servicenow-mcp-ai
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@servicenow-mcp-aiShow me all open incidents with priority 1"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
servicenow-mcp-ai β ServiceNow MCP Server
A Model Context Protocol server that lets an MCP client (VS Code, Claude Desktop, etc.) run commands against a ServiceNow instance through its REST APIs β Table, Aggregate, Attachment, Import Set, Batch and CMDB, plus the Service Catalog, Change Management and Knowledge plugin APIs. Credentials are kept in a local env file and can be updated at runtime through a tool.
Upgrading from 1.x? v2.0 makes writes plan-by-default:
create/update/deleteand the other record-write tools return a non-mutating preview unless you passapply: true(or setSN_WRITE_MODE=applyto restore the v1 "execute immediately" behaviour). See the CHANGELOG β 2.0.0 for the full migration note.
Contents: Quick demo Β· Features Β· Requirements Β· Setup Β· Configure credentials Β· Run / debug Β· Develop Β· Tools Β· Resources Β· Prompts Β· Project structure Β· Security notes Β· Project documentation Β· Support
Built and maintained in my own time β if it helps, a GitHub Sponsors tip keeps it going. Full Support options are near the end.
Quick demo
Three things the platform makes hard, one call each. Point your MCP client at an instance (Setup) and ask:
1. "Where is this field actually used?" β every script, business rule, client script, UI policy/action and ACL that touches it, as JSON or a Mermaid graph. The IDE-grade find usages ServiceNow has no button for:
// servicenow_where_used
{
"kind": "field", // "table" | "field" | "script"
"name": "u_cost_center",
"mermaid": true, // also render a reference graph
}2. "What runs when I save this record?" β the full automation chain in execution order (display β before β after β async business rules, then flows, workflows and notifications), each with its condition β a logical test that runs nothing:
// servicenow_trace_table_event
{
"table": "incident",
"operation": "update", // insert | update | delete | query
}3. "What drifted between dev and prod?" β a Markdown diff of tables, columns, scripts (by SHA-256) and plugins between two configured profiles, with a CI-friendly exit code so a pipeline can block a risky deploy:
servicenow-mcp-ai drift dev prod # report on stdout; exit 1 on drift, 0 if cleanAll three are read-only and work against any instance β including a free PDI β with the model and client of your choice.
Related MCP server: @onlyflows/servicenow-mcp
Features
Full Table API: query, read, create, update and delete records on any table, with encoded queries, field selection and pagination.
Extra ServiceNow APIs: Aggregate (Stats), Attachment (list/upload/download/delete), Import Set, Batch (many REST calls in a single request), plus table/column metadata (
sys_db_object,sys_dictionary).Process & plugin APIs: CMDB (class-aware CI CRUD + meta via IRE), Service Catalog (browse/order items), Change Management (typed creation + conflict detection) and Knowledge (article search). Plugin-scoped APIs report clearly when not active on the instance.
Script intelligence: read and search the instance's own code (business rules, script includes, client scripts, UI policies/actions, scheduled jobs, transform/REST scripts, ACLs) and get a table's full automation picture β all read-only over the Table API.
Flow tracing & code checking (Phase 8): deterministically trace what a table operation runs (
flowspackage β business rules, flows, workflows and notifications, in order, with a Mermaid flowchart), read Flow Designer flows and run history, and lint scripts against a local rule set with an aggregate code-health report (codecheck). Run ATF tests via the CI/CD API (atf, opt-in, non-default β the run tools execute on the instance).Self-documentation: a local Markdown knowledge base (read/write/search) plus deterministic Mermaid generators (ER diagrams from references, record-lifecycle flowcharts from business rules) so the server builds durable, reusable context.
Prompts: ready-made workflows (incident triage, change impact analysis, document a table) that orchestrate the tools.
Tool packages: load only the tool groups you need via
SN_TOOL_PACKAGES(default profilecore;allenables everything).Basic or OAuth 2.0 authentication over HTTPS; the password/token is never echoed back.
Least-privilege controls: table allow/deny lists and a global read-only mode.
Resilience: per-request timeout, retry with backoff and
Retry-After, SSRF guard, and a result-size guard.MCP tool annotations and resources, structured error payloads, and structured logging on stderr.
Credentials in an env file (project,
~/.config, orSN_ENV_FILE), updatable at runtime viaservicenow_set_credentials.
Requirements
Node.js 20+ (enforced:
engines+ a runtime guard with a clear message; the project targets the version in.nvmrc).
Setup
From source (for development):
npm install
npm run buildOr run the published package directly, without cloning:
npx servicenow-mcp-aiRegister it with an MCP client (Claude Desktop, VS Code Chat, the Inspectorβ¦) by
pointing the server command at npx:
{
"mcpServers": {
"servicenow": {
"command": "npx",
"args": ["-y", "servicenow-mcp-ai"]
}
}
}Claude Code plugin (zero-config β installs the server wired up):
/plugin marketplace add IvanBBaev/servicenow-mcp-ai
/plugin install servicenow-mcp-aiVS Code β install the ServiceNow MCP extension from the Marketplace
(code --install-extension ivanbbaev.servicenow-mcp-ai); it registers the server
in Copilot Chat (agent mode) automatically, no manual mcp.json. Source:
extension/.
Credentials are read from ~/.config/servicenow-mcp-ai/.env (or real environment
variables) β see below.
Quickstart
The fastest path is three lines of Basic auth β set these (in the env file or the real environment) and you are connected:
SN_INSTANCE=dev12345.service-now.com
SN_USER=your.username
SN_PASSWORD=your-passwordEverything else is optional tuning; see the full Environment variables reference for the rest.
Past a quick try, prefer OAuth over a stored password. For anything shared or long-lived, run the one-time
npx servicenow-mcp-ai logininstead β it stores a refresh token, not your password. See Configure credentials β OAuth 2.1.
Verify your setup
Once the three variables are set, confirm the connection before you start:
Run the
servicenow_test_connectiontool β it reads onesys_userrecord and reportsok, HTTP status and latency.Run
servicenow_check_capabilitiesβ it previews which admin-restrictedsys_*tables the connected user can actually read.
Or do both from the shell in one shot:
npx servicenow-mcp-ai doctor # checks credentials, reachability and capabilitiesConfigure credentials
Credentials live in .env at the project root (git-ignored):
SN_INSTANCE=your-instance.service-now.com
SN_USER=your.username@example.com
SN_PASSWORD=your-passwordSN_INSTANCE accepts dev12345, dev12345.service-now.com or a full https:// URL.
You can also set or change them at runtime by calling the
servicenow_set_credentials tool β the new values are written straight back to the env file.
The env file is resolved in this order: SN_ENV_FILE, then
~/.config/servicenow-mcp-ai/.env (XDG) if present, then the project-root .env.
A global/npx install therefore writes to your user config rather than into
node_modules. Real environment variables always take precedence over the file.
OAuth 2.1 (Authorization Code + PKCE) β recommended
Register an Authorization Code OAuth API endpoint in ServiceNow with a
loopback redirect URL (e.g. http://localhost:53682/callback), set
SN_OAUTH_CLIENT_ID (and SN_OAUTH_CLIENT_SECRET for a confidential client),
then run the one-time interactive login:
npx servicenow-mcp-ai loginIt opens the browser, you approve, and the obtained refresh token is stored in your env file. The server then runs non-interactively (refresh_token grant) β no password is ever stored. PKCE (S256) is always used.
The OAuth 2.0 password grant (ROPC) is deprecated in OAuth 2.1 and disabled on many instances; prefer
login.client_credentialsandrefresh_tokengrants remain supported for service accounts. See .env.example.
Supported authentication methods
Every inbound REST auth method ServiceNow offers is covered:
Method |
| Set | Notes |
Basic |
|
| Default. |
OAuth 2.1 β Authorization Code + PKCE |
|
| Recommended. Interactive, stores a refresh token. |
OAuth β Client Credentials |
|
| Service-to-service. |
OAuth β Refresh Token |
|
| Set by |
OAuth β JWT Bearer |
|
| RS256 assertion; no password. |
OAuth β Password (ROPC) |
|
| Deprecated. |
API Key |
|
|
|
Bearer token |
|
| Pre-obtained token, used verbatim. |
Mutual TLS (client cert) |
|
| Cert maps to a user; needs optional |
Environment variables
All settings are read from .env (or the real process environment, which takes
precedence). Only the first three are required; the rest are optional tuning knobs.
See .env.example for a template.
Variable | Required | Default | Description |
| yes | β | Instance name, host, or |
| yes | β | ServiceNow username for Basic auth. |
| yes | β | ServiceNow password. Never logged or returned by any tool. |
| no |
| Per-request timeout in milliseconds. |
| no |
| Retries for transient failures (429/5xx, network errors). Non-idempotent writes are only retried on connect errors. |
| no |
| Hard cap on records returned by a |
| no |
| Character budget for a query result before it is truncated for the client. |
| no | β | Comma-separated allow-list of permitted hosts (for custom or sovereign-cloud domains). When set, only matching hosts are contacted. When unset, only |
| no | auto | Auth method: |
| no | β | ServiceNow Inbound API Key, sent as the |
| no | β | A pre-obtained bearer token, sent verbatim as |
| no | β | OAuth client id (its presence enables OAuth). |
| no | β | OAuth client secret. |
| no |
| OAuth grant: |
| no | β | PEM private key for the |
| no | β | Refresh token for the |
| no |
| Loopback redirect URL for the PKCE |
| no | β | Optional OAuth scope requested during |
| no | β | Client certificate (PEM) for mutual TLS (or |
| no | β | Private key (PEM) for the client certificate (or |
| no | β | Optional CA bundle (PEM) to trust (or |
| no | β | Comma-separated table allowlist; when set, only these tables are reachable. |
| no | β | Comma-separated table denylist; always wins over the allowlist. |
| no |
| When truthy, refuse every create/update/delete. |
| no |
|
|
| no | β | DF-5: mask these field values before records reach the model (comma/space-separated). |
| no |
| DF-5: also mask email/phone/national-id patterns inside string values. |
| no |
| DF-6: |
| no |
| DF-6: TCP port for the http transport. |
| no |
| DF-6: bind address for the http transport (loopback by default). |
| no | β | DF-6: when set, http requests must send |
| no |
| Log verbosity on stderr: |
| no | β | Explicit path to the env file to read/write. |
| no |
| Comma/space-separated tool packages or profiles to enable. Profiles: |
| no | β | Comma/space-separated packages to exclude even if enabled by |
| no | β | Comma/space-separated packages whose write tools are not registered; their read tools stay. Per-package complement to the global |
| no |
| TTL for the near-static schema reads cache ( |
| no |
| Maximum parallel HTTP requests to the instance (simple in-process semaphore). |
| no |
| Reference fields come back without their |
| no |
| Tool results are compact JSON by default (pretty-printing ~doubles tokens). Set |
| no |
| Directory the |
| no |
| Opt in to the Code Search API ( |
| no | β | Named connection profiles: |
| no |
| Which profile tools use. Switch at runtime with |
Two-axis access policy
Access is controlled on two independent axes, because a table restriction does not reach the plugin-backed APIs (Change, Catalog, Knowledgeβ¦). Guard both:
Axis | Enable / deny / read-only | Example |
Tables |
|
|
Packages |
|
|
So denying the change_request table still leaves the Change Management API
(sn_chg_rest) able to read/write changes β the package axis is why it exists.
See Security notes for the full model (including how the Batch
API obeys both axes).
List syntax: table lists (SN_TABLES_ALLOW / SN_TABLES_DENY) are
comma-separated; package lists (SN_TOOL_PACKAGES, SN_PACKAGES_DENY,
SN_PACKAGES_READONLY) accept commas or whitespace. Surrounding spaces are
trimmed in both, and table matching is case-insensitive β so
SN_TABLES_DENY=Change_Request, sys_user works.
Run / debug
VS Code: open the Command Palette and start the server defined in .vscode/mcp.json, then use it from Chat.
MCP Inspector:
npm run inspectorDirectly:
npm start
Command-line interface
The published servicenow-mcp-ai binary (run it directly, or via
npx servicenow-mcp-ai) has three invocations. All connection settings come from
environment variables / the env file (see Environment variables);
only drift takes positional arguments.
Command | Positional parameters | What it does | Exit codes |
| (none) | Starts the MCP server. The transport ( |
|
| (none β operates on the active profile) | One-time OAuth 2.1 Authorization Code + PKCE login: opens the browser, captures the loopback redirect, stores a refresh token. |
|
|
| DF-3 CI drift gate: compares the two instances and writes a Markdown diff report. |
|
login operates on the active profile (SN_ACTIVE_PROFILE, default
default) and reads, for that profile:
SN_INSTANCEβ required; the target instance.SN_OAUTH_CLIENT_IDβ required; client id of an Authorization Code OAuth API endpoint.SN_OAUTH_CLIENT_SECRETβ optional; for a confidential client.SN_OAUTH_REDIRECT_URIβ optional; loopback URL, defaulthttp://localhost:53682/callback. Must match the redirect registered on the endpoint.SN_OAUTH_SCOPEβ optional; requested OAuth scope.
On success it writes SN_AUTH=oauth, SN_OAUTH_GRANT=refresh_token and
SN_OAUTH_REFRESH_TOKEN back to the env file (profile-prefixed when the profile
is not default). The authorization URL is printed on stderr in case the browser
does not open automatically.
drift takes two positional profile names; each must resolve to a configured
profile (SN_PROFILE_<NAME>_*, or the bare SN_INSTANCE / SN_USER /
SN_PASSWORD keys for default). The Markdown report is written to stdout
(capture it as a CI artifact); a one-line drift summary goes to stderr.
CI drift gate (DF-3)
Compare two configured profiles and fail a pipeline on configuration drift:
servicenow-mcp-ai drift dev prod # report on stdout; exit 1 on drift, 0 if clean, 2 on errorDevelop
npm run check # full gate: build, lint, format check, coverage-gated tests, prod audit
npm test # unit tests only (node:test; needs a prior npm run build)
npm run lint # ESLint (flat config + typescript-eslint)
npm run format # format with PrettierSee CONTRIBUTING.md for the conventions (one commit per task, tests ship with the change, generated docs).
Tools
This table is generated from the tool registrations β edit the tool
definitions in src/tools/, then run npm run docs:readme.
Package | Tool | Read-only | Description |
|
| yes | Read records from any ServiceNow table through the Table API |
|
| yes | Read a single record from a table by its sys_id |
|
| no | Create a new record in a table with the given field values |
|
| no | Update fields on an existing record identified by its sys_id |
|
| no | Delete a record from a table by its sys_id |
|
| yes | List tables from sys_db_object, optionally filtered by a name or label fragment |
|
| yes | List a table's columns (name, label, type, mandatory, reference) from sys_dictionary |
|
| yes | Compute server-side aggregates (count, avg, min, max, sum) over a table via the Stats API, with optional gr⦠|
|
| yes | List attachment metadata, optionally scoped to a specific record (table + sys_id) |
|
| yes | Read a single attachment's metadata by its sys_id |
|
| yes | Download an attachment's bytes, returned as base64 |
|
| no | Attach a file (provided as base64) to a record identified by table + sys_id |
|
| no | Delete an attachment by its sys_id |
|
| no | Insert a single row into a staging table and run its transform map |
|
| yes | Read the transform outcome for a previously inserted staging row by its sys_id |
|
| no | Execute several ServiceNow REST sub-requests in a single HTTP round-trip via the Batch API |
|
| yes | List the Service Catalogs available on the instance (Service Catalog API) |
|
| yes | List the categories within a service catalog |
|
| yes | Search/list orderable catalog items, optionally by text or category |
|
| yes | Get a catalog item, including its order variables, by sys_id |
|
| no | Order a catalog item directly ('order now') |
|
| yes | List change requests through the Change Management API |
|
| yes | Get a single change request by sys_id |
|
| no | Create a normal, standard or emergency change |
|
| no | Update fields on a change request by sys_id |
|
| no | Read schedule conflicts for a change, or recalculate them (calculate=true) |
|
| yes | Full-text search of knowledge articles (Knowledge API), with optional encoded query and paging |
|
| yes | Get a knowledge article (content and metadata) by sys_id |
|
| yes | List featured or most-viewed knowledge articles for the current user |
|
| yes | List configuration items of a CMDB class through the class-aware CMDB Instance API |
|
| yes | Get a CI with its attributes and inbound/outbound relations by class and sys_id |
|
| no | Create a CI via the CMDB Instance API (routed through Identification & Reconciliation) |
|
| no | Update a CI's attributes via the CMDB Instance API (IRE) |
|
| yes | Get the schema/metadata of a CMDB class (attributes, relationship rules) from the CMDB Meta API |
|
| yes | List script artefacts of one type as compact metadata (no source code) |
|
| yes | Read one script artefact in full, including its source code and execution context |
|
| yes | Search script source for a literal substring across one or all script types |
|
| yes | Assemble the automation that runs on a table: business rules (ordered by when+order), client scripts, UI po⦠|
|
| yes | Find where a table, field or script is referenced across the instance's code: textual references in every s⦠|
|
| yes | Deterministically trace what ServiceNow would run for a table operation, in execution order: display/before⦠|
|
| yes | List Flow Designer flows (sys_hub_flow) or legacy workflows (kind: 'workflow') as compact metadata |
|
| yes | Get a structured view of one flow or workflow: its trigger (table/condition/when) and ordered steps |
|
| yes | Read flow execution evidence from sys_flow_context β by flow sys_id or by the record (document) it ran agaiβ¦ |
|
| yes | Run deterministic code-quality rules over one script artefact (hard-coded sys_ids/URLs, unbounded or in-loo⦠|
|
| yes | Lint every active business rule, client script and UI policy of a table (via table_logic), returning per-sc⦠|
|
| no | Aggregate code-health picture: script counts by type, a security scan of the access-control layer (ACL scri⦠|
|
| yes | List the Markdown documents in the local instance-documentation folder (SN_DOCS_DIR) |
|
| yes | Read one Markdown document from the local instance-documentation folder |
|
| yes | Search the local instance documentation for a substring; returns a snippet per match |
|
| no | Create or overwrite a Markdown document in the local docs folder and refresh index.md |
|
| yes | Build a Mermaid erDiagram from sys_dictionary: an entity per table plus a relationship for every reference β¦ |
|
| yes | Build a Mermaid flowchart of a record's lifecycle on a table, grouping active business rules by phase (disp⦠|
|
| no | Download the instance's structural metadata into the local docs folder (SN_DOCS_DIR//): tables.md+β¦ |
|
| no | Diff two connection profiles: tables present in only one, common columns whose type/mandatory/reference dif⦠|
|
| no | Send an email through the instance's Email API, optionally associated with a record (table + sys_id) |
|
| yes | Read a sent/received email record by its sys_id (Email API) |
|
| yes | List Automated Test Framework tests (sys_atf_test) as metadata: name, active flag, description |
|
| yes | List Automated Test Framework test suites (sys_atf_test_suite) as metadata |
|
| no | Run a single ATF test through the CI/CD API |
|
| no | Run an ATF test suite through the CI/CD API |
|
| yes | Poll an ATF run by its execution id: status, percent complete and message (CI/CD progress API) |
|
| no | Save or update the ServiceNow connection credentials |
|
| yes | List the configured ServiceNow connection profiles (instances): name, host, user, read-only flag and whethe⦠|
|
| no | Switch the active ServiceNow connection profile (persisted to the env file) |
|
| yes | Show the configured instance, user, auth mode and access policy, and whether credentials are complete |
|
| yes | Verify that the configured credentials actually work: reads one sys_user record and reports ok/status/latency |
|
| yes | Preflight which admin-restricted sys_* tables the connected user can actually read, and report which higher⦠|
All tools carry MCP annotations (readOnlyHint, destructiveHint,
idempotentHint) so clients can apply the right confirmation UX.
Tool packages
Tools are grouped into packages so you can expose only what a given client needs
(fewer tools keep the model focused). Set SN_TOOL_PACKAGES to a comma/space
separated list of profiles or package names:
core(default) βtable,schema,aggregate,attachment.allβ every package below.Individual packages:
table,schema,aggregate,attachment,importset,batch,catalog,change,knowledge,cmdb,scripts,flows,codecheck,docs,instance,email,atf.
The admin tools (servicenow_set_credentials, servicenow_get_status) are
always registered, regardless of the active packages. Unknown names are ignored.
servicenow_get_status reports the resolved enabledPackages.
# Only table + batch tools (plus the always-on admin tools)
SN_TOOL_PACKAGES=table,batchPresets
If you would rather not curate the list yourself, three named presets cover the
common roles. The admin tools are always on, so they are not listed. Each preset
also has a one-word alias β SN_TOOL_PACKAGES=reader|developer|admin β that
expands to the same package set.
Preset |
| For whom |
|
| First contact, analysts, a PDI play β read and query only. |
|
| The core segment: script intelligence, flow tracing, linting, docs and diagrams. |
|
| Everything, including the plugin and write-heavy packages. |
The developer preset builds on the reader set; the docs package includes the
Mermaid diagram generators. Use the alias for brevity or spell the packages out to
add or drop one.
Examples
Query the 5 most recent active incidents:
// servicenow_query_table
{
"table": "incident",
"query": "active=true^ORDERBYDESCsys_created_on",
"fields": ["number", "short_description", "priority", "state"],
"limit": 5,
}Create an incident:
// servicenow_create_record
{
"table": "incident",
"fields": {
"short_description": "Printer on 3rd floor is down",
"urgency": "2",
"impact": "2",
},
}Update credentials at runtime:
// servicenow_set_credentials
{
"instance": "dev98765.service-now.com",
"user": "admin",
"password": "β’β’β’β’β’β’",
}Resources
Read-only metadata is also exposed as MCP resources, so clients can attach it declaratively instead of calling a tool:
URI | Description |
| Connection status, auth mode, access policy. |
| List of tables from |
| Columns of a table from |
| A Markdown document from the local docs store. |
Prompts
Ready-made workflows are exposed as MCP prompts; they orchestrate the tools and insist on reading real values from the instance:
Prompt | Argument | Purpose |
|
| Summarize, assess priority, categorize and recommend next steps. |
|
| Affected CIs, schedule conflicts and a go/no-go call. |
|
| Schema + automation + diagrams β saved Markdown doc. |
Project structure
.
βββ .env # credentials (git-ignored; or ~/.config/servicenow-mcp-ai/.env)
βββ .env.example # template
βββ .github/workflows/ # CI: build + lint + test
βββ .vscode/mcp.json # VS Code MCP server registration
βββ eslint.config.js # ESLint flat config
βββ .prettierrc.json # Prettier config
βββ src/
β βββ index.ts # bootstrap: load env, register, connect stdio
β βββ registry.ts # registers all tool groups
β βββ resources.ts # MCP resources (status, tables, schema, docs)
β βββ prompts.ts # MCP prompts (triage, change impact, document table)
β βββ http.ts # shared REST client (auth, retry, SSRF)
β βββ auth.ts # Basic + OAuth 2.0 providers
β βββ host.ts # host resolution + SSRF guard
β βββ policy.ts # table allow/deny + read-only guards
β βββ settings.ts # numeric env settings
β βββ logging.ts # structured stderr logger
β βββ result.ts # tool results + structured errors
β βββ servicenow.ts # Table API client
β βββ config.ts # env file read/write + location
β βββ api/ # aggregate, attachment, import set, batch, catalog, change, knowledge, cmdb, scripts, diagrams, docs, meta
β βββ tools/ # tool registration per API group
βββ test/ # node:test unit + mock-fetch tests
βββ build/ # compiled output (after npm run build)Note on names: the npm package and the GitHub repository are both
servicenow-mcp-ai(the unscopedservicenow-mcpwas already taken on npm); the local working folder isservicenow-mcp. The difference is cosmetic and does not affect the build or runtime.
Security notes
The env file is git-ignored β do not commit real credentials.
The env file is written owner-only (
0600) β it holds a plaintext password.The server uses the stdio transport and only logs to
stderr; secrets and raw encoded queries are never logged.The password/token is never returned by any tool.
Hosts are restricted: without
SN_ALLOWED_HOSTS, only*.service-now.cominstances are contacted (internal/loopback always blocked), so a redirected or mistyped host cannot silently receive credentials. SetSN_ALLOWED_HOSTSto opt in a custom or sovereign-cloud domain.Prefer OAuth 2.0 over Basic where possible (
SN_OAUTH_CLIENT_ID).Apply least privilege with
SN_TABLES_ALLOW/SN_TABLES_DENYandSN_READONLY=truefor read-only deployments.Table policy does not cover plugin APIs.
SN_TABLES_DENY=change_requestblocks the Table API path, but the Change Management API (sn_chg_rest) can still read/write changes. To restrict the plugin-backed surfaces useSN_PACKAGES_DENY(drop the whole package) orSN_PACKAGES_READONLY(register only its read tools). The Batch API obeys both axes too: a sub-request to a denied package's path is refused, and writes to a read-only package are blocked β a batch cannot be used to bypass the package policy.
Project documentation
Document | Contents |
Layered architecture, Mermaid diagrams (modules, request lifecycle, security model, auth, packages), condensed ADRs | |
Current product state: API coverage map, quality status, history timeline, roadmap | |
Forward plan: ship 1.0.0, Phase 8 (flow testing + code analysis), Phase 9 (competitive differentiators), optional and deferred items | |
Positioning vs the official ServiceNow MCP Server Console: comparison, where it structurally lags, the Phase 9 boost plan, and platform risks | |
Detailed specs for the upcoming phases (harness 2.0, multi-instance, flow testing) | |
Completed work with commit refs / remaining decisions | |
Detailed work journal / user-facing changelog | |
Dev setup, gates and conventions / security model and reporting |
Support
This project is built and maintained in my own time. If it saves you or your team time, please consider supporting its continued development β sponsorship directly funds new tools, bug fixes and keeping pace with ServiceNow's REST surface.
GitHub Sponsors β one-off or recurring, with no platform fee taken out (the preferred option).
Ko-fi β quick one-off support; it also accepts PayPal, so it's the fallback for anyone without a GitHub account.
Donate (Donatree) β a no-account donation page (card, PayPal and more) for a one-off tip.
Trademark
servicenow-mcp-ai is an independent, community-built project. It is not
affiliated with, endorsed by, or sponsored by ServiceNow, Inc.
"ServiceNow", the ServiceNow logo, "Now", and related marks are trademarks or registered trademarks of ServiceNow, Inc. in the United States and other countries. They are used in this project's name and documentation only nominatively β to identify the platform this software interoperates with β and no affiliation or endorsement is implied. All other product names and marks are the property of their respective owners.
This project is licensed under the MIT License; that license covers the source code and does not grant any rights to use the ServiceNow trademarks.
Available Tools
19 toolsservicenow_aggregateAggregate ServiceNow recordsARead-only
Compute server-side aggregates (count, avg, min, max, sum) over a table via the Stats API, with optional grouping. Avoids pulling individual rows.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Include a record count (sysparm_count). | |
| query | No | Encoded query to filter rows before aggregating. | |
| table | Yes | Table name, e.g. 'incident'. | |
| having | No | HAVING clause to filter groups (sysparm_having). | |
| group_by | No | Fields to group by. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. | |
| avg_fields | No | Numeric fields to average. | |
| max_fields | No | Fields to take the maximum of. | |
| min_fields | No | Fields to take the minimum of. | |
| sum_fields | No | Numeric fields to sum. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true, and the description adds useful behavioral context: computation happens server-side, uses the Stats API, supports grouping, and avoids downloading rows. This meaningfully extends the structured metadata without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, and no redundant words. The efficiency cue 'Avoids pulling individual rows' earns its place by informing agent decision-making.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter tool with no output schema, the description covers the essential behavioral contract: what it computes, how it computes it, and why it is preferable to row-level queries. The main gap is not spelling out the return shape, but annotations and schema coverage reduce the burden considerably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all 10 parameters. The description adds only the high-level concept of 'optional grouping', which is consistent with group_by and having but does not deepen parameter-level meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Compute'), a clear resource ('a table'), and the exact operations ('count, avg, min, max, sum') via the Stats API. 'Avoids pulling individual rows' distinguishes it from row-returning sibling tools like servicenow_query_table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when server-side aggregates are needed instead of fetching individual rows. It does not name the alternative explicitly or list exclusion conditions, but the context is strong enough for an agent to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_check_capabilitiesCheck achievable capabilitiesARead-only
Preflight which admin-restricted sys_* tables the connected user can actually read, and report which higher-level capabilities (schema reads, script intelligence, ACL audit) are achievable. Run this before relying on the scripts/flows/codecheck tools on a governed instance β on a least-privilege account those reads may be silently empty.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only and open-world, and the description adds useful behavioral context: it reports achievable capabilities and warns that reads may be silently empty in restricted environments. It does not describe exact output structure, but the warning adds meaningful transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the purpose, and adds a concrete usage warning. Every sentence contributes useful information without fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only preflight tool with one optional parameter, annotations, and a clear description, the definition is complete. It states what it checks, when to use it, and the key risk it mitigates, so an agent can select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, 'instance', is fully described in the schema as the connection profile with a default and a pointer to servicenow_list_instances. With 100% schema coverage, the description doesn't need to add parameter details, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Preflight') and names the concrete resource (admin-restricted sys_* tables) plus the higher-level capabilities being checked. This clearly distinguishes the tool from record/query/attachment siblings, which perform different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to run this before relying on scripts/flows/codecheck tools on a governed instance, and warns about silently empty reads on least-privilege accounts. This gives clear contextual guidance, though it does not explicitly list when NOT to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_create_recordCreate ServiceNow recordB
Create a new record in a table with the given field values.
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | Execute the change. In the default plan mode, omitting this returns a non-mutating before/after preview; set true to apply. SN_WRITE_MODE=apply makes execution the default. | |
| table | Yes | Table name, e.g. 'incident'. | |
| fields | Yes | Field name/value pairs for the new record, e.g. { "short_description": "Printer down", "urgency": "2" }. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the disclosure burden. It says a record is created but does not mention that the default plan mode can return a non-mutating preview unless 'apply' is true, nor does it disclose side effects or write-mode requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A short, front-loaded single sentence with no filler. Every word earns its place, and the core operation is stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description does not explain return behavior, the apply/preview default, or error conditions. For a mutation tool with a notable 'apply' nuance, this is too sparse to fully enable a correct call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the input schema fully documents 'table', 'fields', and 'apply'. The description adds little beyond the phrase 'given field values', which loosely maps to the 'fields' parameter without providing extra semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Create') and a clear resource ('a new record in a table with the given field values'). It is unambiguous and distinguishes itself from siblings like servicenow_update_record, servicenow_query_table, and servicenow_delete_record.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to choose this tool over alternatives, prerequisites, or conditions such as write mode or an existing table. The only usage signal is the verb itself, which implies the purpose but does not explicitly route the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_delete_attachmentDelete ServiceNow attachmentBDestructiveIdempotent
Delete an attachment by its sys_id.
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | Execute the change. In the default plan mode, omitting this returns a non-mutating before/after preview; set true to apply. SN_WRITE_MODE=apply makes execution the default. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. | |
| attachment_sys_id | Yes | The sys_id of the attachment to delete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It only says 'Delete' and does not mention irreversibility, permissions, or the plan-mode preview behavior described in the apply parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, front-loading the action and target. It is appropriately sized for the minimal information it conveys.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation with no annotations and no output schema, the description is too sparse. It misses prerequisites, side effects, and execution-mode caveats; only the schema's apply and instance fields partially fill this gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters have meaningful descriptions in the schema, so the baseline is 3. The description's 'by its sys_id' adds little beyond what the schema already states for attachment_sys_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact operation (delete), the resource (attachment), and the selection method (by sys_id). This is clearly distinct from sibling tools like servicenow_delete_record and the other attachment-related operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives, nor does it mention how to obtain the required sys_id. It relies on the schema for context but provides no exclusion or alternative references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_delete_recordDelete ServiceNow recordBDestructiveIdempotent
Delete a record from a table by its sys_id.
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | Execute the change. In the default plan mode, omitting this returns a non-mutating before/after preview; set true to apply. SN_WRITE_MODE=apply makes execution the default. | |
| table | Yes | Table name, e.g. 'incident'. | |
| sys_id | Yes | The sys_id of the record to delete. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not mention that deletion may be irreversible, that permissions are required, or the plan-mode nuance where omitting apply returns a non-mutating preview. The schema's apply parameter hints at this, but the description itself adds no behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient, front-loaded sentence with no filler. However, it is very sparse and leaves out important caveats like the plan-mode behavior, so while it is concise, it is not as informative as a top-tier description could be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema is rich and documents apply and instance, which helps an agent understand the mechanics. But with no annotations and no output schema, the description leaves out the destructive/preview caveat and does not clarify what response or side effects to expect. It is minimally adequate but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides high-coverage descriptions for all four parameters (apply, table, sys_id, instance), so the baseline is 3. The description only mentions sys_id in passing and adds no meaning about table names, the apply flag, or connection profiles beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (Delete), targets a concrete resource (a record in a ServiceNow table), and identifies the lookup key (sys_id). This clearly distinguishes it from sibling tools such as servicenow_get_record, servicenow_update_record, and servicenow_delete_attachment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives, no exclusions, and no mention of cases where a non-destructive operation or an attachment deletion would be more appropriate. The intended usage is only implied by the tool name and title.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_describe_tableDescribe ServiceNow tableARead-only
List a table's columns (name, label, type, mandatory, reference) from sys_dictionary.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name to describe, e.g. 'incident'. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the read-only nature is covered. The description adds useful behavioral context by naming the exact source table and the fields returned, but it does not describe error behavior, instance resolution, or any external network implications despite openWorldHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and resource, then compacts the output fields into a parenthetical list. There is no filler or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only describe operation with one required parameter, the description provides sufficient context: what it lists, where it reads from, and which columns are returned. The absence of an output schema is mitigated by the explicit field list in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both 'table' and 'instance' clearly described. The description adds mild context by clarifying that the output comes from sys_dictionary, but the parameters themselves are already well documented in the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('a table's columns') and identifies the data source ('from sys_dictionary'). It clearly distinguishes this tool from siblings like servicenow_list_instances or servicenow_get_status, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when you need table column metadata from sys_dictionary. It does not explicitly state when-not-to-use or name alternative tools for related tasks, but the sibling context makes the intended use reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_download_attachmentDownload ServiceNow attachmentARead-only
Download an attachment's bytes, returned as base64. Large files are refused (see SN_MAX_RESULT_CHARS).
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. | |
| attachment_sys_id | Yes | The sys_id of the attachment to download. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, but the description adds valuable behavioral detail: the output is base64 and large files will be refused referencing SN_MAX_RESULT_CHARS. This goes beyond what annotations provide and sets clear expectations for the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using two short sentences. The primary action and output format are front-loaded, and the key limitation is stated without ambiguity. Every word contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple download operation with only one required parameter and no output schema, the description covers all essential aspects: what it does, the return format, and a critical size limitation. No additional context is needed for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides complete descriptions for both parameters (instance and attachment_sys_id), so the description does not need to add param-level detail. It does indirectly reference a size constraint via SN_MAX_RESULT_CHARS, but this is not tied to a specific parameter. This aligns with the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('Download') on a specific resource ('an attachment's bytes') and specifies the return format ('base64'). This distinguishes it from sibling tools like credential management or instance listing, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when the tool is appropriate (downloading attachments) and includes a critical limitation ('Large files are refused') that guides usage. It does not explicitly name alternatives, but no direct alternative exists among the listed siblings, so this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_get_attachmentGet ServiceNow attachment metadataARead-only
Read a single attachment's metadata by its sys_id.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. | |
| attachment_sys_id | Yes | The sys_id of the attachment record. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, and the description does not contradict them. It adds useful scope ('single attachment', 'metadata'), but it does not disclose output shape or any edge-case behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence with the action and object front-loaded and no filler. Every word contributes to the meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only, two-parameter tool, the description plus schema and annotations cover what an agent needs to invoke it. There is no output schema, but 'metadata' conveys the return type at a useful level; more detail about returned fields would be a minor enhancement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides complete descriptions for both parameters, including a reference to servicenow_list_instances for the instance parameter. The tool description echoes 'by its sys_id' but adds no significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb 'Read', a specific resource 'a single attachment's metadata', and the method 'by its sys_id'. This clearly differentiates it from sibling tools, which are about instance management, status, and connection testing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies the prerequisite: you must have an attachment_sys_id and want metadata for one attachment. It does not explicitly name alternatives or exclusions, but none of the listed sibling tools perform attachment operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_get_recordGet ServiceNow recordBRead-only
Read a single record from a table by its sys_id.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name, e.g. 'incident'. | |
| fields | No | Columns to return. Omit to return all columns. | |
| sys_id | Yes | The sys_id of the record to read. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden of behavioral disclosure. It states the operation is a read, but does not describe the response format, behavior for missing records, required permissions, or any other runtime behavior beyond the core action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence that communicates the essential operation immediately. There is no redundant wording or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the schema covers parameters well, but there is no output schema and the description does not explain return conventions or error behavior. For a basic read operation this is close to sufficient, but some edge-context detail is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents all four parameters thoroughly, including examples and default behavior for fields and instance. The description adds no extra parameter detail, which is acceptable because schema coverage is effectively complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Read), the resource (a single record from a table), and the key identifier (sys_id). It is distinct from sibling tools like servicenow_aggregate or servicenow_list_attachments, though it does not explicitly name any alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when a specific sys_id is known and a single record is needed, but it provides no explicit guidance on when to use this tool versus siblings such as servicenow_get_attachment or servicenow_aggregate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_get_statusGet ServiceNow connection statusARead-only
Show the configured instance, user, auth mode and access policy, and whether credentials are complete. The password is never revealed.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
Output Schema
| Name | Required | Description |
|---|---|---|
| user | Yes | |
| authMode | Yes | |
| instance | Yes | |
| profiles | Yes | |
| readOnly | Yes | |
| telemetry | Yes | |
| configured | Yes | |
| pluginApis | Yes | |
| passwordSet | Yes | |
| deniedTables | Yes | |
| activeProfile | Yes | |
| allowedTables | Yes | |
| deniedPackages | Yes | |
| enabledPackages | Yes | |
| readOnlyPackages | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds a meaningful behavioral trait beyond the readOnlyHint annotation: explicitly stating that the password is never revealed. It also clarifies the scope of output (configuration and credential completeness, not secrets), which is valuable for an agent deciding whether to call this tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler. The first sentence front-loads what is shown; the second preempts a likely security concern. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only status tool with an output schema present and a single optional parameter documented in the schema, the description covers the essential behavioral and security context. It lacks nothing critical for an agent to use the tool correctly, though a touch more detail about how the optional instance parameter affects results could push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single optional parameter, with the schema already explaining that 'instance' selects a connection profile. The description adds no additional parameter-level detail, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Show') and enumerates the exact resource and fields (configured instance, user, auth mode, access policy, credential completeness), making it unmistakably distinct from siblings like servicenow_query_table and servicenow_check_capabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies when to use it (e.g., before other ServiceNow operations, to verify connection configuration), but it offers no explicit guidance about situations where a sibling would be better, nor does it name alternatives. The usage context is inferred rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_list_attachmentsList ServiceNow attachmentsARead-only
List attachment metadata, optionally scoped to a specific record (table + sys_id).
| Name | Required | Description | Default |
|---|---|---|---|
| table | No | Table the record belongs to, e.g. 'incident'. | |
| sys_id | No | sys_id of the record whose attachments to list. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, so the safe read behavior is covered. The description adds the useful distinction that only metadata is returned, not file content, and that scoping is optional. However, it discloses nothing about pagination, result size limits, or behavior when no scope is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence states the core purpose immediately and adds the scoping detail without fluff. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool, the description, schema, and annotations together cover the essential who/what/where. It could be more explicit about whether table and sys_id are required together and whether listing without them returns all attachments, but the 'optionally scoped' phrasing and schema descriptions largely fill those gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters (table, sys_id, instance) have descriptive text in the schema, so the description adds no additional parameter meaning. With high schema coverage, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('attachment metadata'), and clarifies the optional scoping by table + sys_id. This clearly differentiates it from sibling upload/delete tools without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context about optional scoping but provides no guidance on when to use this tool versus alternatives like servicenow_upload_attachment or servicenow_delete_attachment. No exclusions or conditional routing are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_list_instancesList connection profilesARead-only
List the configured ServiceNow connection profiles (instances): name, host, user, read-only flag and whether credentials are complete. Passwords are never included.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that no mutation occurs, and the description adds meaningful behavioral context: passwords are explicitly never included, a read-only flag is returned, and credential completeness is reported. This valuable detail goes beyond what the annotations alone provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the primary purpose front-loaded and a security-relevant note appended without excess. Every clause earns its place, and there is no repetitive or boilerplate language.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, read-only listing tool with zero required parameters and no output schema, the description names all meaningful output fields and explicitly covers the password-exclusion guarantee. It is nearly complete, though a note about the return container or pagination would fully remove ambiguity for agents expecting an array shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, instance, is fully documented in the schema with its default behavior and a reference to this tool. The description itself does not add further parameter-level guidance, so the schema carries the burden and the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a clear resource ('configured ServiceNow connection profiles (instances)') and enumerates the returned fields: name, host, user, read-only flag, and credential completeness. This clearly distinguishes the tool from the inline-invocation siblings that check credentials or capabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the tool to inspect available connection profiles, and the parameter schema notes the active-profile default. However, it never explicitly states when to use this tool instead of the sibling tools, nor does it mention any exclusions or prerequisites for calling it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_list_tablesList ServiceNow tablesARead-only
List tables from sys_db_object, optionally filtered by a name or label fragment.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Case-insensitive fragment to match in name or label. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the description only needs to add context beyond that. It does add the specific source (sys_db_object) and the filtering behavior, but it does not disclose pagination, result shape, or the fact that unfiltered calls may return a large list. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core action and resource, then adds the optional filtering detail. There is no filler or redundancy; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with two optional parameters, full schema coverage, and read-only annotations, the description is nearly complete. The only minor gap is the absence of any return-shape or pagination notes, but the tool name and 'list' verb strongly imply a table list, so this is not a significant omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% β both parameters already have descriptions. The description adds semantic context for 'filter' by explaining it matches a fragment in name or label, which goes slightly beyond the schema's bare description. The 'instance' parameter is covered fully by the schema, so no further description is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and a concrete resource ('tables from sys_db_object'), and clearly distinguishes the metadata-listing purpose from sibling record-manipulation tools like servicenow_query_table and servicenow_get_record. The optional filter by name or label is also explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys a clear context: use this tool to discover available ServiceNow tables from the system metadata table. It does not explicitly name alternatives or state when not to use it, but the sibling set makes the intended use obvious, and the mention of an optional filter implies its use for narrowing discovery.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_query_tableQuery ServiceNow tableARead-only
Read records from any ServiceNow table through the Table API. Supports encoded queries, field selection and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of records to return (default 10). | |
| query | No | Encoded query (sysparm_query), e.g. 'active=true^priority=1^ORDERBYDESCsys_created_on'. | |
| table | Yes | Table name, e.g. 'incident', 'sys_user', 'change_request'. | |
| fields | No | Columns to return. Omit to return all columns. | |
| format | No | Output format: 'json' (default), or 'csv' for a spreadsheet-friendly export. | |
| offset | No | Number of records to skip, for pagination. | |
| fetchAll | No | When true, page through all matching records (up to the server's SN_MAX_RECORDS cap) instead of a single page. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. | |
| displayValue | No | Return display values ('true'), raw values ('false', default) or both ('all'). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint and openWorldHint annotations already communicate that this is a safe read operation, which the description's 'Read records' wording confirms. The description adds some value by mentioning Table API support, encoded queries, field selection, and pagination, but it does not disclose behavior like response shape, server-side caps, or what happens with fetchAll. This is adequate given the annotations but not richly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences, front-loading the core purpose ('Read records from any ServiceNow table') and then summarizing the key capabilities without redundancy. No words are wasted, and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters and no output schema, the description gives a useful high-level overview but leaves several contextual details to the schema, such as defaults, limits, and formatting options. It does not describe the return structure or differentiate from close siblings. It is sufficient but not complete enough to guide an agent without consulting the schema heavily.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all 9 parameters in detail with examples, defaults, and enums. The description's reference to 'encoded queries, field selection and pagination' maps to query, fields, and limit/offset/fetchAll, but it adds no meaning beyond what the schema already provides. A baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Read records') and the resource ('any ServiceNow table through the Table API'), which identifies the tool's purpose. It does not explicitly differentiate from siblings like servicenow_get_record or servicenow_aggregate, but the combination of plural records, encoded queries, and pagination makes its query-oriented role reasonably clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool through 'Supports encoded queries, field selection and pagination' and the phrase 'any ServiceNow table.' However, it does not explicitly say when not to use it or mention alternatives such as servicenow_get_record for single-record lookups or servicenow_aggregate for aggregate queries. The usage context is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_set_credentialsSet ServiceNow credentialsAIdempotent
Save or update the ServiceNow connection credentials. Values are persisted to the env file and used for all subsequent requests. Provide any subset of fields.
| Name | Required | Description | Default |
|---|---|---|---|
| user | No | ServiceNow username. | |
| profile | No | Connection profile to write (default: the active one). Use a new name to create a profile. | |
| instance | No | Instance host, e.g. 'dev12345' or 'dev12345.service-now.com'. | |
| password | No | ServiceNow password. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the idempotentHint annotation, the description discloses the practical side effect: values are persisted to the env file and affect all later requests. The 'provide any subset' clause also signals partial updates. This adds meaningful behavioral context not present in the annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences deliver purpose, persistence behavior, and the partial-update rule with no fluff. The most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple configuration tool with four fully documented optional parameters and no output schema, the description covers purpose, side effects, and usage scope. Nothing essential is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already well documented. The description adds only the global hint that any subset of fields can be provided, which is useful but does not deepen per-parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pair: 'Save or update the ServiceNow connection credentials.' It clearly distinguishes this configuration tool from the data-operation siblings by noting persistence and use across subsequent requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: credentials are persisted to the env file and used for all subsequent requests, implying this should be called to configure the connection before other operations. It does not explicitly name alternatives or exclusion cases, but the intended use is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_test_connectionTest ServiceNow connectionARead-only
Verify that the configured credentials actually work: reads one sys_user record and reports ok/status/latency. Auth and connectivity problems are returned structurally (ok:false), not as errors.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| user | No | |
| status | Yes | |
| message | No | |
| latencyMs | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description adds valuable behavioral context: it reads exactly one sys_user record, and it explicitly states that auth and connectivity problems are returned structurally (ok:false) rather than as errors. This gives an agent accurate expectations about failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no wasted words. The primary purpose is front-loaded, and the error-handling caveat is placed second, which is natural and useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with a readOnly annotation and an output schema, the description is nearly complete. It covers purpose, behavioral scope, and error semantics. The only missing piece is explicit differentiation from sibling tools, but that is a minor gap given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single optional parameter, so the schema already handles parameter documentation. The tool description itself adds no parameter details, though the schema pointing to servicenow_list_instances is helpful. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: verifying configured credentials by reading one sys_user record and reporting ok/status/latency. This distinct focus on credential verification differentiates it from siblings like get_status and check_capabilities, and includes a specific resource and behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use it ('verify that the configured credentials actually work'). However, it does not explicitly mention when not to use it or how it compares to sibling tools, so it stops short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_update_recordUpdate ServiceNow recordAIdempotent
Update fields on an existing record identified by its sys_id.
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | Execute the change. In the default plan mode, omitting this returns a non-mutating before/after preview; set true to apply. SN_WRITE_MODE=apply makes execution the default. | |
| table | Yes | Table name, e.g. 'incident'. | |
| fields | Yes | Field name/value pairs to change on the record. | |
| sys_id | Yes | The sys_id of the record to update. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=false, indicating a mutating but non-destructive operation. The description adds no additional behavioral context, such as permissions, reversibility, or the preview/plan mode behavior encoded in the 'apply' parameter. It is consistent with annotations but adds little beyond them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words. It immediately names the action, target, and key identifier, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich schema (which covers parameters and the apply/preview behavior) and the annotations covering mutation safety, the concise description is sufficient for an agent to understand the tool's core purpose. It does not explain the preview mode, but that is fully documented in the apply parameter description, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all five parameters, including table, sys_id, fields, and the apply flag. The description itself adds no parameter-level meaning, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Update'), a resource ('fields on an existing record'), and the identifier ('sys_id'). This clearly distinguishes it from creating, deleting, querying, or fetching records, so an agent can select it without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for modifying existing records (as opposed to creating or deleting), but it does not explicitly mention alternatives or state when not to use it. No prerequisites or exclusions are given, so the guidance is adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_upload_attachmentUpload ServiceNow attachmentA
Attach a file (provided as base64) to a record identified by table + sys_id.
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | Execute the change. In the default plan mode, omitting this returns a non-mutating before/after preview; set true to apply. SN_WRITE_MODE=apply makes execution the default. | |
| table | Yes | Table the record belongs to. | |
| sys_id | Yes | sys_id of the record to attach to. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. | |
| file_name | Yes | File name to store, e.g. 'log.txt'. | |
| content_type | No | MIME type, e.g. 'text/plain'. Defaults to octet-stream. | |
| content_base64 | Yes | File contents, base64-encoded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal that this is a mutating, non-destructive operation (readOnlyHint=false, destructiveHint=false). The description adds the base64 input format and record-targeting behavior, but does not disclose whether repeated uploads create duplicates, size limits, permission requirements, or side effects associated with openWorldHint=true. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and key parameters. Every word contributes meaning, and there is no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core operation is clear, but there is no output schema and the description does not indicate what the tool returns upon success/failure, any prerequisites, or potential side effects. Given the seven-parameter schema and openWorldHint, slightly more context would help an agent confidently invoke the tool and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters, including the plan-mode 'apply' nuance and base64 encoding of content. The description reinforces table + sys_id as the record locator but adds little beyond the schema, matching the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Attach'), a specific resource ('a file'), and the target ('a record identified by table + sys_id'), making the tool's action unambiguous. It is naturally distinguishable from sibling attachment tools like get_attachment, download_attachment, and delete_attachment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies the use case: upload an attachment to an existing ServiceNow record using its table and sys_id. It does not explicitly discuss when not to use it or name alternative tools, but the phrasing gives enough context that an agent can route to this tool for uploads.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
servicenow_use_instanceSwitch connection profileAIdempotent
Switch the active ServiceNow connection profile (persisted to the env file). All identity-scoped caches (OAuth tokens, schema, plugin availability) are cleared.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Profile to activate, e.g. 'default' or 'dev'. | |
| instance | No | Connection profile to use for this call (default: the active profile). See servicenow_list_instances. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful side-effect context beyond the annotations: it discloses persistence to the env file and clearing of identity-scoped caches (OAuth tokens, schema, plugin availability). This is useful behavioral disclosure even though destructiveHint=false; clearing caches is not presented as destructive to persistent data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences. The primary action is front-loaded, and the side-effect detail is presented in a compact second sentence with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple profile-switching tool, the description, paired with parameter schema and annotations, covers the essential behavior, persistence, and cache effects. It does not mention return values or error conditions, but the absence of an output schema and the tool's simple state-changing nature make this a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both schema parameters already have clear descriptions: 'name' indicates the profile to activate and 'instance' explains the per-call override with a pointer to servicenow_list_instances. Since schema coverage is high, the description does not need to add parameter detail, and it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Switch') and resource ('active ServiceNow connection profile'), and specifies it is persisted to the env file. This clearly differentiates it from sibling tools like servicenow_list_instances or servicenow_set_credentials.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when you want to change the active ServiceNow profile, but it does not explicitly compare with alternatives or state when not to use it. The schema references servicenow_list_instances for discovering profiles, but the description itself gives no usage guidance beyond the core action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
19 tool updates
v2.0.1- First observed
servicenow_aggregate - First observed
servicenow_check_capabilities - First observed
servicenow_create_record - First observed
servicenow_delete_attachment - First observed
servicenow_delete_record - First observed
servicenow_describe_table - First observed
servicenow_download_attachment - First observed
servicenow_get_attachment - First observed
servicenow_get_record - First observed
servicenow_get_status - First observed
servicenow_list_attachments - First observed
servicenow_list_instances - First observed
servicenow_list_tables - First observed
servicenow_query_table - First observed
servicenow_set_credentials - First observed
servicenow_test_connection - First observed
servicenow_update_record - First observed
servicenow_upload_attachment - First observed
servicenow_use_instance
TDQS
Each tool targets a distinct resource and action: record CRUD, schema discovery, aggregation, attachments, and connection management. Even within attachments, list vs get vs download vs upload vs delete are clearly separated by operation. There is no meaningful overlap between tools.
All tools follow the consistent servicenow_verb_noun pattern in snake_case. Verbs like query, get, create, update, delete, list, describe, aggregate, download, upload, set, use, test, and check are all used uniformly with clear object nouns.
At 19 tools, the server sits in the borderline heavy range (16-25). Each tool has a distinct purpose, but the count is high for a single connector and could potentially be consolidated without losing clarity.
The surface covers the full lifecycle of records (create/read/update/delete/query), schema exploration, server-side aggregation, attachment management (list, get metadata, download, upload, delete), and connection profiling. No obvious dead ends or missing core operations for the stated ServiceNow domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
An MCP server that provides access to Agility CMS. See https://mcp.agilitycms.com for more details.
MCP server for AI access to Swagger by SmartBear.
An MCP server that provides bazaarvoic JOLT transformation capabilities.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceMCP server enabling interaction with ServiceNow API for managing incidents, CMDB, change management, and other ServiceNow operations via natural language.19MIT
- AlicenseAqualityDmaintenanceThe most comprehensive ServiceNow MCP server. 17 tools for full CRUD, CMDB graph traversal, background scripts, ATF testing, and more.1711913MIT
- AlicenseNot gradedqualityDmaintenanceMCP server to interact with ServiceNow instances, enabling ITSM, CMDB, workflow, and knowledge search operations.MIT
- AlicenseAqualityCmaintenanceAn MCP server for interacting with a ServiceNow instance via its Table API, enabling CRUD operations on incident, request, and requested item tables, as well as generic operations on any table by name.22MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/IvanBBaev/servicenow-mcp-ai'
If you have feedback or need assistance with the MCP directory API, please join our Discord server