ServiceNowCAUTION

secret: 'unit-test-non-secret'

password: 'legacy-password-fixture',

password: 'legacy-password-fixture',

password: 'legacy-password-fixture',

password: 'configured-password-fixture',

.gitleaks.toml

.gitleaksignore

exec(sql) {

expect(() => new Function(generated)).not.toThrow();

expect(() => new Function(generated)).not.toThrow();

const DEFAULT_CONFIG_PATH = path.resolve(__dirname, '../../config/servicenow-instances.json');

['an invalid table', [{ table: 'incident/../../x', sys_id: hex(1), data: {} }]]

'markdown/../../other/x.md',

for (const unsafe of ['../../etc/passwd.md', 'a%2F..%2Fb.md', 'x.md?y', undefined]) {

const denied = await client.callTool({ name: 'SN-Docs-Get', arguments: { path: '../../../etc/passwd.md' } });

proxy_pass http://127.0.0.1:3000;

`/health` requires the bearer token like every other route. The image's `HEALTHCHECK` (and the one in `docker-compose.yml`) reads `HAPPY_MCP_API_TOKEN` from the container environment at run time and c

Register `http://127.0.0.1:8202/callback` as the public client's redirect URL. Do not set `SERVICENOW_CLIENT_SECRET` for a public client.

Implement `validateNewInstance(instance)` with the approved invariants. Permit `http://127.0.0.1`, `http://localhost`, and `http://[::1]` only for loopback fixtures. Never include the whole submitted

console.log(`🚀 SSE Test Server listening on http://127.0.0.1:${PORT}`);

@inquirer/prompts, @napi-rs/keyring, chokidar, dotenv, express, zod, @types/jest, jest

1. **HTTP/SSE:** generate a token (`openssl rand -hex 32`), set `HAPPY_MCP_API_TOKEN` on the server, and send `Authorization: Bearer <token>` from every HTTP client, probe and health check. Set `HAPPY

- Bound the SSE lifecycle: 16 pending and 32 active sessions; 30-second setup, 30-minute idle and 12-hour lifetime limits; 8 MiB JSON bodies; one POST at a time per session with up to 8 queued; 8 conc

- Bind persisted authorization-code refresh tokens to the OAuth identity they were issued for: a versioned `identity-v1-<sha256>` key over the local OS user, canonical instance URL, OAuth client ID, a

- OAuth authorize/token endpoints must share the instance origin unless the operator lists the external IdP origin in `SERVICENOW_OAUTH_TRUSTED_ORIGINS` (comma-separated exact origins). The policy is