How to Approve and Pause MCP Servers in ServiceNow AI Gateway

If an agent can connect to any MCP server a developer pastes in, you don't have governance, you have hope. AI Gateway v3.4 (September 2026) closes that gap: agents can only use servers that are approved and active. This guide shows how to approve MCP servers in ServiceNow, pause one when something looks wrong, and verify what happened afterward. It follows the v3.4 release notes and the AI Gateway FAQ. Menu paths below come from those pages, so expect minor label differences in your instance.

Two roles matter. Product Owners build agents and submit server requests. AI Stewards review, approve and run the runtime controls.

1. Get the MCP server into the catalog

There are four ways a server enters the unified inventory:

1. Auto-discovery from AI Agent Studio.
2. Direct registration in the MCP Server Console.
3. Import from the MCP catalog, which pre-fills the URL and authentication.
4. Manual entry for servers not in the catalog.

The Product Owner's usual path is in AI Agent Studio:

AI Agent Studio > Settings > Manage MCP Servers > New

Pick a catalog entry for a one-click import, or enter the server by hand. Requests can also be raised directly in AI Control Tower. Only remote MCP servers qualify; locally hosted servers are not supported.

2. Review and approve the MCP server

Servers move through these states: New, In Review, Approved, Active/Deployed, Deprecated. The AI Steward does the review here:

AI Control Tower > AI assets > MCP Servers

Filter to In Review, then work through the Asset Approval Playbook. Check which tools the server exposes, what data it touches, and whether that fits your security policy.

Approved servers move to Deployed and show up for agent builders. Rejected servers cannot be added to agent configurations. Approval status also flows into AI Agent Studio, so developers see what is allowed, and unapproved servers are hidden from Product Owners' dropdowns.

3. Check the OWASP MCP Top 10 tool scan

Before a server's tools go live, AI Gateway scans them against the OWASP MCP Top 10 categories. Vulnerable tools are deactivated automatically, and this is on by default. Review the scan result during approval rather than after the first incident.

A separate data sensitivity check can block responses containing the sensitive data types you configure, at server or tool level. It only fires if you activate it and define the patterns, so decide that during setup.

4. Keep credentials out of the agents with OAuth 2.1

Every MCP connection goes through the AI Gateway proxy. The gateway issues scoped, short-lived OAuth 2.1 tokens, and token validation and rotation happen centrally. Agents never hold server credentials, so rotating a key doesn't mean touching agent configs.

If your client platform supports Client Identity Metadata Document (CIMD), it can register once in AI Control Tower and cover all approved servers without per-server setup.

5. Pause an MCP server without touching code

When a server misbehaves, an AI Steward can pause it individually or pause connections globally from the AI Gateway setup tab. Traffic stops, agents receive error responses, and the configuration is preserved so you can resume later.

Don't expect instant: the FAQ says changes take effect within 10 minutes because of cache refresh.

6. Read the audit trail and monitor tools

Every MCP transaction through the gateway is logged with caller identity, the tool invoked, latency and outcome. Approval decisions are logged too. Use AI Control Tower for the audit view.

The Monitor tab adds per-tool success rates, P50/P90/P95 latency and connection attempts with client identity. Look there first when an agent starts failing after a pause.

Gotchas

• Unapproved servers are blocked in AI Agent Studio, with no developer workaround. Tell your builders before rollout.
• Pause takes up to 10 minutes to propagate. Plan incident runbooks around that gap, and tell agent owners that errors are expected.
• Only remote MCP servers are supported.
• The sensitive data check blocks the whole call when it matches, so test your patterns on non-production traffic first.
• Auto-deactivated tools after a scan need a steward's review, not a quiet re-enable.

Governing MCP at the gateway means one place to approve, cut off and audit every tool your agents can reach, which is what a production deployment needs when something goes wrong at 2 a.m.