- Post History
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
2 hours ago
AI Gateway is ServiceNow's centralized control point for governing, securing, and observing cross-platform AI agent operations. It sits between your agent builder applications and the external resources they connect to, intercepting all Model Context Protocol (MCP) traffic to enforce policies, authenticate requests, and capture usage data without requiring any code changes or developer involvement.
As organizations build AI agents across platforms like ServiceNow AI Agent Studio, Microsoft Copilot Studio, and others, managing those connections securely and consistently becomes a significant challenge. AI Gateway addresses that challenge by providing a single governance layer that spans every MCP connection, regardless of which agent builder created it.
This article introduces each section of the AI Gateway Implementation Guide so you know exactly what to expect and where to go for the configuration steps you need. For full step-by-step procedures, see the attached implementation guide.
📖 Key Terms
MCP Server: An external resource (such as Slack, GitHub, or a third-party API) that exposes tools and capabilities to AI agents via the Model Context Protocol.
AI Gateway: The ServiceNow-hosted proxy layer that intercepts all MCP traffic between agents and external servers, enabling centralized governance, security, and observability.
Gateway URL: The ServiceNow-hosted endpoint that agents connect to instead of connecting directly to an MCP Server. All traffic flows through this URL.
AI Steward: The role responsible for reviewing, approving, and governing MCP Servers through Asset Approval Playbooks.
CIMD: Client Identity Metadata Document. A metadata document hosted on the client platform's domain that AI Gateway reads to automatically configure and validate the client, eliminating manual credential setup.
Setup and Prerequisites
The guide opens with a concise orientation to AI Gateway's purpose and architecture, then moves directly into what you need before you start.
You will find plugin requirements, role assignments, and playbook activation steps needed before any MCP Server can be registered or governed. See the attached implementation guide for current release and patch requirements.
Plugin quick reference
AI Gateway is automatically installed with the AI Control Tower Core plugin (sn_awh_config).
Required roles
AI Steward (sn_ai_governance.ai_steward) for approval and governance workflows. AI Agent Admin (sn_aia.admin) and MCP Client Admin (sn_mcp_client.admin) for agent-side configuration.
The Setup Process: Steps 1 Through 3
The core of the implementation guide walks you through seven sequential steps. The sections below preview the first three — intake, approval, and client registration — so you know where to go when you're in them.
The guide covers three methods for registering an MCP Server with AI Gateway. The right method depends on where the server was created and how it will be used.
Method 1A: Automatic Discovery from AI Agent Studio
MCP Servers created in AI Agent Studio are automatically synced to AI Control Tower every 15 minutes. No manual registration required. The server appears in Inventory with a state of New and is ready for AI Steward review.
Method 1B: MCP Catalog Import
Browse and import pre-configured MCP Servers from the built-in MCP catalog. Selecting a server auto-populates its URL and authentication type. Client registration details auto-populate as well if the server supports CIMD. One click submits it for AI Steward approval.
Method 1C: Direct Intake
Register an external MCP Server manually through AI Control Tower, without going through AI Agent Studio first. Use this for servers not available in the MCP catalog, or when an external agent platform such as Copilot Studio or Claude Desktop needs to connect to a ServiceNow-hosted MCP Server.
Regardless of intake method, every server arrives as an unmanaged asset. Moving a server to Managed is the AI Steward's first action in Step 2 — it activates the Lifecycle tab and starts the Onboard playbook. Completing that playbook and reaching Deployed & Approved status is what unlocks client registration, tool controls, security policies, and observability.
AI Stewards use the Onboard Approval Playbook to review and approve MCP Servers before they become available for agent use. The guide details each playbook phase and what the AI Steward should check at each point.
MCP Server lifecycle states
Unmanaged → Managed → Deployed & Approved. Moving to Managed starts the Onboard playbook, which runs through Assess, Build and test, and Deploy phases. Completing all phases moves the server to Deployed & Approved, which is what makes it available to agents.
Enforcement in AI Agent Studio
Product Owners in AI Agent Studio only see approved servers in their dropdown. Unapproved servers are hidden, so governance is enforced at the point of development. If an AI Steward pauses a server, it becomes immediately unavailable to all agents with no code changes required.
Once an MCP Server is Deployed & Approved, clients (agent builder applications) must be configured to authenticate through AI Gateway. The guide covers both registration types and walks through the full setup for each.
MCP client registration (AI Agent Studio, Copilot Studio, and all other platforms)
Manual registration requiring a client name and the platform's redirect URL. AI Gateway generates a Client ID and Client secret that must be entered in your agent platform to complete the connection.
CIMD client registration (VS Code)
Automated registration using a Client Identity Metadata Document. Enter the metadata URL and AI Gateway validates and configures credentials automatically. One CIMD registration covers all MCP Servers on that host, eliminating repeated per-server credential setup.
Finding the Gateway URL
Once a client is registered, the AI Gateway MCP server URL, Client ID and secret, and the authentication and token endpoint URLs are all available on the MCP Server record's AI Gateway tab → Setup sub-tab. Agents connect to this Gateway URL only — never directly to the MCP Server.
What's next in the guide: Once client registration is complete, the implementation guide continues with Step 4: Tool Governance (reviewing and deactivating individual tools exposed by a server) and Step 5: Configure Agents to Use MCP Servers (connecting your agent to the new Gateway URL) — before moving into the Security Controls and Observability sections previewed below.
Security Controls
The security section covers the two runtime controls AI Stewards use to respond to incidents and protect sensitive data across all MCP connections.
AI Stewards can pause MCP Servers individually or globally to respond to suspicious activity, security incidents, or compliance violations. The guide covers the exact steps to pause a server from AI Control Tower, confirms that enforcement takes effect within 10 minutes with no code changes or deployments required, and describes what agents receive when attempting to connect to a paused server.
Global vs. per-server pause
A global pause stops all MCP Server connections on the instance at once. A per-server pause stops traffic to one specific server while all other connections continue running. Configurations are preserved in both cases. Resume is a single click when the issue is resolved.
AI Stewards can activate sensitive data detection per MCP Server using a single toggle on the server record. When active, every call to that server is scanned for sensitive data patterns configured in your system. If a match is detected, the entire response is blocked before it reaches the agent. It is not filtered, masked, or modified in any way.
No code changes required
Activation is a single toggle on the MCP Server record. The guide covers instance-level activation from Settings, per-server activation from the server record, and per-tool activation from the Policies sub-tab. Detection changes take effect within 10 minutes.
Observability and Monitoring
The observability section explains where to find and how to interpret usage and latency metrics in AI Gateway, at both the instance level and the individual server level.
All metrics are captured at the Gateway boundary, so no agent-side instrumentation is required. The guide covers three views, each with navigation steps, what the numbers mean, and how to act on them.
Usage metrics
Request volume and success rate per MCP Server, viewed instance-wide from Insights > Monitor > AI Gateway, or per tool from the Monitor tab on an individual server record.
Latency insights
P50, P90, and P95 response times per server and per tool. The guide includes interpretation benchmarks for healthy versus degraded performance and guidance on when to investigate.
Ready to get started? Access the full implementation guide and additional resources below.
AI Gateway Product Documentation → | AI Gateway FAQ Article →
