{"slug": "deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server", "title": "Deploying Snowflake Cortex Agent and Knowledge Graph with ServiceNow MCP Server", "summary": "A developer documented an architecture that connects Claude Code to both Snowflake and ServiceNow through ServiceNow's MCP Server, exposing a subflow that invokes a Snowflake Cortex Agent and a ServiceNow Knowledge Graph as callable tools. The setup uses OAuth authentication between the two platforms and a Snowflake Semantic View so a single agent can answer questions spanning hardware assets in Snowflake and software assets in ServiceNow without the user knowing where the data lives.", "body_md": "ServiceNow provides a feature called **MCP Server**. It allows various capabilities registered in ServiceNow, such as flows and knowledge graphs, to be exposed as callable **tools** that AI agents such as Claude Code can invoke directly.\n\nThis article documents the steps used to build the following environment:\n\nThe final objective is to let a user ask a single AI agent a question such as, “What assets are managed by Tim?” and receive an answer spanning both the hardware assets in Snowflake and the software assets in ServiceNow. The advantage of this architecture is that users do not need to know where the data is stored, whether in Snowflake or ServiceNow.\n\nAll instance URLs and account names in this article have been replaced with placeholders such as `<your-instance>`. When implementing this architecture, replace them with the values for your own environment.\n\n```\nClaude Code (MCP Client)\n        │  MCP protocol (OAuth authentication)\n        ▼\nServiceNow\n ├─ MCP Server (gateway for tools)\n │   ├─ Tool: Subflow ── Invokes Snowflake Cortex Agent\n │   └─ Tool: Knowledge Graph ── Searches data in ServiceNow\n │\n └─ Snowflake, accessed through the subflow\n      ├─ Cortex Agent\n      └─ Semantic View (HARDWARE / ADMIN tables)\n```\n\nBefore proceeding with the implementation, this section summarizes the terms used throughout the article. Return here if you encounter an unfamiliar term.\n\n| Term | Description | \n|---|---|\n| **MCP (Model Context Protocol)** | A standard protocol that allows AI agents to invoke external tools and data sources. An MCP Server provides tools, while an MCP Client, Claude Code in this example, consumes them. | \n| **Cortex Agent** | An AI agent capability provided by Snowflake. It receives a natural-language query, uses a Semantic View to construct SQL, retrieves data from tables, and returns an answer. | \n| **Semantic View** | A definition that adds business meaning to table columns and relationships, such as identifying an administrator name or an asset name. By using a Semantic View, Cortex Agent can construct SQL from natural language without directly relying on the physical table structure. | \n| **ServiceNow Knowledge Graph** | A ServiceNow capability that connects tables through edges and makes the resulting graph structure searchable using natural language. Within ServiceNow, it plays a role similar to the combination of a Snowflake Semantic View and Cortex Agent. | \n| **Subflow** | A reusable unit of processing created in ServiceNow Flow Designer and invoked by other flows. In this implementation, the Cortex Agent invocation is encapsulated in a subflow. | \n\nTo use Cortex Agent, first create an entry point in Snowflake that accepts OAuth authentication from ServiceNow. You must also create the Semantic View that gives business meaning to the data, as well as a runtime user and the permissions required to query the agent.\n\nOpen a Snowsight worksheet using the `ACCOUNTADMIN` role and run the following SQL. This configuration allows Snowflake to accept OAuth authentication from ServiceNow.\n\n```\n-- 01. OAuth settings\nUSE ROLE ACCOUNTADMIN;\nCREATE OR REPLACE SECURITY INTEGRATION _cortex_oauth_2\n  TYPE = OAUTH\n  ENABLED = TRUE\n  OAUTH_CLIENT = CUSTOM\n  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'\n  OAUTH_REDIRECT_URI = 'https://<your-instance>.service-now.com/oauth_redirect.do'\n  OAUTH_ISSUE_REFRESH_TOKENS = TRUE\n  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000 -- Refresh-token lifetime in seconds, up to 90 days\n  COMMENT = 'OAuth integration for ServiceNow Cortex Agent Integration'\n;\n```\n\n`OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'` assumes that the client secret can be stored securely on the ServiceNow server side. A `PUBLIC` client is used for environments such as browsers or mobile applications where a secret cannot be protected. Because this implementation is a server-to-server integration, `CONFIDENTIAL` is selected.\n\nAfter creating the security integration, retrieve the Client ID and Client Secret.\n\n```\n-- 02. Check the Client Secret and Client ID\nSELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('_CORTEX_OAUTH_2');\n```\n\nKeep these values available because they will be used in the ServiceNow Application Registry configuration.\n\nCreate the database and schema that will contain the managed data.\n\n```\nUSE ROLE SYSADMIN;\nCREATE DATABASE management;\nCREATE SCHEMA hardware;\n```\n\nCreate the following two tables in this schema and load the sample data.\n\n`ADMIN`: Contains administrator IDs and administrator names.\n| admin_id | admin_name | \n|---|---|\n| IT0001 | Tim | \n| IT0002 | Chester | \n| IT0003 | Arlon | \n| IT0004 | Michel | \n| IT0005 | Lick | \n| IT0006 | Len | \n| IT0007 | Eathon | \n\n`HARDWARE`: Contains asset names, descriptions, vendors, administrator IDs, and related information.\n| admin_id | asset_name | vender | description | \n|---|---|---|---|\n| IT0001 | MacBook Pro 14 | Apple | Laptop for sales and proposal activities | \n| IT0002 | Dell Latitude 7450 | Dell | Windows laptop for internal business operations | \n| IT0003 | ThinkPad X1 Carbon | Lenovo | Laptop for data analysis and customer support | \n| IT0004 | Surface Laptop 7 | Microsoft | PC for meetings and presentations | \n| IT0005 | ProBook 440 G11 | HP | PC for general administration and remote work | \n| IT0006 | iPhone 16 | Apple | Smartphone for business communication and multi-factor authentication | \n| IT0007 | Galaxy Tab S10 | Samsung | Tablet for on-site viewing and mobile approvals | \n| IT0001 | Dell UltraSharp U2723QE | Dell | 27-inch external monitor for remote work | \n| IT0003 | MX Keys S | Logitech | Wireless keyboard for data entry | \n| IT0006 | Jabra Evolve2 65 | Jabra | Wireless headset for online meetings | \n\nCreate a Semantic View so that the loaded table data can be queried using natural language.\n\n`MANAGEMENT.HARDWARE.ADMIN` and `MANAGEMENT.HARDWARE.HARDWARE` as the tables.`SV_HARDWARE_ADMIN`.` MANAGEMENT.HARDWARE`.\nIn the editor for `SV_HARDWARE_ADMIN`, configure the following:\n\n`ADMIN_ID` columns in the two tables. This allows the agent to understand which administrator is responsible for each asset.\nUnder **Verified queries**, register representative questions and their corresponding SQL statements in advance. This is an important way to improve the agent's response accuracy. It effectively teaches the agent an FAQ with model answers.\n\nQuestion: `What hardware assets are managed by each administrator?`\n\nSQL:\n\n```\n  SELECT a.ADMIN_NAME, h.ASSET_NAME, h.DESCRIPTION, h.VENDER\n  FROM admin AS a\n  JOIN hardware AS h ON a.ADMIN_ID = h.ADMIN_ID;\n```\n\nNext, create the agent that provides the external endpoint and selects the appropriate tool.\n\n`SEARCH_AGENT` in Under **Instructions**, configure:\n\nUnder **Tools**, select **Add semantic view** and add the previously created `SV_HARDWARE_ADMIN`. This allows the agent to access data safely through the business definitions in the Semantic View rather than writing SQL without semantic context.\n\nFinally, use **Preview** to test a question such as “Check the hardware managed by Tim” and verify that the expected answer is returned.\n\nGrant the end user connecting from ServiceNow permission to execute Cortex Agent and access the required resources. A dedicated role and service account are used to follow the **principle of least privilege**, exposing only the permissions needed for the external integration. Using an administrator role for the ServiceNow connection could permit unintended operations.\n\n```\n-- 04. Create the role and grant permissions\nUSE ROLE SECURITYADMIN;\n\nCREATE ROLE cortex_agent_hardware_search;\nGRANT DATABASE ROLE SNOWFLAKE.CORTEX_AGENT_USER TO ROLE cortex_agent_hardware_search;\nGRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE cortex_agent_hardware_search;\nGRANT USAGE ON DATABASE management TO ROLE cortex_agent_hardware_search;\nGRANT USAGE ON SCHEMA management.hardware TO ROLE cortex_agent_hardware_search;\nGRANT USAGE ON AGENT management.hardware.search_agent TO ROLE cortex_agent_hardware_search;\nGRANT USAGE ON WAREHOUSE compute_wh TO ROLE cortex_agent_hardware_search;\nGRANT USAGE ON DATABASE MANAGEMENT TO ROLE cortex_agent_hardware_search;\nGRANT USAGE ON SCHEMA MANAGEMENT.HARDWARE TO ROLE CORTEX_AGENT_HARDWARE_SEARCH;\nGRANT USAGE ON SEMANTIC VIEW MANAGEMENT.HARDWARE.SV_HARDWARE_ADMIN TO ROLE CORTEX_AGENT_HARDWARE_SEARCH;\nGRANT SELECT ON SEMANTIC VIEW MANAGEMENT.HARDWARE.SV_HARDWARE_ADMIN TO ROLE CORTEX_AGENT_HARDWARE_SEARCH;\nGRANT SELECT ON TABLE MANAGEMENT.HARDWARE.HARDWARE TO ROLE CORTEX_AGENT_HARDWARE_SEARCH;\nGRANT SELECT ON TABLE MANAGEMENT.HARDWARE.ADMIN TO ROLE CORTEX_AGENT_HARDWARE_SEARCH;\n\n-- Grant the role to the user\nCREATE USER servicenow\n    PASSWORD = '<your_password>'\n    DEFAULT_ROLE = cortex_agent_hardware_search\n    MUST_CHANGE_PASSWORD = FALSE\n    COMMENT = 'Service account for ServiceNow integration';\n\nGRANT ROLE cortex_agent_hardware_search TO USER servicenow;\nGRANT ROLE sysadmin TO USER servicenow;\n```\n\nUse ServiceNow's standard OAuth integration capabilities to connect securely from ServiceNow to Snowflake. ServiceNow OAuth integration uses three layers, each with a different role:\n\n| Field | Value | \n|---|---|\n| Name | Snowflake Cortex Agents OAuth 2.0 | \n| Client ID | Client ID issued by Snowflake | \n| Client Secret | Client Secret issued by Snowflake | \n| Default Grant type | Authorization Code | \n| Authorization URL | `https://<your-account>.snowflakecomputing.com/oauth/authorize` | \n| Token URL | `https://<your-account>.snowflakecomputing.com/oauth/token-request` | \n| Redirect URL | `https://<your-instance>.service-now.com/oauth_redirect.do` | \n\nThis step registers the **definition** that tells ServiceNow which credentials to use when authenticating with Snowflake as an OAuth provider. It does not yet establish a connection or issue an authentication token.\n\n| Field | Value | \n|---|---|\n| Name | Snowflake Cortex Agents User Credential | \n| OAuth Entity Profile | Entity Profile for Snowflake Cortex Agents OAuth 2.0 created in Application Registry | \n| Integration Type | Personal | \n\nSave the configuration, then select **Get OAuth Token** to obtain an authentication token and store it in ServiceNow. At this point, the OAuth flow defined in Application Registry runs for the first time, including browser-based login and consent, and a token is issued.\n\n| Field | Value | \n|---|---|\n| Name | Snowflake OAuth Cortex Agents Alias | \n\n| Field | Value | \n|---|---|\n| Name | Snowflake Cortex Agents HTTP Connection | \n| Credential | Snowflake Cortex Agents User Credential | \n| Connection URL | `https://<your-account>.snowflakecomputing.com` | \n\nConnection & Credential Alias provides an abstraction that Flow Designer can reference to determine which connection information to use for an HTTP request. If the destination or credential changes, the flow implementation does not need to be modified as long as the alias continues to resolve to the appropriate connection.\n\nSnowflake Cortex Agent is invoked through the `agent:run` REST API.\n\n`Ask Snowflake Cortex Agent`.\n**Input variable definition**\n\n| Label | Type | \n|---|---|\n| user_prompt | String | \n\n**Action step definition**\n\n**Step 1**\n\n`/api/v2/databases/management/schemas/hardware/agents/search_agent:run`\n\n```\n  {\n    \"stream\": false,\n    \"messages\": [\n      {\n        \"role\": \"user\",\n        \"content\": [\n          {\n            \"type\": \"text\",\n            \"text\": \"{{input user_prompt}}\"\n          }\n        ]\n      }\n    ]\n  }\n```\n\n**Step 2**\n\n`<step1 cortex agent action - response_body>`\n`<step1 cortex agent action - status_code>`\n\n```\n(function execute(inputs, outputs) {\n  if (inputs.status_code != 200) {\n    outputs.error = \"Error: HTTP \" + inputs.status_code + \" - \" + inputs.response_body;\n    outputs.answer = \"\";\n    return;\n  }\n\n  try {\n    var response = JSON.parse(inputs.response_body);\n    var answerText = \"\";\n\n    // Extract text from the content array in the non-streaming response\n    if (response.content && response.content.length > 0) {\n      for (var i = 0; i < response.content.length; i++) {\n        if (response.content[i].type === \"text\") {\n          answerText += response.content[i].text;\n        }\n      }\n    }\n\n    outputs.answer = answerText;\n    outputs.error = \"\";\n  } catch (e) {\n    outputs.error = \"Failed to parse response: \" + e.message;\n    outputs.answer = \"\";\n  }\n})(inputs, outputs);\n```\n\n**Action output variable definition**\n\n| Label | Type | Value | \n|---|---|---|\n| answer | String | `<step2 return output - answer>` | \n| error | String | `<step2 return output - error>` | \n\nFinally, select **Publish**.\n\nThe action is invoked through a subflow rather than used directly so that the **execution user's context is preserved**. Calls from MCP Server should execute while retaining the identity of the user who submitted the question. This behavior is controlled through the subflow's **Run As** setting.\n\n| Field | Value | \n|---|---|\n| Name | Hardware Search Cortex Agents Sub Flow | \n| Run As | User who initiates session | \n\n**Input and output variables**\n\n`user_prompt` / String`answer` / String and `error` / String\n**Actions**\n\n`<1 Ask Snowflake Cortex Agent - answer>`\n`<1 Ask Snowflake Cortex Agent - error>`\nSelect **Test**, enter `What kind of hardware is managed by Tim?`, and verify that the expected value is returned. Finally, select **Publish**.\n\nFinally, configure permissions so that an external AI agent can invoke this subflow through an MCP Client.\n\n`security_admin`.\n| Field | Value | \n|---|---|\n| Type | flow | \n| Operation | invoke_from_ai | \n| Decision Type | Allow If | \n| Role | snc_internal | \n\nThe dedicated `invoke_from_ai` operation makes it possible to distinguish between execution by a person through the UI and execution by an AI agent through MCP. Calls from AI can therefore be allowed or restricted independently of ordinary flow execution permissions.\n\nThe ServiceNow subflow configuration is now complete.\n\nSoftware asset information is stored in ServiceNow tables, so natural-language search is implemented differently from the Snowflake part of the architecture. ServiceNow **Knowledge Graph** defines relationships between tables as a graph, allowing the data to be traversed through natural-language queries.\n\nPrepare an Excel file and import the following tables through App Engine Studio.\n\n`admin`: When configuring the `admin_id` column, select `software`: When configuring the | admin_id | software_name | vendor | description | \n|---|---|---|---|\n| IT0001 | Microsoft 365 Apps | Microsoft | Productivity suite for document creation, email, and collaboration | \n| IT0002 | Slack | Salesforce | Business messaging and team communication platform | \n| IT0003 | Tableau Desktop | Salesforce | Data visualization and dashboard development software | \n| IT0004 | Microsoft Teams | Microsoft | Online meetings, chat, and collaboration software | \n| IT0005 | Adobe Acrobat Pro | Adobe | PDF creation, editing, and electronic document management | \n| IT0006 | Microsoft Authenticator | Microsoft | Multi-factor authentication and secure account access application | \n| IT0007 | ServiceNow Mobile | ServiceNow | Mobile access for workflow tasks, approvals, and service requests | \n| IT0001 | Salesforce Sales Cloud | Salesforce | Customer relationship management software for sales activities | \n| IT0003 | Visual Studio Code | Microsoft | Source code editor for development and data-related scripts | \n| IT0006 | Jabra Direct | Jabra | Device management software for Jabra headsets and firmware updates | \n\n`software admin graph`.` What kind of software is managed by Tim?`, and verify that the expected result is returned.\nThe ServiceNow Knowledge Graph configuration is now complete.\n\n| Field | Value | \n|---|---|\n| Label | assets-admin-ask | \n| Short Description | This MCP server manages the administrators of hardware and software assets. Hardware assets and administrators are stored in Snowflake, while software assets and administrators are stored in ServiceNow Knowledge Graph. | \n\nUnder **Tools**, select **Create Tool** and create the following two tools. This configuration presents the Snowflake data and ServiceNow data to users as two tools within a single MCP Server.\n\nOAuth authentication is also required when the MCP Client, Claude Code, connects to ServiceNow MCP Server. In this flow, ServiceNow accepts OAuth requests from an external client, so configure it as an inbound integration.\n\n| Field | Value | \n|---|---|\n| Name | assets_admin_ask | \n| Provider Name | ServiceNow | \n| Redirect URLs | `http://localhost:8080/callback` | \n\nWhen Claude Code connects to a remote MCP Server through OAuth, it starts a temporary local web server to receive the authorization callback and token. By default, a random port may be used. Because a fixed redirect URL must be registered in the ServiceNow inbound integration in advance, use the `--callback-port` option to **fix the port number**.\n\nThis implementation uses port `8080`. Add the following URL to **Redirect URLs** in the `assets_admin_ask` inbound integration created above:\n\n```\nhttp://localhost:8080/callback\n```\n\nThe ServiceNow-side preparation is now complete. Finally, configure Claude Code through its VS Code extension and connect to the MCP Server in ServiceNow.\n\n`claude mcp add`\nUsing the **Client ID** and **Client Secret** issued for the inbound integration, register the MCP Server through the Claude Code CLI.\n\n```\nclaude mcp add --transport http \\\n  --client-id <Client ID issued by the inbound integration> \\\n  --client-secret \\\n  --callback-port 8080 \\\n  --scope user \\\n  servicenow-mcp \\\n  https://<your-instance>.service-now.com/sncapps/mcp-server/mcp/<mcp-server-name>\n```\n\n`--client-secret` without a value and enter the secret interactively when prompted, preventing it from being stored in shell history.`--scope user` registers the server as a `--scope` is omitted, the configuration is local to the project and will not be visible to Claude Code sessions started from another directory.`<mcp-server-name>` is the path name corresponding to the server created in MCP Server Console, in this example `assets-admin-ask`.\nThis command only **registers the configuration**. It does not open a browser at this stage. The OAuth authorization flow is started explicitly in the next step.\n\nCheck the authentication state of the registered server with:\n\n```\nclaude mcp list\n```\n\nIf `servicenow-mcp` is displayed as `! Needs authentication`, the configuration has been registered but authentication has not yet been completed. To begin authentication, run the following command in an interactive Claude Code session:\n\n```\n/mcp\n```\n\nSelect `servicenow-mcp` from the list, then select **Authenticate**. A browser opens and displays the ServiceNow login and authorization page. After authorization, the browser is redirected to `http://localhost:8080/callback`, the token is passed to Claude Code, and authentication is completed.\n\nRun `claude mcp list` again. If `servicenow-mcp` is displayed as `✔ Connected`, the connection is complete.\n\nFinally, ask for the software and hardware assets managed by Tim and verify that the correct results are returned. In Claude Code, the result should look similar to the following.\n\nThis implementation uses ServiceNow MCP Server to provide seamless natural-language access from a single AI agent, Claude Code, to two data sources with different storage locations and query mechanisms: Snowflake Cortex Agent for hardware asset management and ServiceNow Knowledge Graph for software asset management.\n\nServiceNow MCP Server makes it possible to invoke both native ServiceNow assets and external tools efficiently through a unified interface.", "url": "https://wpnews.pro/news/deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server", "canonical_source": "https://dev.to/shin_m_5c8fda95a8ffc03f70/deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server-4lff", "published_at": "2026-09-22 07:58:15+00:00", "updated_at": "2026-09-22 08:22:52.733483+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "ai-infrastructure", "structured-data"], "entities": ["Snowflake", "ServiceNow", "Claude Code", "Snowflake Cortex Agent", "ServiceNow Knowledge Graph", "Model Context Protocol", "Flow Designer", "Snowsight"], "alternates": {"html": "https://wpnews.pro/news/deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server", "markdown": "https://wpnews.pro/news/deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server.md", "text": "https://wpnews.pro/news/deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server.txt", "jsonld": "https://wpnews.pro/news/deploying-snowflake-cortex-agent-and-knowledge-graph-with-servicenow-mcp-server.jsonld"}}