No MCP did browser-based auth for ServiceNow admins. So I built one.
This came out of building ServiceNow Portal — widgets, pages, script includes, the whole
dependency graph.
The real work was never the code change; it was diagnosing what was actually broken and why,
accurately, before touching anything.
Once an AI agent could do that diagnosis reliably, the next question was whether it could go
further — into testing and deployment — safely.
The Table API alone wasn’t enough for that diagnosis.
Flow Designer’s real structure — triggers, actions, why a flow actually fired or didn’t — lives
behind session-only endpoints that ordinary REST auth can’t reach.
So the tool had to grow into real browser authentication, not an API key sitting in a config
file.
What an admin actually needs is what a human admin already has — a real, MFA/SSO/SAML-gated
session.
Nothing in the MCP ecosystem did that for ServiceNow, so that became the harness itself: the
agent inherits a live browser session instead of holding a key.
From there it stopped being an API wrapper.
Every write goes through the same discipline a careful engineer uses by hand — local-first,
diffed against the live server before anything is pushed, anchored so a conflicting edit gets
caught instead of silently overwritten, and provable, so a deployment XML carries a certificate
showing it actually came from the live instance.
Token cost got the same treatment — every schema compacted, every package scoped to what an
agent can actually use.
Every one of these choices has been battle-tested on real ServiceNow portal work, not a spec —
that’s where they actually came from.
🔎 Precise Diagnosis
Traces the real dependency chain — which widget, which script include, which flow — instead of guessing from a stack trace.
🔑 A Session, Not a Secret
Flow Designer’s real structure lives behind session-only endpoints the Table API can’t reach. The agent inherits a live admin session — MFA, SSO, SAML — instead of holding an API key.
🧭 Anchored Sync
Every push is diffed and anchored against the live record first — a conflicting edit is caught, never silently overwritten.
🪶 Token-Conscious by Design
Compacted schemas, package-scoped tools, projected reads — cost is a design constraint, not an afterthought.
🛠️ Dogfooded Daily
Built for, and used on, real ServiceNow work — every rough edge here got smoothed out because it actually got hit.
Quick Start
Just paste this. That’s it.
Copy the line below into any AI coding assistant.
It installs everything — uv, Playwright, MCP config, and skills — automatically.
Install and configure mfa-servicenow-mcp by following the instructions here:
curl -s https://raw.githubusercontent.com/jshsakura/mfa-servicenow-mcp/main/docs/llm-setup.md
Works with Claude Code, Cursor, Codex, OpenCode, Windsurf, VS Code Copilot, Antigravity, Zed, and more.
Your AI detects the client and OS, then walks you through setup interactively.
After setup, restart your AI client to load the MCP server.
If uvx is blocked by corporate security tooling, jump to the
If uvx is blocked (pip) section below.
Manual — install + configure
Install, then add to your client config
Prefer the terminal? Install uv + Chromium, then add the server to your MCP client config file (snippets below). No installer command, no per-client flags.
# 1. Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh
# 2. Fetch the server + Chromium up front (so the first browser-auth call# doesn't download ~150 MB and time out)
uvx --refresh --with playwright --from mfa-servicenow-mcp servicenow-mcp --version
uvx --with playwright playwright install chromium
# 3. Add the server to your MCP client config — copy a snippet below
# 1. Install uv (if not already installed)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
# 2. Fetch the server + Chromium up front (so the first browser-auth call# doesn't download ~150 MB and time out)
uvx --refresh --with playwright --from mfa-servicenow-mcp servicenow-mcp --version
uvx --with playwright playwright install chromium
# 3. Add the server to your MCP client config — copy a snippet below
If uvx is blocked
Install with pip instead
Windows Smart App Control blocks uvx, because uvx unpacks an unsigned temporary executable on every run. If uvx worked until recently and stopped right after a Windows update, this is why. Install with pip and launch the server as a module — the servicenow-mcp console script is an unsigned pip-generated .exe shim that Smart App Control blocks for the same reason.
# Homebrew and distro Pythons refuse global pip installs (PEP 668).# Use a python.org Python, or simply stay on uvx above.
pip install mfa-servicenow-mcp playwright
python -m playwright install chromium
# Verify:
python -m servicenow_mcp --version
# Updating later:
pip install --upgrade mfa-servicenow-mcp playwright
python -m playwright install chromium
# Python 3.10+ from python.org is signed and passes Smart App Control.
pip install mfa-servicenow-mcp playwright
python -m playwright install chromium
# Verify:
python -m servicenow_mcp --version
# Updating later:
pip install --upgrade mfa-servicenow-mcp playwright
python -m playwright install chromium
The env block is identical either way — only command and args change. Paste the snippet from the Manual fallback section below, then set command to python and args to [“-m”, “servicenow_mcp”].
Manual fallback
Repair or inspect client config manually
The installer is the recommended path. Use the raw config examples below only if you need to inspect or repair a client config by hand.
Four distinct shapes cover every supported client. The env block is identical everywhere — only the outer wrapper differs.
The read-only standard package loads by default — no MCP_TOOL_PACKAGE needed.
For write access, set it to an advanced package (service_desk, portal_developer,
platform_developer, or full) — see the
Tool Packages (Advanced) guide.
Manual — Step 3
Add LLM-optimized skills
Tools alone are raw API calls. Skills are what make your LLM actually useful —
verified pipelines with safety gates, rollback, and context-aware delegation.
4 skills today, more coming with every release.
uvx --from mfa-servicenow-mcp servicenow-mcp-skills claude
