Proven Optics AI Core
A native ServiceNow implementation of the Model Context Protocol (MCP) that lets Proven Optics applications securely expose their data and tools to AI assistants like Claude, ChatGPT, and Gemini.
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-10-24 | 0 | - |
About
- Introduces the foundational MCP server framework (transport, OAuth, capability registry, session/invocation lifecycle, and AIUtil data-access layer) for use by Proven Optics scoped applications.
- Ships a REST API (OAuth-protected Internal API) and 7 supporting REST operations.
- Delivers 13 framework tables, 9 script includes, 18 business rules, and role-based ACL enforcement (56 ACLs across framework tables and endpoints).
- First consuming application: Budget Clarity AI, which registers 25 scripted tools against this framework.
Key Features
- **Native MCP server framework for ServiceNow** — implements the Model Context Protocol (JSON-RPC 2.0) over HTTP, supporting four protocol revisions (2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25), so any MCP-compatible AI client (Claude, Claude Code, ChatGPT, Copilot, Codex, Gemini) can connect to ServiceNow data and logic.
- **OAuth 2.1 secured transport** — authorization-code + PKCE (S256) flow, RFC 7591 Dynamic Client Registration, and RFC 8414/9728 discovery documents, layered on ServiceNow's native OAuth provider (no third-party auth dependency).
- **Admin-gated client approval workflow** — every new AI client registration lands in a Requested state; nothing connects until an admin explicitly implements or denies it.
- **Extensible capability registry** — a table-inheritance model for tools (scripted or subflow-backed), prompts, and resources (static or dynamic), letting downstream Proven Optics apps register their own capabilities without reimplementing MCP.
- **Two-tier role-based access control** — independent role gating at both the server and individual-capability level, so a single server URL can present a role-tailored toolset per user (e.g., general vs. privileged tools).
- **ACL-aware generic data-access engine (AIUtil)** — GlideRecordSecure-based reads, aggregation, and schema reflection utilities that respect ServiceNow row/field ACLs, callable by any consuming scoped app.
- **Full session and audit lifecycle** — automatic session state management (init → active → idle → expired/closed) with a scheduled cleanup job, plus a complete per-call invocation audit trail (request/response, duration, status).
- **Token-efficient serialization (TOON)** — compact, LLM-optimized output format that reduces token consumption versus standard JSON for large data reads.
- **Zero outbound third-party HTTP** — the only external calls are loopbacks to the instance's own internal API for token validation and request forwarding.