Choose how to connect external systems to Moveworks

Suppose you have an external system that employees need to use from a Moveworks AI Assistant, whether they access it through Employee Web, Slack, Microsoft Teams, or another channel. Should you connect the system directly to Moveworks, or connect it to Moveworks through ServiceNow?

This guide helps you answer that question. It covers four ways to make an external system available in a Moveworks AI Assistant:

Use Enterprise Search to make documents and knowledge searchable.
Connect an MCP server through MCP Workspace in Agent Studio.
Connect through ServiceNow via MCP when ServiceNow already provides a suitable workflow or access to the data.
Build a Moveworks plugin in Agent Studio.

If the experience will live in ServiceNow instead of a Moveworks AI Assistant, connect the external system directly to ServiceNow. That scenario is outside the scope of this guide.

This is a lightweight framework to help you compare the options available to connect your Moveworks AI Assistant to external tools. You can read our full guide on the different tools available to learn more about each of the options.

Understand the connection strategies

In every strategy, the employee interacts with a Moveworks AI Assistant. What changes is the path between the assistant and the external system.

Enterprise Search

Enterprise Search retrieves unstructured content such as documents, files, and knowledge articles. Configure an Enterprise Search connector to either index content from the external system in Moveworks or perform a real-time search.

Depending on the connector’s implementation approach, authentication uses administrator-configured credentials or user consent.

MCP server through MCP Workspace

An MCP server is a set of tools that AI assistants can call through the open Model Context Protocol to work with structured data. The same server may work with Moveworks and other MCP-compatible assistants. An administrator can connect an existing server through MCP Workspace in Agent Studio, or a developer can build a custom server when needed. Employees consent to the connection and sign in with their account in the connected system.

For current availability and access details, see MCP Workspace.

MCP Servers are recommended for read operations, or reversible operations (like changing the status of an item). We do not recommend using MCP servers for destructive operations.

Be aware that:

MCP Workspace does not provide a confirmation step before calling a tool, so a write (including a destructive action) can run without approval.
MCP Workspace controls access at the server level, not per tool. When a server is enabled, the Moveworks AI Assistant can use any tool the server exposes to an employee under that employee’s upstream permissions. Review the full tool inventory before enabling the server.
Unlike a Moveworks plugin, an MCP server connected through MCP Workspace does not use Moveworks slots to guide how the Assistant collects inputs.

ServiceNow through MCP

Moveworks connects to a ServiceNow MCP server through MCP Workspace to access structured data or actions. A ServiceNow administrator configures the connection and publishes the tools that ServiceNow exposes.

The employee signs in with their ServiceNow account, and the Assistant calls the published tool. If the tool calls a third-party system, the downstream identity depends on the underlying workflow and connection configuration.

Use this option for reads and reversible writes only. Do not use ServiceNow through MCP for destructive writes, based on the same considerations as any MCP server.

Moveworks plugin

Developers can build a plugin in Agent Studio that connects to structured data and actions through an external system’s API. The connection can use each employee’s consent and OAuth sign-in or connector credentials.

Slots define the inputs the plugin needs. For each slot, the developer can tell the Assistant to infer a value or always ask for it, validate the value, and use a resolver to match it to a record in the external system.

The plugin can read data or perform reversible and destructive writes. It can apply company rules, ask for confirmation, and coordinate multiple actions before calling the external system.

Compare capabilities

Your use case will narrow the available strategies. Start with four questions:

What kind of data does the Assistant need?
Whose credentials should the connection use?
Can you configure an existing connection, or do you need to build one?
Does the Assistant need to read data, change it, or both?

Strategy	Data type	Authentication	What you configure or build	Operations
Enterprise Search	Unstructured	Connector credentials or user consent, depending on the connector and search mode	Configure an Enterprise Search connector	Read
MCP server	Structured	User consent	Configure an MCP server connection; build a custom server if needed	Read, reversible write
ServiceNow through MCP	Structured	User consent to ServiceNow; downstream identity depends on the workflow and connection configuration	Build and publish a ServiceNow MCP tool backed by a workflow or data access	Read, reversible write
Moveworks plugin	Structured	User consent or connector credentials	Build a plugin in Agent Studio	Read, reversible write, destructive write

MCP servers define what inputs a tool accepts. In a plugin, you define and control how inputs are collected, resolved, and validated.

With MCP, the Moveworks AI Assistant works from the input schema exposed by the server and may infer values from the employee’s request. When you connect to an MCP server, you also depend on the tool definitions and behavior that server provides.

With a Moveworks plugin, you own the tool and can use slots, resolvers, policies, and confirmation to put explicit guardrails around each input and action.

For a deeper comparison, see Choosing the right tool framework.

Choose a connection pattern

Use the flow below to choose a connection strategy.

Recommendations

Treat actions that change data differently from reads

Use MCP (including ServiceNow through MCP) for reads and low-impact writes that are easy to undo.

For destructive writes and high-stakes workflows, use a plugin. See Choosing the right tool framework for more guidance.

Decide whose account performs the action

An MCP connection uses each employee’s account in the connected system. A plugin can use each employee’s account or connector credentials.

When connecting through ServiceNow, the MCP call uses the employee’s ServiceNow account, but the workflow and downstream connection may use different identities. Test which identity and permissions each system records.

Anti-patterns

Using ServiceNow only as an extra hop: connect through ServiceNow only when it already provides a suitable workflow or access to the data.
Enabling an MCP server without checking every tool: MCP Workspace cannot enable or disable individual tools. Inspect the full tool inventory during testing, including with representative users.
Expecting MCP to add plugin safeguards: an MCP connection does not add Moveworks input checks or confirmation. Use a plugin when the process requires these safeguards.