AI Gateway FAQ

[Ashley Snyder]

AI Gateway is ServiceNow's runtime enforcement layer for MCP (Model Context Protocol) connections in AI Control Tower. It governs which MCP servers agents can reach, secures every connection with centralized authentication, and gives AI Stewards complete visibility into every tool call across the enterprise.

This FAQ covers getting started, key concepts, security and compliance, and using AI Gateway day-to-day.

JUMP TO Getting Started Key Concepts What AI Gateway Does Using AI Gateway Security and Compliance

Getting Started

What is AI Gateway?

As organizations scale AI agent deployments across multiple platforms, the connections between those agents and external tools multiply quickly, and so does the risk. Without a central control point, it becomes difficult to know which agents are accessing what, whether those connections are properly authenticated, and what's happening across all of them in real time.

AI Gateway addresses this through three capabilities that work together:

• Govern, A centralized inventory of every MCP server and tool, with AI Steward approval workflows and full lifecycle management. Only approved servers and tools reach agents, enforced directly in AI Agent Studio.
• Control: OAuth 2.1 authentication enforced on every connection. Runtime policy enforcement, sensitive data detection and blocking, and instant Pause controls on any server or tool.
• Observe, Every MCP transaction logged in full, with usage, latency, and success rates at the server, tool, and client level. Tamper-evident audit logs shipped automatically to enterprise storage.

Why do I need AI Gateway?

As organizations scale AI agent deployments across multiple platforms, the connections between those agents and external tools multiply quickly, and so does the risk. Without a central control point, it becomes difficult to know which agents are accessing what, whether those connections are properly authenticated, and what happened when something goes wrong.

AI Gateway addresses three specific challenges:

• Visibility, A single inventory showing which agents access which tools across your entire organization, so you're never in the dark about what's connected to what.
• Security, Centralized policy enforcement and authentication management, so your security team doesn't have to chase configurations across a dozen platforms.
• Compliance, Complete audit trails for every agent interaction, so you can respond quickly to incidents and meet regulatory requirements without manual log-digging.

Is AI Gateway available now, or is this a future product?

AI Gateway is generally available today, delivering MCP server governance, authentication, content guardrails, and operational visibility as a unified product within AI Control Tower.

To use AI Gateway, you need an AI Control Tower entitlement. The product documentation at servicenow.com/docs covers installation prerequisites and setup end to end, and your ServiceNow account team can help you map out an implementation path specific to your environment.

How much does AI Gateway cost?

For specific pricing details and how usage-based costs apply to your subscription, reach out to your ServiceNow account team.

How do I get access to AI Gateway?

AI Gateway is included with AI Control Tower, there's no separate purchase or activation required. If your organization has AI Control Tower entitlements, AI Gateway is automatically available on your instance.

To use AI Gateway, you need an AI Control Tower entitlement. Contact your ServiceNow account team to confirm the specific version and SKU requirements for your environment.

Does AI Gateway work if I'm not using ServiceNow AI Agents?

Yes, and this is an important point. AI Gateway is platform-agnostic by design. It governs connections from any agent platform, not just agents built in ServiceNow AI Agent Studio.

If your organization is running agents on Microsoft Copilot Studio, AWS Bedrock, Google Vertex AI, or a custom-built agent platform, those agents can connect to MCP Servers through AI Gateway using the standard Gateway URL and OAuth 2.1 authentication. From a governance perspective, the platform the agent was built on doesn't matter, what matters is that the connection flows through AI Gateway, where it can be approved, authenticated, monitored, and controlled.

Platforms that support CIMD (Client Identity Metadata Document) can auto-configure through a single registration in AI Control Tower, covering all approved MCP Servers on that host without repeated per-server setup. For platforms that don't yet support CIMD, guided OAuth 2.1 setup is available for manual configuration.

This is especially relevant for organizations with multi-vendor AI strategies, where different teams may be building on different platforms. AI Gateway gives your security and governance teams a single place to oversee all of it.

---

📖 Understanding Key Concepts

📖 Key Terms

• MCP (Model Context Protocol): An open-source industry standard that defines how AI agents connect to external tools and systems, like USB-C for AI.
• MCP Server: A program that exposes capabilities (tools, APIs, data sources) to AI agents in a standardized way.
• AI Steward: A governance, security, or compliance team member who reviews and approves MCP Server requests in AI Control Tower.
• CIMD: Client Identity Metadata Document, allows agent platforms to auto-register with AI Gateway using their HTTPS certificate, eliminating per-server OAuth setup.

What is Model Context Protocol (MCP)?

MCP is an open-source industry standard that defines how AI agents connect to external tools and systems. Think of it like USB-C for AI, instead of every agent platform building its own custom integration for every tool it needs to access, MCP provides a universal connection standard that works across platforms.

In practical terms, MCP standardizes two things: how an agent discovers what tools are available, and how it invokes those tools. A GitHub MCP server, for example, exposes a set of capabilities, search repositories, create issues, read files, and any MCP-compatible agent can discover and call those capabilities without needing a custom integration built specifically for that agent platform.

For enterprises, this matters because it means your AI agents can access a growing ecosystem of external tools and systems without a proliferation of one-off integrations to manage, secure, or audit.

What is an MCP server?

An MCP server is a program that exposes a set of capabilities, tools, APIs, data sources, to AI agents in a standardized way. It tells any MCP-compatible agent what it can do and how to call it.

Examples of what an MCP server might expose: the ability to search a knowledge base, create a ticket, query a database, or retrieve a file from Google Drive. The MCP server handles the connection to the underlying system; the agent just needs to know the server exists and what tools it offers.

In the context of AI Gateway, every external tool your agents connect to is registered as an MCP Server. AI Gateway governs which MCP Servers are approved for use, how clients authenticate to them, and what happens at runtime when an agent makes a call.

What is the relationship between AI Gateway and AI Control Tower?

AI Control Tower is ServiceNow's complete AI governance platform, it's where you manage AI models, agents, policies, risk assessments, and compliance across your enterprise. AI Gateway is a feature set within AI Control Tower that specifically handles cross-platform agent connections using MCP protocols.

A useful way to think about it: AI Control Tower is the broader governance platform for your entire AI program. AI Gateway is the component within it that focuses on the connections your agents make to the outside world.

You don't purchase or install AI Gateway separately. It's included with AI Control Tower Core and Pro Plus, and the plugin (sn_awh_config) installs automatically when you set up AI Control Tower.

How is AI Gateway different from an API Gateway?

API Gateways manage traditional application-to-application calls, they're designed for REST APIs, microservices, and similar request/response patterns between software systems. They're excellent at what they do, but they weren't built with AI agents in mind.

AI Gateway is purpose-built for agentic workloads. That means it understands MCP as a protocol, manages the specific lifecycle of agent-to-tool connections (intake, approval, authentication, runtime enforcement), and provides the kind of audit trail and policy controls that enterprise AI governance requires. It also handles things an API Gateway doesn't need to think about, like detecting sensitive data in agent requests before they reach an external tool, or enforcing that only approved servers are available to agent builders at development time.

💡 If your organization already uses an API Gateway, AI Gateway sits alongside it, not in place of it. They solve different problems.

---

Using AI Gateway

Who are the main roles in AI Gateway?

AI Gateway is designed around two personas who each interact with it differently:

• Product Owners are the builders, the people creating AI agents and connecting them to external tools. Their primary interaction with AI Gateway is through AI Agent Studio, where they submit requests to add MCP Servers, configure which tools their agents use, and view usage metrics for their connections. Product Owners working in AI Agent Studio only see approved MCP Servers in their dropdown. Unapproved servers are hidden, so governance is enforced at the point of development, not after the fact.
• AI Stewards are the governors, typically members of your AI governance, security, or compliance teams. They review and approve MCP Server requests, configure authentication, pause or resume servers, activate sensitive data protection, and monitor connection health across the enterprise. AI Stewards work primarily in AI Control Tower.

Most users fall into one of these two roles. Your ServiceNow administrator can assign the appropriate role, contact them if you're unsure which one applies to you.

How do I submit a request to add an external tool?

If you're a Product Owner building an agent in AI Agent Studio, you can submit an MCP Server request directly from the Studio. Navigate to Settings > Manage MCP Servers, then click New. From there you can either enter the server details manually or browse and import from the MCP catalog with one click. Details are pre-populated so there's no manual configuration required.

Your request enters the approval lifecycle in AI Control Tower, where an AI Steward reviews it. You'll be able to track the approval status on the MCP Server record.

If you're registering a server that wasn't created in AI Agent Studio, for example, an external third-party server your agents need to access, that intake can also be done directly through AI Control Tower without needing to go through AI Agent Studio first.

What authentication methods are supported?

AI Gateway supports two authentication methods for MCP server connections:

OAuth 2.1 is the primary authentication method. Every OAuth connection routes through the AI Gateway proxy, where token validation and rotation are enforced centrally, agents never connect directly to the server. Platforms that support CIMD can auto-configure through a single registration in AI Control Tower, covering all approved MCP servers on that host without repeated per-server setup.

Every OAuth connection routes through the AI Gateway proxy, where token validation and rotation are enforced centrally. Agents never connect directly to the server.

OAuth 2.1 connections go through the same governance lifecycle, intake, review, approval, and runtime enforcement. The choice between them depends on what the MCP server supports, not on governance coverage.

How does automated client registration work for external platforms?

AI Gateway supports automated client registration through CIMD (Client Identity Metadata Document), a capability in the MCP specification that allows an agent platform to prove its identity dynamically using its HTTPS certificate.

In practice, this means an AI Steward registers an external platform once in AI Control Tower. That single registration covers every approved MCP server on that host automatically.

In practice, an AI Steward registers the external platform once in AI Control Tower by entering the platform's CIMD client URL under Configurations > AI Gateway. From that point, a single registration covers every MCP server on that host, when a new server is approved, it automatically becomes accessible to that client without any additional setup.

For platforms that don't yet support CIMD, guided OAuth 2.1 setup remains available for manual client credential configuration.

How do I troubleshoot connectivity issues across platforms?

AI Gateway logs every connection attempt with the client identity and timestamp. AI Stewards can use this data to track down connectivity issues by counting successful and failed connections, filtering by time period, and grouping results by MCP client.

This makes it faster to identify which agent platform is experiencing issues and when the problem started, without having to cross-reference logs from multiple systems.

For deeper investigation once you've identified the affected client or time window, your next step would be reviewing that server's configuration and authentication setup in AI Control Tower. If the issue warrants immediate action, any MCP server can be paused instantly while you investigate.

How does an AI Steward approve or reject an MCP Server?

When a Product Owner submits an MCP Server request, it appears in AI Control Tower with a status of In Review. To review it, navigate to AI Control Tower > AI assets > MCP Servers and filter to servers in the In Review state. The AI Steward opens the server record and works through the Asset Approval Playbook, reviewing what tools the server exposes, what data it accesses, whether it comes from a trusted source, and whether it meets your organization's security requirements. At the end of the playbook, the Steward approves or rejects the request.

Approved servers move to the Deployed lifecycle phase and become available to agents. Rejected servers cannot be added to agent configurations. The entire review history is logged, so there's always a record of who approved what and when.

Can I pause a server if something goes wrong?

Yes. AI Stewards can pause any MCP Server instantly, individually or globally, directly from the AI Gateway setup tab on the MCP Server record in AI Control Tower. When a server is paused, all agent traffic to that server stops without client configuration changes.. Agents attempting to call a paused server will receive an error response. No code changes or deployments are required, and the server can be resumed just as quickly once the issue is resolved. Configurations are preserved when a server is paused, so no setup needs to be repeated to resume.

Note: Pause, resume, and sensitive data detection changes take effect within 10 minutes due to cache refresh.

What do agents experience when a server is paused?

When an AI Steward pauses an MCP server, individually or globally, all traffic to that server stops without configuration changes needed on the client side. Agents attempting to call a paused server will receive an error response indicating the server is currently unavailable. No agent-side code changes are required.

Configurations are preserved when a server is paused. Once the AI Steward resumes the server, it becomes available again, agents connecting after resumption will succeed without any reconfiguration on the agent side. 

Note: Pause, resume, and sensitive data detection changes take effect within 10 minutes due to cache refresh.

This is intentional by design: the pause mechanism is built for speed in security or compliance scenarios, and the resume path is equally fast so the impact on agent users is as short as possible.

Does AI Gateway support locally hosted MCP Servers?

No, AI Gateway only supports MCP Servers hosted on remote servers. Locally hosted servers running on a developer's machine are not supported. This is by design, as remote hosting is required to ensure the secure, reliable connections that enterprise governance depends on.

How does the MCP server approval workflow work for reviewers?

When a Product Owner submits an MCP server request, it appears in AI Control Tower with a status of In Review. AI Stewards navigate to AI Control Tower > AI assets > MCP Servers and filter to servers in the In Review state.

Approval tasks deep-link directly to the tool governance view. Reviewers click once from the approval task to open the Tools tab, where they can review tool configurations, scan results, and governance details without leaving the workflow or switching systems. At the end of the review, the AI Steward approves or rejects the request.

Approved servers move to the Deployed lifecycle phase and become available to agents. Rejected servers cannot be added to agent configurations. Every approval decision is logged with a complete audit trail, who approved what, when, and with what outcome.

How do asset owners register new AI connections?

A guided intake flow gives asset owners a self-service path to register new AI connections without engineering support. The flow is role-appropriate, it surfaces only the controls relevant to the asset owner persona, so business-side stakeholders aren't presented with technical configuration options outside their scope.

To get started, navigate to AI Control Tower and select AI Asset Onboarding. The guided experience walks through each required step, validates inputs along the way, and routes the completed registration into the standard approval lifecycle for AI Steward review.

How does tool-level governance work?

Tool-level governance extends the same approval, policy, and lifecycle management that applies to MCP servers down to the individual tools those servers expose. AI Stewards can review and approve not just which servers are allowed, but which specific tools within each server agents can access.

Once a tool is approved, access policies can be set at the tool level, by role, department, or data classification, and those policies apply automatically across every agent that calls that tool, regardless of which platform the agent was built on. A live tool catalog tracks every tool, version, and owner across all registered servers, giving agent builders a searchable view of approved tools they can reuse without duplicate integrations.

Can I set different policies for different tools on the same server?

Yes. Policies in AI Gateway can be defined at the tool level, which means two tools on the same MCP server can have completely different access rules. For example, a read-only tool might be accessible to all agent builders, while a tool that writes to a production system might be restricted to a specific role or department.

Tool-level policies are defined once in AI Control Tower and apply automatically across all agents, there's no need to configure restrictions at the agent level or rely on individual teams enforcing their own access controls. Every policy decision is logged, so AI Stewards have a complete record of what was restricted, when, and why.

---

Security and Compliance

How does AI Gateway enforce security at runtime?

Security in AI Gateway operates across three controls that apply on every MCP call.

1. Server State

Before anything else, AI Gateway checks whether the MCP Server is currently active. If an AI Steward has paused the server, globally or individually, the request is blocked.

Note: Pause, resume, and sensitive data detection changes take effect within 10 minutes due to cache refresh.

2. Authentication

Every connection is routed through AI Gateway and OAuth 2.1 is enforced, not recommended, enforced. There is no path to an MCP Server that bypasses authentication. AI Gateway manages token validation and rotation centrally, so there's no risk of hardcoded credentials or tokens that never rotate.

3. Sensitive Data Detection

If an AI Steward has activated sensitive data detection for that server, every call is scanned. If sensitive data is detected, the traffic is blocked entirely. It does not pass through, it does not get logged downstream, and it does not reach its destination.

All three controls are enforced at the infrastructure level. No developer involvement required, no relying on individual teams having implemented their own checks.

How does sensitive data protection work, and what does "blocked" mean exactly?

When an AI Steward activates sensitive data detection for an MCP Server using one toggle in AI Control Tower, every call to that server is scanned. The scan checks for patterns configured in your system, such as social security numbers, credit card numbers, and other sensitive data types your organization has defined.

If sensitive data is detected, AI Gateway blocks the entire payload. It does not pass through to the agent, it does not appear in downstream logs, and it does not reach any connected system. The blocked event is recorded in the audit trail so your compliance team has a complete record.

This protection is consistent across every agent connecting to that server, regardless of which platform the agent was built on or who built it.

Can I quickly respond if a security issue is detected?

Yes, AI Stewards can pause any MCP Server instantly, either individually or across all servers globally, directly from AI Control Tower. When a server is paused, all agent traffic to it stops without configuration changes needed on the client side. No change management cycle, no deployment window, no code changes required. The server can be resumed just as quickly once the issue is resolved.

Note: Pause, resume, and sensitive data detection changes take effect within 10 minutes due to cache refresh.

This is particularly useful in situations like a vendor disclosing a vulnerability, an unusual spike in call volume, or a server behaving unexpectedly, scenarios where you need to act in seconds, not hours.

Does AI Gateway help with compliance requirements?

AI Gateway contributes to compliance in four direct ways.

First, sensitive data detection and blocking at the gateway ensures that sensitive data never transits through agent connections to any downstream system, supporting data minimization and access control requirements without relying on individual development teams to implement their own checks.

Second, every MCP transaction flowing through AI Gateway is logged with caller identity, tool invoked, latency, and outcome, giving your compliance team a traceable record of every agent action.