Connect a ServiceNow Hosted MCP Server

ServiceNow can host an MCP server for an instance through Server Console, exposing tools built on Now Assist Skills, Knowledge Graph, Subflows, Actions, and Scripted REST APIs directly from ServiceNow data. This guide covers the Arcade-side setup for connecting a ServiceNow Console server as a remote MCP server, plus the handful of ServiceNow settings that most commonly trip people up.

Server Console is a newer, actively evolving feature. Field names and menu paths below reflect ServiceNow’s documentation and community reports at time of writing. Confirm exact screen labels against your instance’s release before publishing this internally.

This guide is about connecting to a ServiceNow-hosted server. If you’re looking to call ServiceNow APIs from your own tools instead, build a custom with the Arcade MCP SDK against ServiceNow’s Table API.

Outcomes

Connect a ServiceNow Server Console server to Arcade and use its in gateways and SDKs.

You will Learn

Which ServiceNow inbound integration settings matter for Arcade specifically, and why
Configure the remote server’s OAuth 2.0 settings in Arcade
Diagnose the most common setup mistakes from their error messages

Prerequisites

An Arcade
A ServiceNow instance with Server Console activated and at least one server configured with
A ServiceNow inbound integration (Machine Identity Console) created for the Arcade integration

Set up ServiceNow

Server Console requires a Now Assist or AI Native SKU entitlement. It is not available on Personal Developer Instances (PDIs), since the feature depends on Now Assist activation, which standard PDIs don’t carry. Confirm the entitlement and a supported release (Zurich or later; some MCP Apps features require Zurich Patch 9+ / Australia Patch 2+) before continuing.

Follow ServiceNow’s own guides to activate Server Console and configure a server with the you want to expose (All > Console > Configuration > Servers). A few settings on the inbound integration matter specifically for connecting to Arcade:

Create the inbound integration under Machine Identity Console, not the classic Application Registry: All > Machine Identity Console > Inbound integrations > New, then choose OAuth - Authorization code grant. This is the only OAuth flow Server Console supports, consistent with the MCP authorization spec (there’s no client-credentials, or machine-to-machine, option). Configuring this requires the oauth_admin, mi_admin, or admin role.
Auth scope: clear the Allow access only to APIs in selected scope toggle. ServiceNow’s setup guides don’t always call out why this matters. Left enabled, the resulting token can’t reach the /sncapps/mcp-server endpoint, and every call fails even though authorization itself looks successful.
Advanced options → Token Format: set this to JWT. Left at the default, ServiceNow issues an opaque session token instead, and the Server Console endpoint only validates JWTs. Every call then fails with a bare 403, which reads like a permissions problem but is actually a token-format mismatch.
Redirect URL: set this once you have the redirect URI Arcade generates (see Add the redirect URI to your inbound integration below). A placeholder works for now.

Create one inbound integration per external client. ServiceNow’s design assumes a dedicated OAuth integration for each AI application connecting to a server. Reusing an integration created for a different client, or having multiple integrations on the instance and pointing Arcade at the wrong one, is one of the more common causes of “authenticated but not authorized” errors (a valid token that still gets a 403 or an empty list).

Calls through Server Console are proxied via ServiceNow’s central AI Control Tower, which means request and response data leaves the instance for processing. If that matters for your data-residency requirements, review Now Assist’s data handling and opt-out settings before connecting this in a production environment.

Configure the remote server in Arcade

Register the server

Go to the MCP servers dashboard , click Add Server, choose Remote , and enter a server ID and the Console server’s URL. For example, if your instance domain is https://acme-inc.service-now.com and your server is named IncidentTools, the URL is https://acme-inc.service-now.com/sncapps/mcp-server/mcp/IncidentTools.

Configure OAuth2 authorization

Open Advanced settings → OAuth2 authorization and enter:

Client ID / Client Secret: from the inbound integration you created above.
Authorization URL / Token URL: unlike some vendors, ServiceNow doesn’t publish OpenID Connect discovery metadata for inbound integrations, so set these explicitly to your instance’s endpoints:
- Authorization URL: your instance domain with /oauth_auth.do appended. For example: https://acme-inc.service-now.com/oauth_auth.do.
- Token URL: your instance domain with /oauth_token.do appended. For example: https://acme-inc.service-now.com/oauth_token.do.

ServiceNow inbound integrations don’t support Dynamic Client Registration, so you must supply the Client ID and Secret manually. If you leave these blank, Arcade attempts Dynamic Client Registration and ServiceNow rejects it.

Add the redirect URI to your inbound integration

Copy the redirect URI Arcade generated and set it as the inbound integration’s Redirect URL. A new server registration gets its own unique redirect URI, so update it again if you ever re-register the server under a new ID.

If authorization fails with a redirect mismatch immediately after saving the Redirect URL, allow a few minutes for ServiceNow to propagate the change before troubleshooting further.

Authorize and confirm

Save the server to open the authorization prompt. Sign in as a ServiceNow user with the broadest applicable roles on the target server’s tools. Authorization Code Grant runs the session under whoever completes the browser prompt, and every call afterward executes under that identity’s roles and ACLs. Your credentials at setup time also determine the tool list Arcade discovers.

Troubleshooting

A bare 403 with no clear error code, even though authorization looked successful: the inbound integration is issuing opaque tokens instead of JWTs. See Set up ServiceNow.
list comes back empty, or every call fails, despite a valid token: either Allow access only to APIs in selected scope is still enabled on the inbound integration, or Arcade is authenticating against a different inbound integration than the one you intended (check for duplicate integrations on the instance). Test the same access token directly against the server endpoint with curl or Postman to isolate whether the problem is on Arcade’s side or ServiceNow’s.
“Page not found” at the server URL you registered: Server Console isn’t activated on this instance. Confirm the Now Assist / AI Native SKU entitlement. This is the most common cause, especially on non-production or trial instances, and PDIs specifically don’t support it at all.
403 Forbidden on individual calls, but the connection and tool list look fine: the authorizing ServiceNow doesn’t have the roles needed for that tool’s underlying skill or table. Re-authorize as a user with broader access, or adjust the ACLs on the underlying capability.
A setting change doesn’t seem to take effect: existing tokens don’t retroactively pick up changes to the inbound integration. Revoke the existing grant for the affected (ServiceNow Setup or the user’s OAuth grants list) and re-authorize to get a fresh token.

Next steps

Create an MCP Gateway to expose this server’s .
Connect to MCP clients.