List all available tool packages and their tool groups.

Read records, aggregates, or a single record from any ServiceNow table.

Args: table: ServiceNow table name (e.g. 'incident'). sys_id: When set, fetch a single record by sys_id (other filter args ignored except fields and display_values). encoded_query: ServiceNow encoded query string (e.g. 'state=1^priority=2'). Empty = no filter. fields: Comma-separated field projection. List mode requires this argument. '*' explicitly requests all masked fields. Exact sys_id mode defaults to the compact sys_id,sys_updated_on projection. limit: Max rows (1-max_row_limit). Default 20. offset: Pagination offset. order_by: Field name; prefix with '-' for descending (e.g. '-sys_created_on'). display_values: True returns display_value form for reference and choice fields. aggregate: Comma-separated aggregations: 'count', 'avg:', 'sum:', 'min:', 'max:'. When set, returns aggregate result instead of rows. group_by: Comma-separated fields to group by, e.g. state,active (aggregate mode only). resolve_labels: Comma-separated 'field=label' pairs (e.g. 'state=open,priority=high'). Each label is resolved via ChoiceRegistry to its underlying value, then ANDed into encoded_query as 'field=value'.

Return slim field metadata for a table, or list tables / script fields.

Args: table: ServiceNow table name. Required for the default flow and for action='list_script_fields'. Ignored by action='list_tables'. fields: Comma-separated fields to include. Empty returns a bounded compact page. '*' explicitly returns all fields. verbose: When True, return the full sys_dictionary row per field minus a fixed deny-list of high-noise keys. Default False. include_docs: When True, attach the matching sys_documentation entry (label/help/hint/url) per field. Default False. action: When 'list_script_fields', return the dictionary-driven script-bearing fields for table with its resolved super_class chain. When 'list_tables', list tables from sys_db_object (optionally filtered by name_filter). Empty (default) runs the standard table-describe flow. name_filter: Substring matched against table name and label when action='list_tables'. Empty returns all tables (capped). field_offset: Zero-based field offset for compact default pages. field_limit: Field count for compact default pages (1-100).

Create, update, or delete a record. Defaults to preview mode.

Supply all field values, including complete script or markup strings, in data. Omitted fields stay unchanged on update. Dictionary metadata identifies supplied XML fields, including inherited fields; malformed XML is rejected before preview creation or mutation. Creates also check inherited mandatory fields, with child declarations taking precedence. Metadata request errors block writes.

Args: action: 'create' | 'update' | 'delete'. table: Target table. Required. sys_id: Required for 'update' and 'delete'. data: JSON string mapping field names to values, including any script fields. Required for 'create' and 'update'. Maximum 256 KiB of UTF-8 JSON, including escaping and field names. preview: When True (default) returns a preview_token; caller invokes record_apply to commit. When False, write commits immediately.

Commit a previously previewed write. Single-use token.

Args: preview_token: The token returned by record_write in preview mode. Single-use - consumed on success or failure.

Fetch a record by sys_id or name from any table.

Exactly one of sys_id or name must be supplied. Sensitive fields are masked. The response includes a script_fields list (resolved dynamically via sys_dictionary plus the table's super_class chain) so callers can discover which script-bearing fields are writable on a subsequent record_write.

Args: table: ServiceNow table name (e.g. sys_script, catalog_script_client, incident). Tables with zero script fields return script_fields: [] and succeed. sys_id: Mutually exclusive with name. Direct lookup by sys_id. name: Mutually exclusive with sys_id. Resolves via name=<value> query; ambiguous matches return an error. fields: Comma-separated field projection. Empty returns compact identity/update metadata plus all discovered script-bearing fields. '*' returns the full masked record.

Read attachments. action: 'list' | 'get' | 'download' | 'download_by_name'.

Args: action: One of: list, get, download, download_by_name. sys_id: Attachment sys_id (for get, download). table: Parent table (for list, download_by_name). table_sys_id: Parent record sys_id (for list, download_by_name). file_name: File name (for download_by_name).

Write attachments. action: 'upload' | 'delete'.

Args: action: 'upload' or 'delete'. table: Parent table (upload). table_sys_id: Parent record sys_id (upload). file_name: Attachment file name (upload). content_base64: Base64-encoded file bytes (upload). content_type: MIME type (upload, default 'application/octet-stream'). sys_id: Attachment sys_id (delete).

Run an investigation or explain a finding.

Args: action: 'run' | 'explain' | 'describe'. name: Investigation name (required for 'run'; optional direct selector for 'explain' and filter for 'describe'). Available: stale_automations, deprecated_apis, table_health, acl_conflicts, error_analysis, slow_transactions, performance_bottlenecks. params: JSON string of run parameters (run only). element_id: 'table:sys_id' identifier of a finding (explain only).

Resolve a choice label to its underlying value via ChoiceRegistry.

Args: table: ServiceNow table name. field: Field name on that table. label: Choice label to resolve. When empty, returns the full {label: value} mapping for the field.

Service Catalog operations. Dispatch on action.

Args: action: One of: catalogs_list, catalog_get, categories_list, category_get, items_list, item_get, item_variables, order_now, add_to_cart, cart_get, cart_submit, cart_checkout. sys_id: Record sys_id (catalog_get, category_get, item_get, item_variables). item_sys_id: Catalog item sys_id (order_now, add_to_cart). catalog_sys_id: Catalog sys_id (categories_list). catalog: Filter by catalog sys_id (items_list). category: Filter by category sys_id (items_list). text: Search text (catalogs_list, items_list). variables: JSON object of variable name/value pairs (order_now, add_to_cart). limit: Max results (catalogs_list, categories_list, items_list). Default 20. offset: Pagination offset (categories_list, items_list). Default 0. top_level_only: Return only top-level categories (categories_list).

Run bounded, read-only analysis over catalog answers or journals.

Args: action: 'ritm_variables' | 'journal_history' | 'describe'. table: Target table for journal_history. sys_id: Target record sys_id for ritm_variables or journal_history. fields_csv: Allowed journal fields: comments, work_notes, close_notes. since: ISO date floor for journal_history; overrides window_days. window_days: Journal window; defaults to 90 days. limit: Row cap; defaults to MAX_ROW_LIMIT and is capped by it. offset: Zero-based row offset.

Inspect ServiceNow audit posture (table/field config) and audit trail.

IMPORTANT: sys_audit is one of the largest tables on the platform. Every action keeps a default 90-day window for that reason. Override window_days (or since on history) only when you genuinely need older rows - wider windows cause slow queries and can time out.

Args: action: 'check_field' | 'check_fields' | 'check_table' | 'history' | 'describe'. table: ServiceNow table name (required for all actions except 'describe'). field: Field name (required for 'check_field'). fields_csv: Comma-separated field names (required for 'check_fields', 1..50). sys_id: 32-char record sys_id (required for 'history'). since: YYYY-MM-DD cutoff (history only; overrides window_days). window_days: Audit-trail/positive-control window (defaults to 90). limit: Row cap for 'history' (defaults to settings.max_row_limit).

Inspect Flow Designer flows, triggers, and value blobs (read-only).

Args: action: 'contract' | 'inspect' | 'find_by_table' | 'decode_values' | 'list_triggers' | 'describe'. sys_id: Flow sys_id (contract/inspect; mutually exclusive with name). name: Flow name (contract/inspect; mutually exclusive with sys_id). value: gzip+base64+JSON blob to decode (decode_values). table: Target table (find_by_table; optional filter for list_triggers). trigger_type: Trigger type filter (list_triggers, e.g. 'record_update'). active: 'true' | 'false' filter (list_triggers). limit: Row cap for list_triggers (default 100). sections: Comma-separated inspect/contract sections. Empty uses the compact default; '*' returns all. section_limit: Shared cap for selected flow rows/nodes (default 100, max MAX_ROW_LIMIT).

Search ServiceNow code or inspect Code Search table coverage.

Args: action: One of 'search', 'list_tables', or 'describe'. term: Search term for action='search'. table: Optional table filter for action='search' (e.g. 'sys_script_include'). search_group: ServiceNow Code Search group; empty uses sn_codesearch.Default Search Group. limit: Max search results for action='search'. Default 20. extended_matching: Include additional Code Search context fields. Default false. Set true when the extra context is needed.