AI Connectivity for ServiceNow
Windows + SQL Server
Connect an MCP client to a defined business dataset, configure the access boundary, and validate the resulting workflow.
What you will leave with
A tested, limited workflow with a clear identity boundary and an agreed process for reviewing agent access.
In this guide
Deployment model
Use this guide to configure the Windows host, data access, and operational controls for a ServiceNow MCP workflow. Choose the data path before configuring storage.
- For live-source access, queries use the connected ServiceNow account. Document its identity and effective access; do not assume that connecting an administrator automatically gives every client a separate permission boundary.
- For retained-data access, the selected database supplies the historical dataset. Configure and review that access separately from the source application's permissions.
- Record the MCP client, transport, endpoint or local process, authentication method, and allowed tools from your deployment configuration. Keep read and write authorization separate.
Use the installation package and version-specific configuration supplied for your deployment. This guide covers the source, host, database, and workflow decisions that remain consistent across package versions.
Before you begin
Bring the application owner, infrastructure owner, and data owner into the same deployment review. Agree the boundaries before configuring a connection.
Decisions to make together
- Which question or task should the agent be able to handle?
- Will it access current source records, retained data, or both?
- Which identity authorizes access, and which operations must remain unavailable?
- A ServiceNow administrator and an approved non-production instance.
- An inventory of tables, reference fields, inherited fields, and attachment requirements.
- An agreed integration identity and a review of the instance access rules.
- The connection authentication method and a list of permitted operations for this workflow.
Prepare ServiceNow
Define the ServiceNow instance, tables, and access rules for the workflow. Use a non-production instance to validate the configuration before applying it to production.
Table and field scope
List required tables and fields, including inherited fields and reference values. Include a record with related tasks or attachments when validating whether the scope is complete.
Access and business rules
Review table and field access with the instance administrator. For any proposed write operation, identify business rules and flows that may run, and agree how the test will be isolated.
Inspect a small ServiceNow record set
Use the REST API Explorer or an approved authenticated REST client against your non-production instance. This example requests ten incidents and their stored reference values. Adjust the table and fields to your approved scope.
HTTP
GET /api/now/table/incident?sysparm_query=ORDERBYsys_id&sysparm_fields=sys_id,number,short_description,caller_id,sys_updated_on&sysparm_limit=10&sysparm_display_value=falseWhat to verify
Check the result array against records visible to the integration identity. Preserve sys_id values for matching; display labels are not stable record keys. An empty result can reflect the query or permissions. For a larger extract, define pagination and reconcile changes during capture. Download required attachment bytes through the Attachment API; a metadata row alone does not preserve the file.
ServiceNow: Table API parameters and responsesPrepare Windows
Prepare a Windows host whose ownership, service identity, and network routes are agreed with your infrastructure team.
Host and process ownership
Record the Windows release and deployment package version. Choose the account that will run the application, its file permissions, and the team responsible for restarts and upgrades.
Network and certificates
Review outbound access to the source and connectivity to the database, including proxy and certificate requirements. Limit any inbound application access to the approved network.
Storage and operations
Identify directories for application data and logs. Agree disk monitoring, credential rotation, restart checks, and the maintenance window before scheduling work.
Check the Windows host
Run these PowerShell checks on the application host. The service query shows installed Vivly services, if present. Compare the result with the service list supplied for your package.
PowerShell
Get-CimInstance Win32_OperatingSystem |
Select-Object Caption, OSArchitecture, Version
Get-Service | Where-Object DisplayName -Like '*Vivly*' |
Select-Object DisplayName, Status
Get-PSDrive -PSProvider FileSystem |
Select-Object Name, Used, FreeWhat to verify
Record the OS and available storage. After installation, required services should be running. Check both the service account's database access and its ability to read the configured certificates; success from an administrator's interactive session does not establish service access.
Prepare SQL Server
Only apply this database checklist if your agreed MCP workflow uses retained data. Live source queries can have a different storage architecture.
Agree the SQL Server instance, database, schema, and connection identity with the database owner.
Connection contract
Enter the server address, instance or port, database name, authentication method, and certificate requirements. Install the database driver specified by your deployment package on the application host.
Schema and data handling
Use an isolated test database or schema. Test Unicode, long text, date precision, null values, and identifiers with representative source records. Agree how schema changes will be reviewed.
Database operations
Estimate storage and transaction-log growth from the initial dataset. Agree database backup, monitoring, and access review with the DBA; an application transfer is not a replacement for the database's own recovery plan.
Check the SQL Server connection context
Run this read-only query in the chosen database using the application's intended database identity. It checks the selected database and login without creating or changing tables.
SQL
SELECT DB_NAME() AS database_name,
ORIGINAL_LOGIN() AS login_name,
USER_NAME() AS database_user,
SERVERPROPERTY('ProductVersion') AS server_version;What to verify
The database and identity must match the deployment record. Verify schema privileges separately through the package's connection check. For ODBC connections, configure Encrypt=yes and TrustServerCertificate=no with a trusted server certificate; review driver and server compatibility before choosing strict mode.
Microsoft: ODBC encryption and connection settingsConfigure the workflow
Start with a representative dataset, then expand the scope after validation. Use the connection settings established above and keep source changes behind the appropriate approval.
Choose one useful task
Start with an example such as preparing a case summary from approved records. Define the expected output and its source evidence. Keep the initial dataset small enough for a reviewer to check the result.
Specify the access boundary
Identify the source account, permitted records, fields, and operations. A connected service account is not proof of per-user permission inheritance. Document where user identity and authorization are checked.
Review the client and tools
Configure the MCP client with the transport, authentication method, and tool access defined for your deployment. Start with read-only access where available; review any write-capable tool separately before allowing it during validation.
Test the answer and its limits
Use known questions, missing-data cases, and requests outside the approved scope. Check the source evidence, freshness, denied-access behavior, and what the client retains or sends to its model provider.
Confirm the MCP connection contract
- For stdio, the client launches a local server process. Record the executable, arguments, working directory, and how credentials enter that process. A remote URL is not a substitute for a stdio command.
- For Streamable HTTP, record the supplied MCP endpoint, TLS and authentication settings, and the client's support for that transport. Confirm the client can complete initialization and discover tools.
- Review the actual tool list against the workflow's allowlist. Start with one bounded read, then test a denied operation and a connection failure. Do not assume the client supports every transport or protocol version.
Evaluation: prepare an incident handoff
Choose a known incident and the approved fields, references, and knowledge needed for a handoff. Keep unrelated incidents and restricted fields outside the initial scope.
- Inspect the connected identity and tool list, then request a briefing for the known incident.
- Compare the briefing with source records, including missing or unavailable context.
- Request a restricted field and an out-of-scope record; confirm neither is disclosed.
- Review what the MCP host and model provider receive and retain before adding more users or data.
Scope of this example
Begin with retrieval. Any create or update tool needs an explicit permission and a separate review of business rules and side effects. A shared integration account does not establish each end user's right to see a record.
Validate before expanding
- The agent returns an answer that can be checked against the approved source data.
- Out-of-scope requests do not expose restricted records or fields.
- The effective connection identity and authorization boundary are documented.
- Tool operations, client data handling, and review responsibilities are understood.
Keep a deployment record
Record the package version, environment, data scope, test date, expected result, actual result, and owner of each unresolved issue. Keep secrets and customer data out of shared support notes.
Everyday operations
After each run
Review completion status, record counts, failures, and source API usage. Resolve unexpected differences before allowing the next dependent action.
When credentials change
Update the connection through the approved secret process, verify a bounded read, and retest the required operations. Remove obsolete credentials.
When the source changes
Review added or changed objects, fields, access rules, and automation. Repeat representative data and permission checks before expanding the scope.
Before an upgrade
Record the current package and configuration, protect persistent data, and define the rollback procedure. Validate connectivity and a representative workflow after the change.
Troubleshooting
The client cannot connect
Check the confirmed endpoint, supported transport, network reachability, and authentication configuration. Do not substitute an unverified public endpoint.
The answer is incomplete or stale
Compare the permitted dataset, filters, source freshness, and any retained copy. Distinguish unavailable data from an incorrect model interpretation.
The agent can access more than intended
Disable the connection for the initial deployment and review the service account, tool scope, and authorization boundary before reconnecting.
SQL Server connections fail or time out
Check the instance address, listener port, network route, authentication mode, certificate trust, and connection account. Separate connection failure from schema or write permission errors.
Technical references
Use these official references for the source APIs, database connection settings, and runtime behavior discussed above. They describe the underlying platforms; use your Vivly package documentation for its installation and supported configuration.
Review this deployment with Vivly
Bring your source scope, host, database, and success criteria. We will use them to identify the applicable package, open questions, and rollout sequence.
Book a demo