2.2.0 — Flow Designer view, policy card and a denial-of-service fix

Upgrade every install. 2.2.0 fixes a denial-of-service vulnerability: a
single oversized or deeply nested request could make the server exhaust its
memory and stop. 2.2.0 rejects such requests before it validates them.

npm install -g @onlyflows/servicenow-mcp@2.2.0

Restart your MCP client afterwards.

Read this before upgrading from 2.1.0 or a 2.2.0 dev build. Some
installs will refuse to start until a setting is moved, and some profiles
can write more than before:

• The server won't start while SN_FIELD_POLICY_DEFINITIONS is set and
  ~/.servicenow-mcp/config.json exists.
• A malformed field policy in config.json now stops the file from
  loading, so fix it by hand.
• sn_create, sn_update and sn_batch can append comments and
  work_notes on every table a profile may write.
• incident writes are no longer limited to 14 typed fields.
• ["*"] in a field set now means every field.
• readable: [] no longer blocks writes to its table. Add writable: [] to
  keep writes blocked.

Upgrading to 2.2.0
gives the remedy for each case.

Security

• Denial-of-service fix. Every incoming message, over stdio and HTTP,
  passes structural size and depth checks before any schema runs. A request
  outside the limits gets a short, fixed error. The limits admit the largest
  call any tool accepts. (#16)
• Dependencies. zod 4.6.7 (GHSA-mrhx-c7xc-m3w5), MCP SDK 1.32.2, and fixed
  releases of body-parser, fast-uri, hono, iconv-lite, ip-address,
  proxy-addr and qs, plus @hono/node-server 2.1.3
  (GHSA-rmxm-3fg6-px4f, medium: serveStatic decoded paths twice; this
  server never uses serveStatic). npm audit --omit=dev is clean. The container base
  image is pinned to a patched digest. (#10, #16)
• No redirects. API calls and the OAuth token request no longer follow
  HTTP redirects, which could forward an API-key header or re-send the client
  secret. (#15)
• Journal writes are never re-sent after an ambiguous failure, and setup
  re-grants no longer widen a narrowed target. (#11)
• sn_flow_view reads flow input values. It reads sys_variable_value, a
  system table that a "*" field-policy entry does not narrow; name the table
  in the profile's field policy to hide older flows' input values. (#18)
• Metadata cache. The cache no longer reads sys_user or
  sys_properties, so remove grants you added only for it. Cache entries are
  partitioned by credential: restart the server or rotate the secret after
  re-mapping a client-credentials app or API key to another ServiceNow user.
  (#9)

New

• sn_flow_view, the 24th tool, shows a Flow Designer flow or subflow as
  a Mermaid diagram, an outline and a structured graph, covering branches,
  loops, Try / Catch, inputs and called subflows. It is read-only, uses the
  Table API only, and respects your table and field policy.
  servicenow-mcp-setup grant --flows grants read on the flow tables to
  sn_flow_view only. See
  docs/FLOW-VIEW.md.
  (#18)
• Policy card. sn_profile and servicenow-mcp-setup policy show show a
  profile's effective tables, fields, tools and limits. (#17)
• sn_batch dry runs show a sample of up to 5 matched records and the
  field names a confirmed run would write. (#17)
• Warnings on risky grants to role, group, ACL, script, property, user
  and authentication tables. (#17)
• Journal fields on every table. comments and work_notes can be
  written through the generic write tools, and field policy decides where.
  (#11)
• MCP Registry. The package declares mcpName
io.github.onlyflowstech/servicenow-mcp and ships server.json. (#14)
• From the 2.2.0 dev builds: the ATF tools (sn_atf_author, sn_atf_run,
  sn_atf_results, sn_atf_readiness), Windows support in setup, and the npm
  dev channel.

Changed

• Field-policy and journal rules, which are breaking for some profiles. See
  the upgrade guide. (#11)
• sn_batch uses ServiceNow's REST Batch API and never re-sends a batch that
  may have reached the instance. (#11)
• Metadata caching works with OAuth client credentials and API keys, and
  sn_schema results are cached for 5 minutes. (#9)
• zod 4: SDK validation errors use new wording, and tools/list grows by
  about 18 KB because schemas are inlined. (#16)
• About 6 MB less idle memory at startup. (#19)

Fixed

• A hibernating developer instance, or an HTML page in place of JSON, now
  gives a clear error. (#15)
• Every permitted incident field is writable, and most can be cleared;
  short_description, impact, urgency, priority and state cannot. sn_batch applies the same value policy as sn_update. Write responses
  always include sys_id. (#11)
• The metadata cache no longer serves stale rows on accounts east of UTC, and
  it detects deletes. (#9)
• sn_schema and the setup wizard follow table parents by name, not label.
  (#9, #12)
• Tool schemas no longer declare draft-07, which current MCP clients refused
  (first shipped in 2.2.0-dev.6).

Full details are in the
CHANGELOG.
The package is published from GitHub Actions through npm trusted publishing,
with provenance, so you can verify it with npm audit signatures.