ServiceNow's AI Gateway reaches general availability with controls on MCP servers

Model Context Protocol, or MCP, is the open standard many agents use to reach outside tools and data. According to a ServiceNow community post dated Sept. 14, the gateway keeps a catalog of MCP servers and tools with an approval status for each, and a server that has not been approved is blocked when someone tries to build it into an agent.

Traffic runs through the gateway instead of directly from agent to server. ServiceNow said it checks the agent's identity and issues narrowly scoped OAuth tokens that expire quickly for each connection, while the servers' own credentials are kept and rotated in one place and are never revealed to the agent. Tool descriptions are scanned before deployment for malicious instructions, and live traffic can be scanned per tool for personal data and credentials. Any server can be paused, across the board or individually, without code changes, and the gateway logs connection attempts, latency and success rates.

The same release adds collection of traces from agents running on AWS, Microsoft and Google platforms, and runtime evaluations covering quality, safety and security. The descriptions are the vendor's own and have not been independently tested.