# Kiteworks MCP in ServiceNow — Setup Guide

> Connect the Kiteworks MCP Server to ServiceNow AI Agent Studio. Register the Remote HTTPS server over OAuth 2.1 with dynamic client registration, add MCP tools to an AI agent, and run it as a dynamic user.

Kiteworks MCP

# Kiteworks MCP in ServiceNow AI Agent Studio

Connect the Kiteworks MCP Server to ServiceNow AI Agent Studio so a Now Assist agent can search, read, and manage Kiteworks data. ServiceNow connects to the Kiteworks **Remote HTTPS** server over OAuth 2.1.

> This guide covers only the Kiteworks side: the values you enter and the identity the agent runs as. For building agents, tools, triggers, and channels, see the [ServiceNow AI Agent Studio docs ↗](https://www.servicenow.com/docs/csh?topicname=ai-agent-studio.html&version=latest). You will need admin rights in both AI Agent Studio and the Kiteworks Admin Portal.

## Prepare the Kiteworks MCP Server

Before you open AI Agent Studio, deploy the Kiteworks Remote HTTPS server and register its OAuth callback URL. All three steps are detailed in the [Installation & Setup guide](mcp-installation-setup.html).

1. **Configure MCP in the Kiteworks Admin Portal.** Enable Kiteworks MCP in the Admin Portal console. See [Configure MCP in Admin Portal](mcp-installation-setup.html#pdn-plugin).
2. **Deploy the Remote HTTPS server.** Stand up the centralized Remote HTTPS MCP Server that ServiceNow will connect to. See [Remote HTTPS Server](mcp-installation-setup.html#remote-https).
3. **Add the callback URL to the MCP configuration.** Register the callback (redirect) URL of your MCP deployment in the Admin Portal so the OAuth flow can complete for remote clients. Note your server's base URL — you register it in ServiceNow with `/mcp` appended.

## Register the MCP Server in ServiceNow

In AI Agent Studio, add the Kiteworks MCP Server once (in **Manage MCP servers**); the connection is then available to every AI agent you build. For the exact navigation, see the [ServiceNow AI Agent Studio docs ↗](https://www.servicenow.com/docs/csh?topicname=ai-agent-studio.html&version=latest). Enter the following Kiteworks values.

1. **MCP server URL and authentication type.** For **MCP server URL**, enter your Remote HTTPS server URL ending in `/mcp` (for example `https://your.mcp.domain/mcp`). Set the **Authentication type** to **OAuth 2.1**.
2. OAuth settings (Dynamic Client Registration) The Kiteworks MCP Server supports Dynamic Client Registration, so you do not create a client ID or secret by hand. Use these values: **Client registration type:** Dynamic Client Registration
3. **Grant type:** Authorization Code
4. **Token authentication method:** Client Secret Basic
5. **Auth scopes:** `openid`, `profile`, `email`, `mcp:access`
6. **Authorization URL** and **Token URL:** the OAuth endpoints of your Kiteworks MCP deployment (for example `https://your.mcp.domain/oauth/start` and `https://your.mcp.domain/oauth/token`)
7. **Grant access on the Kiteworks consent screen.** Kiteworks opens an authorization page listing the scopes the application is requesting (files, folders, search, and user lookups). Review them and select **Grant Access**. ServiceNow then shows the MCP server as connected.

> Grant access with a Kiteworks account scoped to what your agents should do. See [Define the identity the agent runs as](#security) for per-user identity on top of this connection.

## Add the Kiteworks Tools to an Agent

When you build an agent, add an **MCP server tool**, choose the Kiteworks server you registered, and select the Kiteworks tool to expose (see the [ServiceNow AI Agent Studio docs ↗](https://www.servicenow.com/docs/csh?topicname=ai-agent-studio.html&version=latest)). Available tools include `create_folder`, `create_file_from_content`, `get_folder_children`, `get_top_folders`, `get_file_metadata`, and `search` — the full list is in [Available MCP Tools ↗](https://github.com/kiteworks/mcp/blob/main/docs/AVAILABLE_TOOLS.md). Add only the tools the task requires to keep the agent reliable and its permissions tight.

## Define the Identity the Agent Runs As

The key Kiteworks decision: whose permissions the agent uses. In AI Agent Studio's security controls, set the **User identity type** when you define data access.

> **Recommended: Dynamic user.** The agent runs with the roles and permissions of the user who invokes it, so the MCP Server enforces each caller's own access rather than the admin account that registered the connection. (A **Static user** runs as one fixed account for everyone.) Set **Approved role(s)** to cap the agent for least privilege. See the [ServiceNow security-controls docs ↗](https://www.servicenow.com/docs/csh?topicname=define-sec-controls-aia.html&version=latest).

Triggers, channels (such as Virtual Agent), and publishing are handled in AI Agent Studio and do not affect the Kiteworks connection. Once published, users can ask the agent to work with Kiteworks data, governed by each user's own permissions.

## Next Steps

With the Kiteworks MCP tools connected to your agent, explore what you can do with it:

- [Usage Examples ↗](https://github.com/kiteworks/mcp/blob/main/docs/USAGE_EXAMPLES.md) — Detailed examples including Compliance Review with Forms, Sensitive Data Audit, and Project Handover workflows
- [Available MCP Tools ↗](https://github.com/kiteworks/mcp/blob/main/docs/AVAILABLE_TOOLS.md) — Full list of tools exposed by the MCP Server