SNOW-AF-08: Unauthenticated Agent MCP Client Connection
🔴 High · ServiceNow Action Fabric
Detects a ServiceNow Action Fabric MCP client (or agent connection) with no authentication, so the agent calls that server anonymously. High for a literal remote URL, medium when the URL is a deploy-time placeholder, low for localhost.
Details
| Field | Value |
|---|---|
| Rule ID | SNOW-AF-08 |
| Severity | High |
| Category | ServiceNow Action Fabric |
Remediation
Set an authentication type and credential on the MCP client connection (OAuth, API key, or basic from a credential alias), and require that same authentication on the MCP server.