# Reported issues for ServiceNow MCP Server

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [ServiceNow MCP Server](/mcp/servicenow-mcp-server).

## Most discussed

### FastMCP 4.0 stable: remove beta-pin workarounds

Tracking issue for when FastMCP 4.0 leaves beta (Renovate will propose the bump). Checklist from the v0.6.0 migration:

- [ ] `pyproject.toml`: `fastmcp==4.0.0b2` → a normal range (e.g. `>=4.0,<5`)
- [ ] Remove the direct `fastmcp-slim[client,server]==4.0.0b2` dependency (only existed for uvx pre-release resolution)
- [ ] Remove `[tool.uv] prerelease = "allow"` from pyproject
- [ ] Remove `--prerelease allow` from every uvx example: README, docs/configuration.md, .mcp.json.example, .claude-plugi

[Read the thread](https://github.com/jschuller/mcp-server-servicenow/issues/8) · 2026-08-12 · open · 1 comment

### Support for federated SSO / MFA-enforced ServiceNow instances (e.g. Okta)

Thanks for this project — it's a great fit for the incident/CMDB workflows we need.

  We tried connecting to a ServiceNow instance (*.service-now.com) that uses Okta as its identity provider with MFA enforced. Both basic and
  oauth (ROPC via /oauth_token.do) auth types fail for federated user accounts, since:

  1. Users authenticated via Okta SSO typically have no local ServiceNow password to send in a Basic Auth header or password-grant POST.
  2. Even where a local credential existed, MFA e

[Read the thread](https://github.com/jschuller/mcp-server-servicenow/issues/4) · 2026-07-16 · closed · external user · 1 comment

### feat: ITSM domain-specific tools (incident, change, catalog)

The current tool set provides excellent generic Table API access, but ITSM operations (incidents, changes, catalog requests) require users/agents to know ServiceNow's encoded query syntax and field names.

I'd like to propose **10 domain-specific tools** that build encoded queries from human-friendly parameters:

## ITSM (7 tools)

- `incident_search` — filter by assigned_to, assignment_group, state, priority, CI, date, text
- `incident_create` — create with impact/urgency/category/CI/caller
- `

[Read the thread](https://github.com/jschuller/mcp-server-servicenow/issues/2) · 2026-06-03 · closed · external user · 1 comment

### AuthManager: token response without access_token yields a literal 'Bearer None' header

Surfaced during the mypy adoption review (#9): in `AuthManager.get_headers()` the OAuth branch formats `f"{self.token_type} {self.token}"` where both are `Optional[str]`. A 200 token response that omits `access_token` (malformed proxy, misconfigured provider) would send a literal `Bearer None` Authorization header downstream instead of raising a clear error at the token step.

Tiny hardening: after `_store_token_response`, raise `ValueError` when `access_token` is absent. Pre-existing behavior, 

[Read the thread](https://github.com/jschuller/mcp-server-servicenow/issues/12) · 2026-08-13 · open · 0 comments

### Adopt mypy (package ships py.typed but nothing type-checks it)

The wheel ships `py.typed` and the codebase uses type hints throughout, but no CI step or config validates them — a stale `.mypy_cache/` suggests it ran ad hoc once. Add `mypy` to the dev extra, a `[tool.mypy]` config, and a CI step. Expect a small pile of initial errors around the FastMCP decorator boundaries.

[Read the thread](https://github.com/jschuller/mcp-server-servicenow/issues/9) · 2026-08-12 · closed · 0 comments

### AuthManager ROPC: no HTTP timeout, refresh token discarded

Two defects in `src/servicenow_mcp/auth/auth_manager.py` (`_get_oauth_token`, ~line 74):

1. The password-grant `requests.post` to `/oauth_token.do` has **no timeout** — a hung instance blocks the tool call indefinitely (every other HTTP call in the project honors `config.timeout`).
2. The `refresh_token` from the token response is discarded, so `refresh_token()` silently re-runs the full password grant with stored credentials rather than a refresh grant.

Low urgency (stdio/ROPC path only; the 

[Read the thread](https://github.com/jschuller/mcp-server-servicenow/issues/7) · 2026-08-12 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/jschuller/mcp-server-servicenow/issues).