Connect ServiceNow

Nexatron connects to your ServiceNow instance once and answers as the signed-in person: every question runs under that person's own ServiceNow login, so ServiceNow applies their real roles and ACLs and Nexatron never sees a record they cannot open themselves. There is no shared service account.

If your instance runs the MCP Server Console, questions use it; otherwise — or whenever the console is unreachable or publishes nothing Nexatron can use — questions use the instance's Table API. You do not pick: Nexatron chooses when it tests the connection and tells you which one it is using. Incident write-back always goes through the Table API as governed actions you confirm first.

Setup has two halves: a workspace admin creates the connection once, then each person connects their own ServiceNow login.

What you need

• A ServiceNow instance. Nothing to install for the Table API. For the MCP Server Console, the Model Context Protocol Server store app on Australia Patch 2 or later (it is not available on developer instances) and a published server — the out-of-the-box Quickstart Server is the smoothest path.
• Rights to register an OAuth application on the instance (oauth_admin, mi_admin, or admin).
• A Nexatron workspace admin (the tenant_admin role) to create the connection.

Workspace admin: create the connection

1. On the instance, note the instance address (https://<instance>.service-now.com). If you will use the MCP Server Console, also copy the server's Server URL from MCP Server Console → Servers (it looks like https://<instance>.service-now.com/sncapps/mcp-server/mcp/<server-name>).
2. Register an OAuth application under System OAuth → Application Registry: grant type Authorization Code with refresh tokens, PKCE supported, scope useraccount. Note the client id. Either tick Public Client (then Nexatron needs no secret) or note the secret as well. If you will use the MCP Server Console, set Token Format to JWT — with Opaque the server signs you in but publishes no tools. Leave the redirect URL for step 4.
3. In Nexatron, go to Connections → New connection → Business apps → ServiceNow. Enter the instance URL, the MCP Server Console URL if you have one (leave it blank otherwise), and the OAuth client id (and secret unless the application is a Public Client), then save.
4. Open the new connection's page and copy the redirect URL shown on the Connect card. Paste it into the OAuth application's Redirect URL on the instance. The URL is unique to this connection; do not compose it by hand.

That is the whole admin setup. Creating the connection signs no one in.

Everyone: connect your own login

1. In Nexatron, open Settings → Connected accounts. Every role can open it.
2. Find the ServiceNow connection and choose Connect ServiceNow.
3. Sign in and consent on your ServiceNow instance. You are returned to Nexatron and the card shows your ServiceNow identity.

From then on your questions about ServiceNow run under your own login, with the token refreshed automatically. You can Disconnect from the same card at any time; Nexatron revokes the sign-in on the instance as well.

If you ask a question before connecting, Nexatron tells you so and points you to Connected accounts. Your workspace admin can see who has connected on the connection's page, but never anyone's tokens.

What Nexatron will ask ServiceNow

Run the readiness check on the connection's page: its detail names the transport in use.

Over the MCP Server Console, Nexatron calls a curated read-only set (apart from which nothing is called) of the tools your server publishes: today the four verified Quickstart Server tools for incident and case lookup and summarization. A tool outside that set is never called, and if the server publishes only such tools, Nexatron answers over the Table API instead and says so. Extending the set is a Nexatron change, never a workspace setting, so no workspace can authorize a write tool by itself. Publish read tools only on the instance as defense in depth.

Over the Table API, Nexatron reads a fixed set of tables — incidents, requests and requested items, changes, problems, tasks, users, groups, configuration items and knowledge — with display values, so answers show names rather than ids. A question about a table outside that set is declined, and the refusal lists what is covered.

Writing back

Unless your workspace admin has switched actions off, you can ask Nexatron to open an incident (servicenow.incident.create), change its urgency, impact, state, category or assignment (servicenow.incident.update), add a work note or a comment the caller can see (servicenow.incident.add_note), or resolve it with a close code and notes (servicenow.incident.resolve). Each request shows you a card first: what will happen, what else it triggers (caller and assignment-group notifications, business rules, the resolution SLA), and a Confirm and run button. Nothing is written until you confirm, and the write runs as you, with your own ServiceNow roles — if you cannot edit an incident in ServiceNow, Nexatron cannot either. Writes use the Table API whichever transport answers your questions. Nothing else is writable.

Least privilege

Each person's token carries that person's ServiceNow roles. Give analytics users read access to the tables the tools cover, and keep write roles for the people who need them.

Troubleshooting

Symptom	Cause
"We can't reach ServiceNow as you"	You have not connected your login under Settings → Connected accounts
ServiceNow rejects the redirect URL	The Application Registry redirect URL does not exactly match the one shown on the connection's Connect card
Connecting ends with "access_denied" right after you allow it	The application expects a client secret Nexatron does not have; tick Public Client on the application, or have your admin enter the secret on the connection
"must be a *.service-now.com host" when saving	Instances behind a custom URL or self-hosted instances need a Nexatron operator setting; contact support
Readiness says the MCP endpoint is configured but not used	The console is not installed, the server URL is wrong, the application's Token Format is Opaque, or the server publishes only tools outside the curated read-only set (apart from which nothing is called); the detail says which, and questions still work over the Table API
An incident action is declined with a ServiceNow 403	Your ServiceNow roles do not allow that change; ask your ServiceNow administrator
You are asked to consent again and again	Refresh-token issuance is disabled on the OAuth application; enable it