SNOW-AF-09: Public or Unauthenticated Action Fabric Endpoint
🔴 High · ServiceNow Action Fabric
Detects an Action Fabric MCP server with no authentication, or an AI agent published for A2A with a public flag, a Public security ACL, or allow-third-party. High; critical only when a tool in the same update set can write or delete a system of record.
Details
| Field | Value |
|---|---|
| Rule ID | SNOW-AF-09 |
| Severity | High |
| Category | ServiceNow Action Fabric |
Remediation
Require authentication on the MCP server, and do not publish the agent (public / Public ACL / allow third party) unless callers are authenticated and write tools stay behind a confirmation gate.