ServiceNow
Connect Cardinal to ServiceNow for AI-powered ITSM querying — incidents, changes, CMDB, knowledge articles, and the service catalog.
Overview
With the ServiceNow integration, the AI agent can:
- Query incidents — search, filter, and summarize active and historical incidents
- Browse change requests — review upcoming and recent changes
- Search the CMDB — find configuration items and understand service dependencies
- Access knowledge articles — surface relevant documentation and runbooks
- Explore the service catalog — browse available service offerings
Capabilities
| Capability | Enabled |
|---|---|
| Agent | Always |
Configuration
Settings
| Field | Required | Description |
|---|---|---|
| Instance URL | Yes | Base URL for your ServiceNow instance (e.g., https://yourinstance.service-now.com) |
The instance URL must use HTTPS and end with .service-now.com or .servicenowservices.com.
Credentials
| Field | Required | Description |
|---|---|---|
| Username | Yes | Service account username (e.g., svc_cardinal) |
| Password | Yes | Service account password |
Authentication uses HTTP Basic Auth.
Egress Proxy (optional)
If your network requires outbound HTTPS to traverse a corporate egress proxy, configure it per integration. Leave these fields empty for a direct connection (the default).
| Field | Required | Description |
|---|---|---|
| Proxy URL | No | HTTPS egress proxy URL (e.g., http://proxy.acme.internal:8080). When set, all ServiceNow traffic — including the Test Connection check — is tunneled through this proxy. |
| Proxy Username | No | Only required if your proxy enforces authentication. |
| Proxy Password | No | Only required if your proxy enforces authentication. |
When a proxy URL is configured, both the Cardinal runtime (in mcp-gateway) and the Test Connection flow (in maestro) honor it on every request to ServiceNow. No other Cardinal egress is affected — this setting is scoped to the ServiceNow integration only.
TLS interception
If your proxy performs TLS inspection (re-signs upstream certificates with a corporate root CA), you must additionally trust that CA inside the Cardinal containers — proxy URL alone is not enough. Mount the CA bundle and set:
SSL_CERT_FILE=/path/to/corp-ca.pemfor themcp-gatewaycontainer (Go)NODE_EXTRA_CA_CERTS=/path/to/corp-ca.pemfor themaestrocontainer (Node)
Without this, every TLS handshake to ServiceNow fails with an unknown-CA error. Coordinate with your operator if you’re unsure whether the proxy intercepts TLS.
Prerequisites
- A ServiceNow instance with API access enabled
- A service account with read access to the tables you want the agent to query (incidents, changes, CMDB, knowledge, etc.)
- Network access from Cardinal to your ServiceNow instance (ensure any IP allowlists include Cardinal’s egress IPs)
Recommended Service Account Roles
Create a dedicated service account with read-only roles:
itil— read access to incident and change managementcmdb_read— read access to the CMDBknowledge— read access to knowledge articlescatalog— read access to the service catalog
Setup
- Navigate to Settings > Integrations and click Add Integration
- Select ServiceNow
- Enter your Instance URL (e.g.,
https://yourinstance.service-now.com) - Enter the Username and Password for your service account
- Click Test Connection to verify access
- Click Save
What This Enables
Once configured, you can ask the AI agent questions like:
- “Show me all P1 incidents from the last 24 hours”
- “Are there any change requests scheduled for this weekend?”
- “What does the runbook say about restarting the payment gateway?”
- “Find the CI record for the production database server”
Reach out to support@cardinalhq.io for support or to ask questions not answered in our documentation.