List all available tool packages and their tool groups.

Read records, aggregates, or a single record from any ServiceNow table.

Args: table: ServiceNow table name (e.g. 'incident'). sys_id: When set, fetch a single record by sys_id (other filter args ignored except fields and display_values). encoded_query: ServiceNow encoded query string (e.g. 'state=1^priority=2'). Empty = no filter. fields: Comma-separated field list. Empty returns all (subject to masking). limit: Max rows (1-max_row_limit). Default 20. offset: Pagination offset. order_by: Field name; prefix with '-' for descending (e.g. '-sys_created_on'). display_values: True returns display_value form for reference and choice fields. aggregate: Comma-separated aggregations: 'count', 'avg:', 'sum:', 'min:', 'max:'. When set, returns aggregate result instead of rows. group_by: Field to group aggregate results by (aggregate mode only). resolve_labels: Comma-separated 'field=label' pairs (e.g. 'state=open,priority=high'). Each label is resolved via ChoiceRegistry to its underlying value, then ANDed into encoded_query as 'field=value'.

Return slim field metadata for a table, or list script-bearing fields.

Args: table: ServiceNow table name. Required unless action is set (and even with action='list_script_fields' table is still required - it names the table to inspect). fields: Comma-separated list of fields to include. Empty = all fields. verbose: When True, return the full sys_dictionary row per field minus a fixed deny-list of high-noise keys. Default False. include_docs: When True, attach the matching sys_documentation entry (label/help/hint/url) per field. Default False. action: When set to 'list_script_fields', return the dictionary-driven script-bearing fields for table along with the resolved super_class chain. Empty (default) runs the standard table-describe flow.

Create, update, or delete a record. Defaults to preview mode.

Script-bearing tables (Business Rules, Script Includes, widgets, etc.) are not special-cased - script-field discovery happens at runtime via sys_dictionary and the table's super_class chain. script_path loads a local file into the resolved target field; script_field names the destination column when more than one script-bearing field is detected.

Args: action: 'create' | 'update' | 'delete'. table: Target table. Required. sys_id: Required for 'update' and 'delete'. data: JSON string of field values. Required for 'create' and 'update'. script_path: Optional absolute path to a local script file. Content is read (UTF-8, max 1 MB) and stored under the resolved target script field. Path resolved with strict=True; constrained to settings.script_allowed_root. When the resolved field has internal_type == 'xml', the content is validated as well-formed XML before any platform call. script_field: Optional override for the destination script field. When empty (default), the first detected script field is used (child-first, sys_dictionary row order within a table). When set, must match one of the script-bearing fields detected from sys_dictionary; otherwise the call returns a structured error listing the detected fields. Use describe(action='list_script_fields', table=...) to discover script fields for a table. preview: When True (default) returns a preview_token; caller invokes record_apply to commit. When False, write commits immediately.

Commit a previously previewed write. Single-use token.

Args: preview_token: The token returned by record_write in preview mode. Single-use - consumed on success or failure.

Fetch a record by sys_id or name from any table.

Exactly one of sys_id or name must be supplied. Sensitive fields are masked. The response includes a script_fields list (resolved dynamically via sys_dictionary plus the table's super_class chain) so callers can discover which script-bearing fields are writable on a subsequent record_write.

Args: table: ServiceNow table name (e.g. sys_script, catalog_script_client, incident). Tables with zero script fields return script_fields: [] and succeed. sys_id: Mutually exclusive with name. Direct lookup by sys_id. name: Mutually exclusive with sys_id. Resolves via name=<value> query; ambiguous matches return an error.

Read attachments. action: 'list' | 'get' | 'download' | 'download_by_name'.

Args: action: One of: list, get, download, download_by_name. sys_id: Attachment sys_id (for get, download). table: Parent table (for list, download_by_name). table_sys_id: Parent record sys_id (for list, download_by_name). file_name: File name (for download_by_name).

Write attachments. action: 'upload' | 'delete'.

Args: action: 'upload' or 'delete'. table: Parent table (upload). table_sys_id: Parent record sys_id (upload). file_name: Attachment file name (upload). content_base64: Base64-encoded file bytes (upload). content_type: MIME type (upload, default 'application/octet-stream'). sys_id: Attachment sys_id (delete).

Run an investigation or explain a finding.

Args: action: 'run' | 'explain' | 'describe'. name: Investigation name (required for 'run', optional for 'describe'). Available: stale_automations, deprecated_apis, table_health, acl_conflicts, error_analysis, slow_transactions, performance_bottlenecks. params: JSON string of run parameters (run only). element_id: 'table:sys_id' identifier of a finding (explain only).

Resolve a choice label to its underlying value via ChoiceRegistry.

Args: table: ServiceNow table name. field: Field name on that table. label: Choice label to resolve. When empty, returns the full {label: value} mapping for the field.

Service Catalog operations. Dispatch on action.

Args: action: One of: catalogs_list, catalog_get, categories_list, category_get, items_list, item_get, item_variables, order_now, add_to_cart, cart_get, cart_submit, cart_checkout. sys_id: Record sys_id (catalog_get, category_get, item_get, item_variables). item_sys_id: Catalog item sys_id (order_now, add_to_cart). catalog_sys_id: Catalog sys_id (categories_list). catalog: Filter by catalog sys_id (items_list). category: Filter by category sys_id (items_list). text: Search text (catalogs_list, items_list). variables: JSON object of variable name/value pairs (order_now, add_to_cart). limit: Max results (catalogs_list, categories_list, items_list). Default 20. offset: Pagination offset (categories_list, items_list). Default 0. top_level_only: Return only top-level categories (categories_list).

Build a ServiceNow encoded query string from a JSON array of conditions.

Each condition is an object with:

• operator: The query operator (see groups below).

• field: The field name (not required for new_query).

• value: The comparison value (type depends on operator).

Operator groups: Comparison: equals, not_equals, greater_than, greater_or_equal, less_than, less_or_equal String: contains, starts_with, like, ends_with, not_like, does_not_contain Null / special: is_empty, is_not_empty, anything, empty_string Time: hours_ago, minutes_ago, days_ago, older_than_days Date: on, not_on, relative_gt, relative_lt, more_than Date part: datepart (requires part, dp_operator, dp_value) Range: between (requires start, end) Field comparison: gt_field, lt_field, gt_or_equals_field, lt_or_equals_field, same_as, not_same_as (use other_field for the second field name) Reference: dynamic, in_hierarchy Change detection: val_changes, changes_from, changes_to Logical: new_query (no field needed - inserts ^NQ separator) Related list: rl_query (requires related_table, related_field, rl_operator, value) List: in_list, not_in_list (value is a list of strings) OR: or_equals, or_starts_with Ordering: order_by (optional descending: boolean)

Args: conditions: JSON array of condition objects.

Returns the encoded query string in data.query. Pass this string as the query parameter to the query tool.

Inspect ServiceNow audit posture (table/field config) and audit trail.

IMPORTANT: sys_audit is one of the largest tables on the platform. Every action keeps a default 90-day window for that reason. Override window_days (or since on history) only when you genuinely need older rows - wider windows cause slow queries and can time out.

Args: action: 'check_field' | 'check_fields' | 'check_table' | 'history' | 'describe'. table: ServiceNow table name (required for all actions except 'describe'). field: Field name (required for 'check_field'). fields_csv: Comma-separated field names (required for 'check_fields', 1..50). sys_id: 32-char record sys_id (required for 'history'). since: YYYY-MM-DD cutoff (history only; overrides window_days). window_days: Audit-trail/positive-control window (defaults to 90). limit: Row cap for 'history' (defaults to settings.max_row_limit).

Inspect Flow Designer flows, triggers, and value blobs (read-only).

Args: action: 'inspect' | 'find_by_table' | 'decode_values' | 'list_triggers' | 'describe'. sys_id: Flow sys_id (inspect; mutually exclusive with name). name: Flow name (inspect; mutually exclusive with sys_id). value: gzip+base64+JSON blob to decode (decode_values). table: Target table (find_by_table; optional filter for list_triggers). trigger_type: Trigger type filter (list_triggers, e.g. 'record_update'). active: 'true' | 'false' filter (list_triggers). limit: Row cap for list_triggers (default 100).