What I Built

I connected an orchestration tool I'm building directly to a ServiceNow instance using a custom MCP server — 27 purpose-built tools spanning incident management, change requests, catalog operations, CMDB queries, flow execution, and more. Then I ran a full instance benchmark and stored the findings as persistent AI memory.

The result is an AI that doesn't just know how to use ServiceNow — it knows your ServiceNow. Your backlog. Your users. Your automation health. Your custom apps. And it retains that knowledge across every conversation.

This post covers what that means technically, and what it unlocks at a business level.

The Technical Picture

Architecture

The integration sits between the tool and ServiceNow's REST layer. A Python FastMCP process exposes a structured tool set — the AI calls these tools the same way it calls any other capability. No special prompting required. No manual API calls.


Orchestration tool (Claude) → MCP Server (Python FastMCP) → ServiceNow Table REST API

The tool set covers five domains:

1. Incident & Case Operations

Query, search, assign, update, and close incidents by number or field criteria. Bulk operations work natively — assigning 5 incidents in parallel is a single conversation turn.

2. Generic Record Operations

Read, create, update, and delete any record in any ServiceNow table. The AI isn't limited to incidents — it can work with users, groups, catalog items, change requests, CMDB CIs, or any custom table.

3. Aggregate Intelligence

Count, sum, average, and group-by queries against any table. "How many open P1s are unassigned?" is an instant query, not a report-building exercise.

4. Flow Execution

Trigger Flow Designer flows by name with arbitrary input parameters. Business process automation becomes conversational — describe what you need, the AI invokes the flow.

5. Attachments

List and retrieve file attachments on any record. Relevant for incidents with logs, change requests with implementation plans, or catalog items with documentation.

What the Benchmark Revealed

Once connected, the system runs a full-instance scan — parallel queries across the platform's major object types — and assembles a complete operational picture in seconds. Instead of a person pulling one report at a time, the AI reads the whole environment at once: the security configuration, the automation layer, in-flight processes, the change pipeline, the CMDB, and the user and catalog landscape.

The valuable part isn't any single number — it's what the scan surfaces that normally stays invisible until an audit: automation that's silently stuck, approvals aging in a queue, configuration drift. And because the results are stored as persistent memory, every future conversation starts from that baseline instead of rediscovering it.

The Executive View

The Problem It Solves

ServiceNow is a powerful platform. It's also a system that rewards those who know how to query it — and punishes those who don't. Most workers interact with the surface: the portal, the inbox, the assigned queue. The deeper picture — stuck flows, aging approvals, CMDB drift, automation health — lives in reports that nobody runs daily.

An AI connected to the live platform changes the information flow entirely.

A True Instance Health Check

For leadership, the biggest shift is a genuine health check on the platform. Most organizations gauge their ServiceNow instance by anecdote — what's escalated recently, what a vendor reports, what last quarter's project delivered. A live scan replaces that with an honest, current read on how the instance is actually running: where automation is healthy, where governance is drifting, and where adoption is strong or thin.

That read gives leadership two things they rarely have for their platform: a true maturity level to measure against, and a roadmap grounded in reality. Instead of guessing where to invest next, you can see which areas are mature and which need attention — and prioritize the roadmap around what the instance actually needs rather than what's loudest in the room.

What Changes for Workers

Technicians and IT Staff

Time spent navigating to the right list, building a filter, and exporting data collapses to a question. "Which incidents assigned to my team have been open more than 3 days?" is a conversation, not a reporting task. Bulk updates — reassignments, state changes, work note additions — happen in one message instead of record by record.

Team Leads and Managers

Backlog visibility becomes instant. An AI that monitors incident counts, flow health, and change approval queues can surface issues before they become escalations. The kind of silently-stuck automation and aging approvals a scan like this surfaces? A connected AI catches them in real time — not during a monthly audit.

Platform Administrators

Interrogating the instance's configuration — ACLs, business rules, update set hygiene, custom app activity — no longer requires Studio or background scripts. Questions about what's running, what's active, what's changed recently are answerable in conversation.

Leadership

ITSM health becomes a conversational dashboard. "What's our incident resolution rate this week?" or "Are there any critical flows stuck right now?" have live, instant answers — not answers that require a PA report to be scheduled and delivered.

The Compounding Value of Persistent Memory

This is where the architecture separates from a standard integration. Each time the AI works in the instance, it can update its own memory. The benchmark is the starting point — over time, the system learns:

  • What "normal" looks like for this specific instance
  • Which users are active, which groups handle which request types
  • Where automation tends to break
  • What the custom application does and how it's configured

That memory makes every subsequent interaction faster, more accurate, and more context-aware. It's the difference between an AI that can access ServiceNow and one that knows ServiceNow.

What's Possible Next

The connection opens a set of capabilities that previously required dedicated engineers, scheduled jobs, or third-party integrations:

| Capability | What It Looks Like |

|------------|-------------------|

| Proactive backlog monitoring | "Alert me if any P1 goes unassigned for more than 15 minutes" |

| Automated triage | Incoming incidents auto-categorized and assigned based on description |

| Flow health monitoring | Daily check on stuck executions, with root cause summary |

| Change request acceleration | Draft implementation plans, auto-populate standard fields |

| CMDB auditing | Flag CIs missing relationships, stale software records, untracked hardware |

| Onboarding automation | New user provisioned, groups assigned, catalog access granted — conversationally |

| Executive reporting | Weekly ITSM summary delivered as a brief, not a spreadsheet |

None of these require new integrations or platform licenses. They run on the connection that already exists.

Why This Matters Beyond ServiceNow

The pattern here isn't specific to ServiceNow. Any system with a REST API can become an AI-native platform using the same architecture: a structured MCP tool set, a persistent memory layer, and an AI that learns the specific instance it's connected to.

ServiceNow is a compelling starting point because it sits at the center of operations for most enterprise IT organizations. But the same approach applies to Salesforce, Jira, SAP, Workday — any platform where workers spend significant time navigating data rather than acting on it.

The shift is from AI as a productivity tool to AI as an operational participant. One that knows your systems, remembers what it learned, and gets better at your environment over time.

That's not a future capability. It's running now.