Connecting to an MCP server from an MCP client

Connect to a Model Context Protocol (MCP) server from an MCP client by creating an OAuth inbound integration and configuring the client with the server details.

With the Quickstart Server or after creating a server, you can complete the following steps to connect to a server from a client:

1. Create an OAuth inbound integration for an MCP client
2. Configure an MCP client to connect to an MCP server

The process to configure a client to connect to a server is dependent on the client used. For more information, refer to the documentation for your AI application and client.

Create an OAuth inbound integration for an MCP client

Secure access to Model Context Protocol (MCP) servers on an instance by creating an OAuth inbound integration for each MCP client.

Before you begin

Role required: oauth_admin, mi_admin, admin

About this task

For each client that you want to access servers on an instance, create an OAuth inbound integration in Machine Identity Console. To create the OAuth integration, you need a redirect URL from the client. For more information, refer to the documentation for your AI application and client.

Procedure

1. Navigate to All > MCP Server Console.
2. From the Configuration tab, select Servers.
3. From the OAuth setup required banner, select Set up OAuth.
   Alternatively, you can navigate to All > Machine Identity Console and select the Inbound integrations tab.

   Note:

   In the list of existing inbound integrations, you might see integrations created with the same names as servers (including underscores). These are integrations for monitoring servers from AI Control Tower and shouldn't be used to integrate with clients.
4. Select New integration.
5. Select OAuth - Authorization code grant.
6. On the form, fill in the required fields.
   For more information about this form, see Configure an OAuth authorization code grant.

   Table 1. Inbound integration form

   Field	Value
   Details section
   Name	Enter a name for the OAuth integration.
   Redirect URLs	Enter the redirect URL for a client. The authorization code is sent to this URL after authentication. To get the redirect URL, refer to the documentation for your AI application and client. To connect to the ServiceNow MCP client on another instance, use the following redirect URL: https://<client-instance>.service-now.com/oauth_redirect.do. For more information, see the Model Context Protocol Client documentation.
   Auth scope section
   Allow access only to APIs in selected scope	Clear the check box to make the OAuth integration broadly scoped.
   Advanced options section
   Token Format	Select JWT.

7. Select Save.
   The OAuth inbound integration is created as broadly scoped with a client ID and client secret that you use when configuring the client to connect to servers on the instance.

   

What to do next

Configure the client to use the client ID and client secret to authenticate with servers on the instance.

Configure an MCP client to connect to an MCP server

Configure a Model Context Protocol (MCP) client to connect to an MCP server and prompt the server to perform a task.

Before you begin

Role required: none

About this task

The process to configure a client to connect to a server is dependent on the client used. The following procedure is a high-level overview of the workflow to configure a client to call a server. For more information, refer to the documentation for your AI application and client. For an example that demonstrates how to connect from a server on one instance to the ServiceNow Model Context Protocol Client on another instance, see the example following this procedure.

Procedure

1. Configure a client with the required server details as determined by the client.

   Table 2. Server details for MCP client configuration

   Server details	Value
   Server URL	https://<server-instance>.service-now.com/sncapps/mcp-server/mcp/<server-name> To connect to the preconfigured Quickstart Server, use https://<server-instance>.service-now.com/sncapps/mcp-server/mcp/sn_mcp_server_default.
   Host	<server-instance>.service-now.com
   Base URL	/sncapps/mcp-server
   Scope	mcp_server
   Authentication type	OAuth 2.0
   Identity Provider	Generic OAuth 2
   Authorization URL	https://<server-instance>.service-now.com/oauth_auth.do
   Token URL	https://<server-instance>.service-now.com/oauth_token.do
   Token Revocation URL	https://<server-instance>.service-now.com/oauth_revoke.do
   Refresh URL	https://<server-instance>.service-now.com/oauth_auth.do
   Redirect URL	https://<server-instance>.service-now.com/oauth/callback
   Client ID	The client ID from the OAuth inbound integration on the server instance.
   Client secret	The client secret from the OAuth inbound integration on the server instance.

   After configuring these details, the client calls the server with the Authorization: Bearer <token> header. If the token is validated by the server, the client receives the list of tools available for use.

2. From the client, you can view the list of tools available to determine how to prompt the server.
3. Enter a prompt for the information you need or for the tool to perform an action on the instance.

   For example, if the Look up Incident Records tool is available, you could enter "Get all open incidents." With the Case summarization tool, you could enter "Summarize all cases closed this week."

   The server runs the relevant tools and returns the result to the client as JSON data. The client presents the response as formatted text.

Connecting to an MCP server from ServiceNow Model Context Protocol Client

This example demonstrates how to connect to a server from an AI agent on another instance using the ServiceNow Model Context Protocol Client. First, you configure the client to call the preconfigured Quickstart Server. From an AI agent, you access the Quickstart Server's list of tools and add individual tools to the agent. Lastly, you test the agent in AI Agent Studio by providing a prompt and seeing the agent's response. For more information, see the Model Context Protocol Client documentation.

Role required: sn_mcp_client.admin

1. On the server instance, create an OAuth inbound integration for the ServiceNow Model Context Protocol Client.

   For more information, see Create an OAuth inbound integration for an MCP client.

2. On the client instance, navigate to All > AI Agent Studio > Settings.
3. Select Manage MCP Servers.
4. Select New.
5. Add the Quickstart Server.

   For more information about this step, see Add an MCP server with OAuth 2.1.

   1. On the Add MCP server form, fill in the fields.

      Table 3. Add MCP server form

      Field	Value
      Name	Quickstart Server
      Authentication Type	OAuth 2.1
      MCP server URL	https://<server-instance>.service-now.com/sncapps/mcp-server/mcp/sn_mcp_server_default

   2. Select Next.
   3. On the form, fill in the fields.

      Table 4. Add MCP server form

      Field	Value
      Client registration type	Manual Registration
      Grant type	Authorization Code
      Token authentication method	Client Secret Post
      Client ID	The client ID from the OAuth inbound integration for the Model Context Protocol Client on the server instance.
      Client secret	The client secret from the OAuth inbound integration for the Model Context Protocol Client on the server instance.
      Authorization URL	https://<server-instance>.service-now.com/oauth_auth.do
      Token URL	https://<server-instance>.service-now.com/oauth_token.do
      Token Revocation URL	https://<server-instance>.service-now.com/oauth_revoke.do

   4. Select Save.
6. Verify the OAuth configuration.
   1. Select Authenticate.
   2. Select Allow to allow the client to connect to the server.
7. Add tools from the Quickstart Server to an AI agent.

   For more information about this step, see Add an MCP server tool to an AI agent.

   1. In AI Agent Studio, select the Create and manage tab.
   2. From the AI agents tab, select an existing agent or create one.

      For information about creating an agent, see Create an AI agent.

   3. Select Add tools and information.
   4. Select Add tool > MCP server tool.
   5. On the form, fill in the fields.

      Table 5. Add a Model Context Protocol Tool form

      Field	Value
      Select Model Context Protocol server	Quickstart Server
      Select tool	Select the tools from the Quickstart Server that you want to use with this AI agent.

      

   6. Select Add.
   7. Select Save and continue.
8. Test the AI agent.

   For more information about this step, see Test an AI agent.

   1. In AI Agent Studio, select the Testing tab.
   2. Select Start manual test.
   3. In the Choose a test type field, select AI agent or workflow.
   4. Select the AI agent you configured and its version.
   5. In the Task field, enter a prompt to get information or to perform an action on the instance.

      The prompt should be based on which tools are available. For example, if you added the Look up Case Records and Case summarization tools, you can enter "Summarize all cases closed this week."

      

   6. Select Continue to Test Chat Response.

   The AI agent calls the server, and the server runs the tools requested based on the prompt. The server returns the information to the agent as JSON data, and the agent presents it as formatted text. In this example, the agent returns summaries of the cases closed by Abel Tuter in the past week.

   

Integrating MCP server with third-party identity providers

Configure the ServiceNow® Model Context Protocol (MCP) server to authenticate users through a third-party identity provider (IDP).

When you integrate a third-party IDP with an MCP server, users authenticate through the external IDP instead of ServiceNow's native authentication. This process involves three phases:

1. ServiceNow (Glide) configuration
2. Third-part IDP setup
3. Integration and testing

The first phase is ServiceNow (Glide) configuration that involves setting up the necessary tables and mappings within your ServiceNow instance. This has three steps:

1. Configure the OIDC provider
2. Create the MCP server
3. Map the resource to the IDP

The second phase is Third-party IDP setup that involves setting up the application and authorization server within the IDP. This has three steps:

1. Account setup
2. Create an app integration
3. Configure the authorization server

The final phase is Integration and testing that involves connecting the MCP client (such as Claude Desktop) to the configured systems. This involves three steps:

1. Connect to the MCP client
2. Authenticate
3. Verify tool calls

Related tasks

• Integrate and test IDP with MCP server
• ServiceNow(Glide) configuration for IDP

ServiceNow(Glide) configuration for IDP

This process involves setting up the necessary tables and mappings within your ServiceNow instance. This includes configuring ServiceNow, creating the MCP server, and connecting the MCP client.

Before you begin

Role required: admin

Procedure

Configure the OIDC provider

Note:

Okta is used as the use case to guide you through the steps.

1. Navigate to the oidc_provider_configuration table and select New.
2. Enter a Name for the OIDC provider.
   For example, Okta MCP Third Party.
3. Set the Cache Configuration Lifespan.
   The maximum value is 720 hours.
4. Enter the IDP metadata URL into the Metadata URL field.
5. In the User Claim section, enter sub, and in the User Field, select email.
   This maps the sub claim from the IDP token to the email field in the sys_user table.
6. Select Submit.

Create the MCP server

7. Navigate to the MCP server console and select Create Server.
8. Enter a name for the server and add the required tools.
   For example, MCP with Third Party IDP.
   After you create the server, ServiceNow automatically generates an entry in the oauth_protected_resource table and populates it with the list of APIs allowed for that server.

Map the protected resource to the IDP

9. Navigate to the oauth_protected_resource_idp_mapping table and select New.
10. In the Protected Resource field, select the resource that was created for your MCP server.
    If your MCP server name is sn_mcp_server_default, the protected resource path is /sncapps/mcp-server/mcp/sn_mcp_server_default.
11. In the OIDC Provider field, select the OIDC provider configuration you created earlier.
12. Select Submit.

Result

Your MCP server is now configured to authenticate users through the third-party IDP. Users who connect an MCP client to this server are redirected to the related IDP to authenticate.

What to do next

1. Configure and set up the third-party IDP. This part involves setting up the application and authorization server within the third-party IDP setup. See https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3095516 to read more. This document uses Okta as the use case, however, Microsoft Entra is also recommended.
2. Integrate and test.

Integrate and test IDP with MCP server

This phase within integration of MCP server with IDP involves connecting the MCP client (such as Claude Desktop) to the configured systems.

Before you begin

Role required: admin

Procedure

Connect the MCP client

1. Navigate to your MCP client and go to Manage Connectors > Add a custom connector.
   For example, open Claude Desktop.
2. Enter the Remote MCP Server URL from your ServiceNow MCP server console.
3. Enter the Client ID and Client Secret from your third-party IDP application configuration.

Authenticate

4. Select Connect and authenticate with your third-party IDP credentials.
   You're redirected to the IDP login page. Enter your credentials and verify.

Verify tool calls

5. Test your tool calls to verify the connection is working correctly.

Result

Your MCP server is now configured to authenticate users through the third-party IDP. Users who connect an MCP client to this server are redirected to the IDP to authenticate.