> This page is for Agent Studio. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.moveworks.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server. # ServiceNow MCP: Knowledge Graph > **Controlled Availability** > > MCP Workspace is available to a limited set of customers. Moveworks is validating the experience and gathering feedback, so capabilities and limits may change. To request access, [register your interest](https://community.moveworks.com/p/mcp-workspace-controlled-availability). ServiceNow **Knowledge Graph** gives AI relationship-aware access to live data on your instance. With MCP Server Console, you can expose a Knowledge Graph as an MCP tool. Once that server is connected to MCP Workspace, the assistant can answer natural language questions over your ServiceNow data, such as "Which open P1 incidents are tied to vendors with an expiring contract?" This is a good fit when employees need answers that span several related tables, or when you've brought external data into ServiceNow with Workflow Data Fabric and Zero Copy connectors. This guide walks through the full setup end to end: 1. **Choose a schema** and prepare it: Enterprise Graph with tags, or a custom graph. 2. **Create a Knowledge Graph tool and an MCP server** in ServiceNow's MCP Server Console. 3. **Create an OAuth inbound integration** so Moveworks can authenticate. 4. **Connect the server** in Moveworks MCP Workspace, test, and launch. > **ServiceNow's documentation is the source of truth** > > ServiceNow updates Knowledge Graph and MCP Server Console regularly, so each ServiceNow step below links to the matching ServiceNow page. If what you see on your instance differs from this guide, follow ServiceNow's docs. Start with [Create a tool from a Knowledge Graph](https://www.servicenow.com/docs/r/intelligent-experiences/create-a-tool-from-knowledge-graphs.html). ## Before You Start ### Prerequisites **ServiceNow** * An instance with **MCP Server Console** and **Knowledge Graph**. * If you're querying external data: Workflow Data Fabric with **Zero Copy connectors** set up and data fabric tables created. * A user with **admin** (to create Knowledge Graph tags or graphs), **sn\_mcp\_server.tools\_admin** or **sn\_mcp\_server.admin** (to create tools and servers), and **oauth\_admin**, **mi\_admin**, or **admin** (to create the OAuth integration). **Moveworks** * MCP Workspace enabled for your organization. * Agent Studio admin access. ### How Access Works Knowledge Graph tools respect ServiceNow security. ACLs are enforced at the node (table) level as the graph is traversed, so **two employees can get different results for the same question**. With per-user OAuth, each employee only sees records they can already see in ServiceNow. See the access control section of ServiceNow's [Creating tools for a Model Context Protocol server](https://www.servicenow.com/docs/r/intelligent-experiences/creating-tools-mcp-server.html). ## Step 1: Choose and Prepare a Knowledge Graph Schema The Knowledge Graph tool can use the out-of-the-box **Enterprise Graph** or a **custom graph** you build in Knowledge Graph Designer. > **ServiceNow reference** > > [Enterprise Graph schema overview](https://www.servicenow.com/docs/r/intelligent-experiences/knowledge-graph/global-graph-schema.html) and [Create Knowledge Graph tags](https://www.servicenow.com/docs/r/intelligent-experiences/knowledge-graph/create-knowledge-graph-tags.html) | Schema | What it searches | Best for | | ---------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------ | | **Enterprise Graph** | All instance tables, prioritizing tagged tables. Tags are required. | Broad questions across many tables (more than 50) | | **Enterprise Graph (Small)** | Only tagged tables, up to 50. Tags are required. | Focused use cases where speed matters | | **Custom graph** | Only the tables you add in Knowledge Graph Designer. | A specific domain, or data fabric tables from Zero Copy connectors | ### Option A: Enterprise Graph with Tags A **tag** is a named list of the tables that matter for a use case (for example, HR or Vendor Management). Tags tell Enterprise Graph which tables to prioritize, and let you add business context that improves query accuracy. Follow ServiceNow's [Create Knowledge Graph tags](https://www.servicenow.com/docs/r/intelligent-experiences/knowledge-graph/create-knowledge-graph-tags.html). In summary: 1. Go to **Knowledge Graph Designer > Enterprise Graph Tags** and select **New tag**. 2. Enter a **Tag name** and **Description**, then under **Select Tables** choose the tables for this use case. 3. Select **Next**, then configure each table: * **Synonyms:** Up to five alternative names per table, column, or relationship. For example, add "Tickets" for the Incident table. * **AI Instructions:** Up to five instructions per table, column, or relationship that give the query engine business context. Select **Always include** to apply one to every query. * **Data filters:** For example, `Active = true` to exclude inactive users. * **Hidden columns:** Exclude columns that shouldn't be queried or returned, such as employee numbers. 4. Select **Create tag**. 5. Write down the tag name. You'll reference it when you create the tool. ### Option B: Custom Graph Use a custom graph when you want the tool limited to a specific set of tables, such as data fabric tables created from a Zero Copy connector. 1. Go to **Knowledge Graph Designer** and create a new graph with a clear name (for example, `Vendor Risk Knowledge Graph`). 2. Add each table as a node. For external data, choose **Data Fabric Table** as the node type. 3. For each node, add a **Description**, **Synonyms**, and the **Queryable columns** the assistant can use. 4. If the graph has more than one table, define the relationships between them and describe how to query one table using another (for example, "Find incidents using the Vendor ID from the Vendor table"). 5. Test the graph in Knowledge Graph Designer before moving on. ## Step 2: Create a Knowledge Graph Tool and MCP Server in ServiceNow > **ServiceNow reference** > > [Create a tool from a Knowledge Graph](https://www.servicenow.com/docs/r/intelligent-experiences/create-a-tool-from-knowledge-graphs.html) and [Create a Model Context Protocol server](https://www.servicenow.com/docs/r/XRgEFx7nPN6ciT_BBIvnbg/a2CY_8UaP1y3J_5_ry5NCQ) ### Create the MCP Server If you already created a ServiceNow MCP server for Subflows and Actions, you can add the Knowledge Graph tool to that server instead. 1. Go to **Admin > MCP Server Console**. ![image](https://files.buildwithfern.com/visual-editor-images/docs.moveworks.com/2026-10-15T01:50:06.321Z/agent-studio/mcp-workspace/connect-a-servicenow-mcp-server/image.png "image") 2. On the **Configuration** tab, select **Servers**, then select **Create server**. ![image](https://files.buildwithfern.com/visual-editor-images/docs.moveworks.com/2026-10-15T01:50:30.232Z/agent-studio/mcp-workspace/connect-a-servicenow-mcp-server/image.png "image") 3. Enter a **Label** (for example, `Vendor Data`) and a **Short description** of what the server can answer. The **Name** is generated from the label and becomes part of the server URL. For the full field list, see ServiceNow's [Create a Model Context Protocol server](https://www.servicenow.com/docs/r/XRgEFx7nPN6ciT_BBIvnbg/a2CY_8UaP1y3J_5_ry5NCQ). ### Add the Knowledge Graph Tool 1. In the **Tools** section of the server form, select **Add tools**. 2. Select **Create tool**, then choose **Knowledge Graph**. ![image](https://files.buildwithfern.com/visual-editor-images/docs.moveworks.com/2026-10-15T01:50:49.874Z/agent-studio/mcp-workspace/connect-a-servicenow-mcp-server/image.png "image") 3. Fill in the tool fields below. ServiceNow documents these fields in [Create a tool from a Knowledge Graph](https://www.servicenow.com/docs/r/intelligent-experiences/create-a-tool-from-knowledge-graphs.html). 4. Review the **Tool inputs** section (see below). 5. Select **Create**, then select the tool and select **Add**. 6. Back on the server form, select **Create** to activate the server. 7. Copy the **Server URL**. It looks like `https://.service-now.com/sncapps/mcp-server/mcp/`. You'll need it in Step 4. | Field | Value | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Knowledge Graph** | **Enterprise Graph**, **Enterprise Graph (Small)**, or your custom graph. | | **Label** | A short name for the tool. | | **Description** | What data the tool can answer questions about and when to use it. The assistant relies on this to pick the right tool. If you use Enterprise Graph, name the tag the assistant should use. | | **Annotations** | Defaults to **Read Only**. Keep it, since Knowledge Graph tools only read data. | | **Required roles** | Optional. Roles allowed to use the tool. Employees without these roles can't use it. | #### Tool Inputs The assistant fills in these inputs when it calls the tool. You can turn off optional inputs you don't want it to set. | Input | What it does | Recommendation | | -------------- | --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | `description` | The natural language question to run against the graph. | Required. Leave on. | | `tags` | Tags that prioritize a group of tables. Required for Enterprise Graph and Enterprise Graph (Small). | Leave on for Enterprise Graph. | | `anchortables` | Optional table names that narrow the query (Enterprise Graph only). | Optional. | | `apioptions` | JSON options that control results, such as `resultLimit` (default 10) and `getExplanation`. | Optional. Turn off if you want ServiceNow defaults every time. | > **Write descriptions for the assistant, not for admins** > > * ❌ "Vendor KG" > * ✅ "Answers questions about suppliers, their contracts, and related incidents, such as contract end dates, risk ratings, and open issues by vendor. Use the `vendor_management` tag. Use when someone asks about a vendor or supplier." > **Tools can be shared across servers** > > Editing a tool's name, description, or inputs changes it on every server that uses it. See [Creating tools for a Model Context Protocol server](https://www.servicenow.com/docs/r/intelligent-experiences/creating-tools-mcp-server.html). ## Step 3: Create an OAuth Inbound Integration in ServiceNow If you already set this up for another ServiceNow MCP server, you can reuse the same integration and skip to Step 4. > **ServiceNow reference** > > [Create an OAuth inbound integration for an MCP client](https://www.servicenow.com/docs/r/intelligent-experiences/create-oauth-inbound-integration-mcp-client.html) 1. In **MCP Server Console**, select **Set up OAuth** in the banner. You can also go to **All > Machine Identity Console** and open the **Inbound integrations** tab. ![image](https://files.buildwithfern.com/visual-editor-images/docs.moveworks.com/2026-10-15T01:51:23.880Z/agent-studio/mcp-workspace/connect-a-servicenow-mcp-server/image.png "image") 2. Select **New integration**, then choose **OAuth - Authorization code grant**. 3. Fill in the fields below. 4. Select **Save**. If prompted to assign an auth scope, select **Skip for now**. 5. Copy the **Client ID** and **Client Secret** and store them securely. | Field | Value | | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | For example, `Moveworks MCP OAuth` | | **Redirect URLs** | Your Moveworks callback URL. For the US data center, use `https://.moveworks.com/auth/oauthCallback`. For other data centers, see [OAuth 2.0 Authorization Code](/agent-studio/connectors/http-connectors/oauth-20-authorization-code). | | **Auth scope > Allow access only to APIs in selected scope** | Leave **cleared**. If selected, Moveworks can't fetch tools from the server. | | **Advanced options > Token Format** | **JWT** | | **Active** | Selected | > **Token Format must be JWT** > > ServiceNow MCP servers reject opaque tokens. This is the most common cause of authentication errors. Also, don't reuse integrations that share a server's name (with underscores). ServiceNow creates those for AI Control Tower monitoring. ## Step 4: Connect the Server in Moveworks If you already created an HTTP connector for ServiceNow MCP, reuse it and skip to **Add the MCP Server**. ### Create an HTTP Connector 1. In **Agent Studio**, open **Connectors** and select **Create**. ![image](https://files.buildwithfern.com/visual-editor-images/docs.moveworks.com/2026-10-15T01:51:44.386Z/agent-studio/mcp-workspace/connect-a-servicenow-mcp-server/image.png "image") 2. Fill in the fields below, then select **Save**. | Field | Value | | --------------------------------- | ----------------------------------------------------------- | | **Connector Name** | For example, `servicenow_mcp`. This can't be changed later. | | **Base URL** | `https://.service-now.com` | | **Auth Config** | OAuth2 | | **OAuth2 Grant Type** | Authorization Code Grant | | **Authorization URL** | `https://.service-now.com/oauth_auth.do` | | **Client ID** / **Client Secret** | From Step 3 | | **OAuth2 Token URL** | `https://.service-now.com/oauth_token.do` | | **PKCE** | PKCE using SHA256 code challenge | ### Add the MCP Server 1. In **Agent Studio**, open **MCP Servers** and select **Create**. ![image](https://files.buildwithfern.com/visual-editor-images/docs.moveworks.com/2026-10-15T01:52:03.935Z/agent-studio/mcp-workspace/connect-a-servicenow-mcp-server/image.png "image") 2. Select **Custom Server**. 3. Enter a **name** and **description**. Describe what data employees can ask about, and note that the server is read-only. 4. In the URL field, enter `https://.service-now.com` with no trailing slash. 5. In the **Path** field, enter `/sncapps/mcp-server/mcp/` from the Server URL you copied in Step 2. 6. Under the connector section, choose **Inherit from existing connector** and select your ServiceNow connector. 7. Select **Authenticate** and sign in to ServiceNow. Select **Allow** when prompted. 8. In the **Tools** section, select **Preview Tools**. You should see your Knowledge Graph tool. ### Set the Tool Approval Policy Knowledge Graph tools are read-only, so the default **Follow server guidance** policy typically lets them run without asking the employee each time. Tools run without approval only when they're marked read-only, non-destructive, and not open world. If you put write-capable Subflow or Action tools on the same server, consider **Always ask user**. ### Publish and Launch 1. Select **Publish**. 2. Make sure the server is **Enabled**. 3. In **Launch Configuration**, start with a small pilot audience. For more detail, see [Connect and Manage Servers](/agent-studio/mcp-workspace/connect-and-manage-servers). ## Step 5: Test End to End 1. Open the assistant as a user in your pilot audience. 2. Ask a question your graph should answer, for example: *"Which of our vendors have contracts ending in the next 90 days, and do any of them have open incidents?"* 3. The user should be asked to authenticate to ServiceNow. 4. Confirm the assistant calls the Knowledge Graph tool and the answer matches what you see in ServiceNow. 5. **Test with a non-admin employee.** Because ACLs apply at the node level, results depend on who's asking. Make sure regular employees see what they should, and nothing they shouldn't. 6. Review [MCP tool call logs](/agent-studio/mcp-workspace/view-mcp-tool-call-logs) to see the query the assistant sent and the results returned. > **Tip** > > If answers are inaccurate, improve the graph rather than the prompt: add synonyms, AI instructions, data filters, or hidden columns in your tag or custom graph. Changes apply on the next tool call. ## Troubleshooting | Symptom | What to check | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Answers pull from the wrong tables or miss records | Check the tag includes the right tables, and add synonyms and AI instructions. Consider Enterprise Graph (Small) or a custom graph to narrow the scope. See ServiceNow's [Create Knowledge Graph tags](https://www.servicenow.com/docs/r/intelligent-experiences/knowledge-graph/create-knowledge-graph-tags.html). | | Tool call fails with a missing tags error | Enterprise Graph requires the `tags` input. Make sure it's enabled and the tool description names the tag to use. See ServiceNow's [Create a tool from a Knowledge Graph](https://www.servicenow.com/docs/r/intelligent-experiences/create-a-tool-from-knowledge-graphs.html). | | Admins get results but employees get empty answers | Expected if employees lack access to those tables or records. Check the tool's **Required roles** and the table ACLs. See the access control section of ServiceNow's [Creating tools for a Model Context Protocol server](https://www.servicenow.com/docs/r/intelligent-experiences/creating-tools-mcp-server.html). | | Only 10 results come back | `resultLimit` defaults to 10. Leave `apioptions` enabled so the assistant can raise it, or ask more specific questions. | | Tool call times out | Tool calls are limited to about 60 seconds. Use Enterprise Graph (Small) or a custom graph with fewer tables. | | Authentication fails or Preview Tools returns no tools | Confirm **Token Format** is **JWT**, the OAuth integration isn't limited to a selected API scope, the redirect URL matches your data center, and the **Path** matches the server name. See ServiceNow's [Create an OAuth inbound integration for an MCP client](https://www.servicenow.com/docs/r/intelligent-experiences/create-oauth-inbound-integration-mcp-client.html). | ## Related ServiceNow Docs * [Create a tool from a Knowledge Graph](https://www.servicenow.com/docs/r/intelligent-experiences/create-a-tool-from-knowledge-graphs.html) * [Create Knowledge Graph tags](https://www.servicenow.com/docs/r/intelligent-experiences/knowledge-graph/create-knowledge-graph-tags.html) * [Enterprise Graph schema overview](https://www.servicenow.com/docs/r/intelligent-experiences/knowledge-graph/global-graph-schema.html) * [Creating tools for a Model Context Protocol server](https://www.servicenow.com/docs/r/intelligent-experiences/creating-tools-mcp-server.html) * [Create a Model Context Protocol server](https://www.servicenow.com/docs/r/XRgEFx7nPN6ciT_BBIvnbg/a2CY_8UaP1y3J_5_ry5NCQ) * [Create an OAuth inbound integration for an MCP client](https://www.servicenow.com/docs/r/intelligent-experiences/create-oauth-inbound-integration-mcp-client.html)