Self-Host NowAIKit with Localtonet HTTP Access

What this HTTP access tutorial does and does not expose

NowAIKit is a source-available toolkit that connects AI clients to ServiceNow. Its current project pages describe hundreds of tools across areas such as ITSM, ITOM, CMDB, HRSD, CSM, Flow Designer, scripting, reporting, portals, and application development. The precise catalog changes between releases. Current official pages use both 450+ and 500+, so treat those figures as changing catalog summaries rather than a fixed tool count.

The procedure in this article has two distinct purposes. First, it configures the ordinary local NowAIKit MCP workflow, normally using the default stdio transport. Second, if the installed edition includes the browser dashboard, it starts that dashboard and forwards its local HTTP listener through Localtonet.

This article does not configure remote MCP access. A dashboard URL is not an MCP endpoint. Publishing the dashboard does not expose the stdio process, does not create an SSE endpoint, does not create a Streamable HTTP endpoint, and does not make the REST API available. Each of those network modes has its own startup configuration, endpoint paths, authentication requirements, CORS policy, health checks, and client compatibility constraints.

If your actual goal is to connect a remote MCP client, use NowAIKit's current network-transport documentation and configure that transport as a separate deployment. The current project describes Streamable HTTP as the preferred network transport for new MCP integrations and documents bearer-token authentication for HTTP operation. A safe remote MCP tutorial would need to establish the exact release-specific endpoint, generate and protect the bearer token, restrict CORS to approved origins, verify the local health endpoint, and configure a client that supports that transport. Those details must not be inferred from the dashboard command, so they are deliberately outside this dashboard-focused workflow.

How NowAIKit, ServiceNow, and Localtonet fit together

Keep the application paths separate when designing or troubleshooting the deployment. In the normal local MCP path, an AI client launches NowAIKit and exchanges MCP messages through standard input and output. NowAIKit then makes outbound requests to the configured ServiceNow instance using the selected ServiceNow identity and the permissions available to that identity.

The optional dashboard is another local process or mode with an HTTP listener. The Localtonet client runs on the same host, or on another device capable of reaching that listener, and establishes an outbound connection to a Localtonet relay. A Localtonet HTTP tunnel assigns a public HTTPS URL and forwards requests from that URL to the dashboard's local IP address and port.

Localtonet does not replace NowAIKit authentication, ServiceNow OAuth, ServiceNow roles, NowAIKit permission tiers, or application authorization. Our platform supplies connectivity to the selected local target. The tunnel remains available only while the chosen Localtonet client is connected, the tunnel is started, and the dashboard continues listening at the configured target.

Prerequisites and current compatibility

For the npm installation path, NowAIKit currently requires Node.js 20.0.0 or newer and documents npm 9 or newer. The standalone binary path does not require Node.js, but it still requires a supported operating system, a ServiceNow instance, suitable ServiceNow access, and a compatible AI client if MCP mode will be used.

You also need a Localtonet client on the NowAIKit host or on another device that can reach the dashboard listener. Running both applications on the same host is the simplest arrangement when the dashboard binds only to a loopback address.

Check the npm runtime

node --version
npm --version

Upgrade Node.js before proceeding if the major version is below 20. Open a new terminal after an upgrade and repeat both checks so you do not accidentally use an older runtime left earlier in the executable path.

Choose the ServiceNow instance carefully

Begin with a developer or sandbox instance whenever possible. Read-only access can still reveal incidents, users, configuration records, customer data, or other sensitive information, but a non-production instance reduces the impact of role and tool-selection mistakes while the integration is being validated.

NowAIKit uses a five-tier permission model. Tier 0 read access is enabled by default. Write, CMDB, scripting, and agentic capabilities require explicit opt-in. These NowAIKit controls work alongside ServiceNow authorization. They do not override ServiceNow roles, and they do not make an otherwise unsafe production operation appropriate.

Check supported ServiceNow releases

As documented on the project site for this 2026 article revision, NowAIKit states an n-2 support policy covering Australia as the current general-availability release, plus Zurich and Yokohama. This is time-sensitive information. ServiceNow's release train and NowAIKit's support window will move, so verify the policy for the NowAIKit version you are actually deploying before connecting an older or newly released instance.

A release outside the listed support window might still accept standard API requests, but that does not establish full tool, schema, SDK, or workflow compatibility. Test the precise NowAIKit and ServiceNow release combination rather than assuming that basic connectivity proves complete support.

Install NowAIKit using npm or a standalone package

Use only an official NowAIKit distribution. The project warns that it is not distributed as a downloadable GitHub source archive for ordinary installation. The documented routes are the official npm package, the NowAIKit website, platform installers, or a deliberate source build for administrators and contributors.

Option A: npm installation

The npm workflow is appropriate when Node.js 20 or newer is already available. Install the package globally, then run the current setup wizard:

npm install -g nowaikit
npx nowaikit@latest setup

Using @latest requests the currently published package. For a managed environment, record the tested version and review changes before updating production systems. Tool availability, client support, authentication behavior, and network modes can change between releases.

Verify that the executable can be resolved:

nowaikit --version

If the shell cannot find it, open a new terminal and try again. If the problem remains, check whether npm's global executable directory is included in the current user's PATH.

Option B: standalone binary

The documented standalone distribution includes the MCP server and setup command without requiring Node.js. Current installation documentation lists packages for macOS on Apple Silicon and Intel, Windows on x64 and ARM64, Linux x86_64 as an AppImage, and Debian or Ubuntu as an amd64 package.

Download the package matching the operating system and processor from the official NowAIKit site. On macOS or Linux, make a directly downloaded binary executable, move it to a directory in PATH if that matches your administration policy, and run:

nowaikit setup
nowaikit --version

On Windows, place the downloaded executable in an approved location and run its setup command from PowerShell or the terminal. Exact filenames vary by platform package and release, so use the filename of the verified installer or binary you downloaded rather than copying a filename for another architecture.

Configure ServiceNow authentication and OAuth

Run the setup wizard as the same operating-system user who will run the AI client. The wizard asks for the ServiceNow instance, authentication method, credentials or OAuth details, permission posture, tool package, and client target. It tests connectivity before writing the selected client configuration.

OAuth 2.0 is the documented recommendation for production. Administrative access is needed when a ServiceNow OAuth application must be created or changed. Ordinary users do not need administrator rights merely to perform permitted read operations, but their ServiceNow roles still determine which records and operations they can access.

Preferred current wizard behavior

Current repository guidance says the wizard can sign in, detect an existing OAuth application, or create one after an administrator signs in. On newer ServiceNow releases, it creates a public client using PKCE, which does not require a client secret in the user-facing client configuration. PKCE is preferable where supported because the application proves possession of a temporary verifier rather than embedding a reusable secret in a desktop configuration.

Use the wizard first. If it offers to reuse an approved OAuth application, confirm that the application belongs to the correct instance and environment. If creation is required, an authorized ServiceNow administrator should review the application name, redirect behavior, grant configuration, token policy, and intended users.

Manual ServiceNow application registry setup

If your installed NowAIKit version requires the documented manual OAuth setup rather than the newer PKCE-assisted wizard flow, an administrator can create the application in ServiceNow:

Complete per-user sign-in

After setup, each person using the documented per-user OAuth flow signs in as themselves:

nowaikit auth login
nowaikit auth whoami

The login command opens a browser to complete authorization. The identity check should report the intended user and ServiceNow instance. Per-user identity allows ServiceNow permissions and audit records to correspond to the actual user instead of a shared service account.

Fully restart the AI client after setup so it reloads the generated MCP configuration. If the wizard cannot configure the client automatically, use the current schema and configuration path documented by that client. Avoid copying password-bearing JSON into a public article or repository.

Verify local MCP operation before opening a web listener

Prove the local integration before introducing the dashboard or tunnel. This keeps ServiceNow, MCP client, dashboard, and connectivity failures from becoming one combined troubleshooting problem.

A successful test confirms that the client can start NowAIKit, the MCP configuration is usable, ServiceNow authentication works, the selected tools are visible, and the active ServiceNow identity has the required read permission.

Failure can occur at any of those layers. Check for an invalid client configuration, an unresolved executable, a stale client process, an expired OAuth session, an incorrect instance URL, insufficient ServiceNow roles, or an outbound network restriction.

Confirm entitlement, then start the local dashboard

Do not run or expose the dashboard until you have confirmed that the installed NowAIKit version and license include it. The main documentation currently labels the web dashboard and HTTP API as Enterprise features even though repository installation text also advertises npx nowaikit web. Your applicable license and installed release control availability.

If the dashboard is included, start it in a separate terminal:

npx nowaikit web

Keep the terminal open and inspect its startup output. Record the complete listening URL, including scheme, hostname or IP address, and port. The available evidence does not establish a single fixed dashboard address, so do not borrow a port from an SSE, Streamable HTTP, or REST example.

Verify the dashboard on the host

Open the exact displayed URL in a browser on the NowAIKit host. Confirm that the expected interface loads. If the command reports an entitlement error, unsupported command, startup failure, or unavailable listener, stop and resolve that issue before configuring Localtonet.

You can also test the exact displayed address with an HTTP client:

curl "PASTE_THE_EXACT_DASHBOARD_URL_SHOWN_BY_NOWAIKIT_HERE"

The application may return HTML, a redirect, or another dashboard-defined response. The useful result is a successful local connection to the expected process. Compare terminal logs with the request so you know that another service on the host did not answer accidentally.

Establish the dashboard's authentication behavior

Test the dashboard in a fresh browser session before publishing it. Determine whether it requires a login, whether an existing local session is being reused, how sessions expire, and whether an unauthenticated visitor can reach data or operations. The evidence supplied for this tutorial does not establish a universal authentication behavior for npx nowaikit web.

Expose only the verified dashboard with Localtonet

Once the dashboard works locally, its license is confirmed, and its authentication behavior has been reviewed, create a Localtonet HTTP tunnel to that exact listener. Run our client on the NowAIKit host whenever practical. This avoids LAN binding changes when the dashboard listens only on loopback.

HTTP and File Server tunnels can use a Random Sub Domain, Custom Sub Domain, or Custom Domain Process Type. These options serve the same target at a public HTTPS address. Availability can vary by plan and current dashboard configuration. Check current DNS instructions before using a custom domain.

See the Localtonet HTTP tunnel documentation for current product controls. Values shown in the authenticated dashboard take precedence over old screenshots or examples.

Select the correct target address

If Localtonet and NowAIKit run on the same host, use the verified local address and port printed by the dashboard process. If our client runs on another machine, a dashboard bound to localhost or another loopback address will not be reachable from it.

In a separate-device topology, NowAIKit must use an officially supported LAN-reachable bind address and local network policy must permit the connection. This article does not invent a dashboard bind flag. If your release does not document one, run Localtonet on the dashboard host instead of guessing command options or weakening host networking controls.

Secure the dashboard and ServiceNow access

Publishing a previously local service changes its threat boundary. Requests can now reach the selected listener from the public internet. Treat the dashboard as an internet-facing application for as long as the tunnel is running.

Apply least privilege at every layer

Use a dedicated ServiceNow identity or per-user OAuth identities with only the roles required for the intended work. Keep NowAIKit at its default read tier until a reviewed use case requires more. Choose a role package that limits visible tools rather than loading capabilities unrelated to the user's responsibilities.

Enable write, CMDB, scripting, or agentic capabilities one category at a time in a non-production instance. Test both allowed and denied actions. Enabling a NowAIKit tier does not grant ServiceNow permissions, and having a ServiceNow role does not mean that every possible AI-assisted action is approved.

Separate connectivity from authorization

Localtonet forwards requests to the configured target. It does not decide which dashboard user may view records or invoke operations. Use the authentication and session controls supported by the current NowAIKit dashboard, then test them from an unauthenticated browser before public access begins.

If your organization requires network-level restrictions, apply controls that are actually available in the current Localtonet account and deployment. Do not assume that a plan includes a particular restriction, region, or access feature without checking the dashboard.

Protect files, tokens, and logs

Restrict access to NowAIKit configuration files and OAuth material. Exclude them from source control and unmanaged synchronization. Redact screenshots and terminal output because they can reveal usernames, instance names, local paths, public tunnel URLs, or tokens.

Review logs across the AI client, NowAIKit, ServiceNow, the operating system, and any model provider. The current NowAIKit documentation identifies audit logging and organization policy controls as Enterprise capabilities, so confirm entitlement before relying on them. Where audit logging is required, verify that it is enabled and retained under organizational policy rather than assuming every installation records every tool call.

Minimize exposure time

Start the tunnel only for the period in which remote dashboard access is needed, then stop it. For persistent access, assign ownership for updates, monitoring, access review, credential rotation, incident response, and ServiceNow permission review. A development listener should not become an unreviewed permanent service.

Routine operation, updates, and troubleshooting

Recommended startup order

Start from the innermost dependency. Confirm that ServiceNow is reachable and the intended identity is valid. Verify local MCP operation. Start the licensed dashboard and test its exact local URL. Start the Localtonet client, then start the existing HTTP tunnel. Finally, test the public URL from an external device.

Recommended shutdown order

Stop the Localtonet tunnel first so new public requests cannot reach the dashboard. Stop the NowAIKit dashboard process next. If the machine no longer needs any Localtonet tunnels, stop our client as well. Delete obsolete tunnels and revoke credentials that no longer serve an approved deployment.

Useful NowAIKit maintenance commands

nowaikit instances list
nowaikit setup --add
nowaikit auth login
nowaikit auth whoami

Use the instance list to confirm configured environments before making changes. The setup command with --add adds another instance. The authentication commands begin per-user sign-in and show the active identity.

Test one layer at a time

Test the target first on the NowAIKit host. If Localtonet runs elsewhere, test the same target from that device over the local network. Test the public URL only after both local stages succeed. The first failing stage identifies the layer that needs attention.

Avoid changing authentication, ServiceNow roles, NowAIKit permission tiers, listener addresses, and tunnel settings in one attempt. Make one controlled change and repeat the smallest relevant test.

Update conservatively

Record the working NowAIKit version and protect configuration backups before updating. Test the new version against a non-production ServiceNow instance. Recheck OAuth, active identity, client configuration, permission tiers, dashboard entitlement, dashboard authentication, and the listener address.

If an update changes the dashboard port, update the Localtonet target. If it changes the OAuth flow from a secret-based client to PKCE, follow the new release's migration guidance rather than retaining obsolete credentials. Recheck the ServiceNow support window because the project's n-2 list changes over time.

Frequently asked questions