Read records from any ServiceNow table through the Table API. Supports encoded queries, field selection and pagination.

Read a single record from a table by its sys_id.

Create a new record in a table with the given field values.

Update fields on an existing record identified by its sys_id.

Delete a record from a table by its sys_id.

List tables from sys_db_object, optionally filtered by a name or label fragment.

List a table's columns (name, label, type, mandatory, reference) from sys_dictionary.

Compute server-side aggregates (count, avg, min, max, sum) over a table via the Stats API, with optional grouping. Avoids pulling individual rows.

List attachment metadata, optionally scoped to a specific record (table + sys_id).

Read a single attachment's metadata by its sys_id.

Download an attachment's bytes, returned as base64. Large files are refused (see SN_MAX_RESULT_CHARS).

Attach a file (provided as base64) to a record identified by table + sys_id.

Delete an attachment by its sys_id.

Save or update the ServiceNow connection credentials. Values are persisted to the env file and used for all subsequent requests. Provide any subset of fields.

List the configured ServiceNow connection profiles (instances): name, host, user, read-only flag and whether credentials are complete. Passwords are never included.

Switch the active ServiceNow connection profile (persisted to the env file). All identity-scoped caches (OAuth tokens, schema, plugin availability) are cleared.

Show the configured instance, user, auth mode and access policy, and whether credentials are complete. The password is never revealed.

Verify that the configured credentials actually work: reads one sys_user record and reports ok/status/latency. Auth and connectivity problems are returned structurally (ok:false), not as errors.

Preflight which admin-restricted sys_* tables the connected user can actually read, and report which higher-level capabilities (schema reads, script intelligence, ACL audit) are achievable. Run this before relying on the scripts/flows/codecheck tools on a governed instance — on a least-privilege account those reads may be silently empty.