Reported issues for ServiceNow MCP Server

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to ServiceNow MCP Server.

Most discussed

FastMCP 4.0 stable: remove beta-pin workarounds

Tracking issue for when FastMCP 4.0 leaves beta (Renovate will propose the bump). Checklist from the v0.6.0 migration:

pyproject.toml: fastmcp==4.0.0b2 → a normal range (e.g. >=4.0,<5)
Remove the direct fastmcp-slim[client,server]==4.0.0b2 dependency (only existed for uvx pre-release resolution)
Remove [tool.uv] prerelease = "allow" from pyproject
Remove --prerelease allow from every uvx example: README, docs/configuration.md, .mcp.json.example, .claude-plugi

Read the thread · 2026-08-12 · open · 1 comment

Support for federated SSO / MFA-enforced ServiceNow instances (e.g. Okta)

Thanks for this project — it's a great fit for the incident/CMDB workflows we need.

We tried connecting to a ServiceNow instance (*.service-now.com) that uses Okta as its identity provider with MFA enforced. Both basic and oauth (ROPC via /oauth_token.do) auth types fail for federated user accounts, since:

Users authenticated via Okta SSO typically have no local ServiceNow password to send in a Basic Auth header or password-grant POST.
Even where a local credential existed, MFA e

Read the thread · 2026-07-16 · closed · external user · 1 comment

feat: ITSM domain-specific tools (incident, change, catalog)

The current tool set provides excellent generic Table API access, but ITSM operations (incidents, changes, catalog requests) require users/agents to know ServiceNow's encoded query syntax and field names.

I'd like to propose 10 domain-specific tools that build encoded queries from human-friendly parameters:

ITSM (7 tools)

incident_search — filter by assigned_to, assignment_group, state, priority, CI, date, text
incident_create — create with impact/urgency/category/CI/caller
`

Read the thread · 2026-06-03 · closed · external user · 1 comment

AuthManager: token response without access_token yields a literal 'Bearer None' header

Surfaced during the mypy adoption review (#9): in AuthManager.get_headers() the OAuth branch formats f"{self.token_type} {self.token}" where both are Optional[str]. A 200 token response that omits access_token (malformed proxy, misconfigured provider) would send a literal Bearer None Authorization header downstream instead of raising a clear error at the token step.

Tiny hardening: after _store_token_response, raise ValueError when access_token is absent. Pre-existing behavior,

Read the thread · 2026-08-13 · open · 0 comments

Adopt mypy (package ships py.typed but nothing type-checks it)

The wheel ships py.typed and the codebase uses type hints throughout, but no CI step or config validates them — a stale .mypy_cache/ suggests it ran ad hoc once. Add mypy to the dev extra, a [tool.mypy] config, and a CI step. Expect a small pile of initial errors around the FastMCP decorator boundaries.

Read the thread · 2026-08-12 · closed · 0 comments

AuthManager ROPC: no HTTP timeout, refresh token discarded

Two defects in src/servicenow_mcp/auth/auth_manager.py (_get_oauth_token, ~line 74):

The password-grant requests.post to /oauth_token.do has no timeout — a hung instance blocks the tool call indefinitely (every other HTTP call in the project honors config.timeout).
The refresh_token from the token response is discarded, so refresh_token() silently re-runs the full password grant with stored credentials rather than a refresh grant.

Low urgency (stdio/ROPC path only; the

Read the thread · 2026-08-12 · closed · 0 comments

Most recent

The remaining reports are on the project's issue tracker.