now/cmdb/instance)
cmdb_createCreate a new CMDB configuration item
cmdb_updateUpdate a CMDB configuration item
cmdb_relationship_createCreate a relationship between two CIs
sla_listList SLA definitions
task_sla_listList task SLAs (SLA records attached to tasks)
task_sla_getGet task SLA details
workflow_listList workflow definitions
workflow_context_listList workflow contexts (running workflow instances)
workflow_context_getGet workflow context details
email_listList emails (sys_email table)
email_getGet email details
notification_listList email notification rules
event_listList system events (sysevent)
event_createCreate/fire a system event
journal_listList journal entries (work notes, comments) for a record
activity_streamGet activity stream for a record (all changes, comments)
audit_listList audit history for a record
scheduled_job_listList scheduled jobs
scheduled_job_runExecute a scheduled job immediately
metric_listList defined metrics
metric_dataGet metric data/values
update_set_listList update sets
update_set_getGet update set details with customer updates
asset_listList assets (alm_asset)
asset_getGet asset details
asset_createCreate an asset
asset_updateUpdate an asset
license_listList software licenses (alm_license)
license_getGet software license details
license_entitlementsList license entitlements/allocations
software_listList software installations
software_product_listList software products (software catalog)
contract_listList contracts
contract_getGet contract details
location_listList locations
16 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate
Zod denial of service vulnerability
HERMES_CLIENT_TOKENexport ="<client token>"HERMES_SCHEMEexport ="session"HERMES_SERVICEexport ="servicenow"HERMES_URLexport ="http://127.0.0.1:9876"MS365_PASSWORDMS365_USERNAMESERVICENOW_COOKIE_FILESERVICENOW_INSTANCE_URLexport ="https://yourinstance.service-now.com"SERVICENOW_LEGACY_AUTHexport ="true"SERVICENOW_PASSWORDexport ="your-password"SERVICENOW_SESSION_TOKENexport ="your-session-cookie"SERVICENOW_USERNAMEexport ="your-username"SERVICENOW_USER_TOKENexport ="your-g_ck-token"TOTP_SECRETDependencies
12 dependencies, 1 flagged: playwright
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
116/116 tools missing one or more hints — auth_browser (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); auth_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); auth_import_cookies (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +113 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
No arbitrary install scripts
Has postinstall/preinstall script — runs arbitrary code on npm install
Remove postinstall/preinstall hooks unless they’re essential.
Production dependencies are patched
0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), playwright@1.50.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
1/8 production deps stale: prompts@2023-10-21 (2.8y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/schwarztim/servicenow-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check