Update a ServiceNow security incident by its system ID, modifying fields such as state, severity, or containment status to keep records current.
Update a security incident record (requires WRITE_ENABLED=true)
| Name | Required | Description | Default |
|---|---|---|---|
| fields | Yes | Fields to update (state, severity, containment_status, etc.) | |
| sys_id | Yes | System ID of the security incident |
Changes observed during successful MCP inspections.
v1.0.2Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read/write and destructive profile (readOnlyHint=false, destructiveHint=false, idempotentHint=true). The description adds a specific operational requirement (WRITE_ENABLED=true) that is not in the annotations, which is useful context for the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one short sentence, front-loaded with the verb and resource, and includes the prerequisite in parentheses. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple mutation with two well-documented parameters and annotations covering idempotency and safety. However, the description does not mention return values or behavior for non-existent incidents, and it relies on the schema for field details. It is adequate but has gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so the schema already explains what sys_id and fields mean. The description adds no additional parameter-level meaning beyond the schema, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the verb 'Update' and the resource 'security incident record', which is specific and distinguishes it from sibling tools like create_security_incident, get_security_incident, and list_security_incidents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a prerequisite (WRITE_ENABLED=true) but does not explicitly state when to use this tool versus alternatives. Usage context is implied by the tool name and purpose, but no direct exclusions or alternative references are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.