Query records from any ServiceNow table using an encoded query string.

Use this for ad-hoc queries on any table not covered by specialized tools.

Args:

• table (string): ServiceNow table name (e.g., incident, change_request, sys_user, cmdb_ci)

• query (string): Encoded query string (e.g., 'state=1^priority=1', 'assigned_to=CURRENT_USER'). Leave empty for all records.

• fields (string): Comma-separated field list (e.g., 'sys_id,number,short_description'). Empty = all fields.

• limit (number): Max records to return (1–100, default 20)

• offset (number): Pagination offset (default 0)

• display_value ('true'|'false'|'all'): 'all' returns both display values and raw values (default)

• response_format ('markdown'|'json'): Output format

Returns: List of matching records with pagination metadata

Examples:

• "Find all P1 incidents" → table="incident", query="priority=1^state!=7"

• "List active users in IT" → table="sys_user", query="active=true^department.name=IT"

• "Get open problems" → table="problem", query="state!=4"

Retrieve a single ServiceNow record by sys_id from any table.

Args:

• table (string): Table name (e.g., incident, change_request)

• sys_id (string): 32-character sys_id GUID of the record

• fields (string): Comma-separated fields to return. Empty = all fields.

• display_value ('true'|'false'|'all'): Value display mode (default 'all')

• response_format: Output format

Returns: The record's field values

Examples:

• Get a specific incident → table="incident", sys_id="abc123..."

• Get a CI record → table="cmdb_ci", sys_id="def456..."

Create a new record in any ServiceNow table.

Args:

• table (string): Target table name

• data (object): Key-value pairs of field names and their values (use raw values)

• response_format: Output format

Returns: The newly created record including its sys_id

Examples:

• Create a problem → table="problem", data={"short_description":"DB slow","assigned_to":"user_sys_id"}

• Create a task → table="task", data={"short_description":"Review config","state":"1"}

Note: For incidents and change requests, prefer the dedicated tools (servicenow_create_incident, servicenow_create_change).

Update fields on an existing ServiceNow record by sys_id (PATCH — only specified fields are changed).

Args:

• table (string): Table name

• sys_id (string): 32-character sys_id of the record to update

• data (object): Fields to update with their new values

• response_format: Output format

Returns: The updated record

Examples:

• Close a problem → table="problem", sys_id="...", data={"state":"4"}

• Reassign a task → table="task", sys_id="...", data={"assigned_to":"user_sys_id","assignment_group":"group_sys_id"}

Permanently delete a ServiceNow record by sys_id. This action is irreversible.

Args:

• table (string): Table name

• sys_id (string): sys_id of the record to delete

Returns: Confirmation of deletion

⚠️ Destructive: This permanently removes the record. Use only when deletion is explicitly requested.

List and search ServiceNow incidents with filters.

Args:

• query (string): Encoded query (e.g., 'state=1', 'priority=1^assignment_group.name=Service Desk', 'opened_at>=2024-01-01'). Empty = all open incidents.

• limit (number): Max results (1–100, default 20)

• offset (number): Pagination offset

• response_format: 'markdown' or 'json'

Common query examples:

• All new incidents: 'state=1'

• My assigned incidents: 'assigned_to=javascript:gs.getUserID()'

• High priority open: 'priority<=2^state!=7^state!=6'

• Incidents by group: 'assignment_group.name=Network Operations'

• Recent (last 7 days): 'opened_at>=javascript:gs.beginningOfLast7Days()'

Returns: List of incidents with state, priority, assignment, and timestamps

Get full details of a single ServiceNow incident by number (e.g., INC0012345) or sys_id.

Args:

• identifier (string): Incident number (INC...) or sys_id

• response_format: Output format

Returns: Complete incident details including description, work notes, and all fields

Create a new ServiceNow incident.

Args:

• short_description (string): One-line summary (required)

• description (string): Detailed description

• caller_id (string): sys_id or username of the caller/requester

• category (string): Category (e.g., 'network', 'hardware', 'software', 'inquiry')

• subcategory (string): Subcategory

• priority (number): 1=Critical, 2=High, 3=Moderate, 4=Low, 5=Planning

• urgency (number): 1=High, 2=Medium, 3=Low

• impact (number): 1=High, 2=Medium, 3=Low

• assignment_group (string): sys_id of the assignment group

• assigned_to (string): sys_id of the assignee

• additional_fields (object): Any additional field-value pairs

Returns: Created incident with number and sys_id

Update a ServiceNow incident's state, assignment, priority, or any field.

Args:

• identifier (string): Incident number (INC...) or sys_id

• state (number): New state — 1=New, 2=In Progress, 3=On Hold, 6=Resolved, 7=Closed

• resolution_code (string): Required when resolving (e.g., 'Solved (Permanently)')

• resolution_notes (string): Resolution description (required when resolving)

• priority (number): New priority (1–5)

• assignment_group (string): New group sys_id

• assigned_to (string): New assignee sys_id

• additional_fields (object): Any other field updates

Returns: Updated incident details

Add a work note (internal) or comment (customer-visible) to any ServiceNow record that supports journal fields.

Args:

• table (string): Table name (e.g., incident, change_request, problem)

• identifier (string): Record number or sys_id

• work_note (string): Internal work note text (visible to agents only)

• comment (string): Customer-visible comment text

• At least one of work_note or comment must be provided.

Returns: Confirmation with updated record

Examples:

• Add work note to INC0001234 → table="incident", identifier="INC0001234", work_note="Rebooted server, monitoring."

• Add customer comment → table="incident", identifier="INC0001234", comment="We are investigating your issue."

List ServiceNow change requests with filters.

Args:

• query (string): Encoded query filter. Default shows all non-closed.

• limit / offset: Pagination

• response_format: Output format

Common queries:

• Emergency changes: 'type=emergency^state!=-3'

• This week's scheduled changes: 'start_date>=javascript:gs.beginningOfThisWeek()'

• Changes needing approval: 'state=-3'

• Normal changes in review: 'type=normal^state=0'

Returns: List of change requests with state, type, and schedule

Get full details of a ServiceNow change request by number (CHG...) or sys_id, including implementation, backout, and test plans.

Args:

• identifier (string): Change number (CHG0001234) or sys_id

• response_format: Output format

Returns: Complete change request including all planning fields

Create a new ServiceNow change request.

Args:

• short_description (string): Brief title (required)

• type (string): 'standard', 'normal', or 'emergency'

• description (string): Detailed description/justification

• implementation_plan (string): Steps to implement the change

• backout_plan (string): Rollback procedure if change fails

• test_plan (string): Testing steps

• start_date (string): Planned start (ISO 8601 or ServiceNow format: '2024-06-01 09:00:00')

• end_date (string): Planned end

• assignment_group (string): sys_id of assignment group

• assigned_to (string): sys_id of assignee

• priority (number): 1–5

• risk (number): 1=High, 2=Moderate, 3=Low

• additional_fields (object): Any additional field-value pairs

Returns: Created change request with number and sys_id

Update a ServiceNow change request's state, plan fields, or assignment.

State transitions:

• New (-5) → Assess (-4) → Authorize (-3) → Scheduled (-2) → Implement (-1) → Review (0) → Closed (3)

• Emergency can move more freely

Args:

• identifier (string): Change number (CHG...) or sys_id

• state (string): New state value (e.g., '-2' for Scheduled, '-1' for Implement)

• close_code (string): Required when closing (e.g., 'successful', 'unsuccessful')

• close_notes (string): Closure notes

• work_notes (string): Internal work note to add

• additional_fields (object): Any other field updates

Returns: Updated change request

List and search ServiceNow users.

Args:

• query (string): Encoded query (e.g., 'active=true', 'department.name=IT', 'nameLIKEjohn'). Default: active users only.

• limit / offset: Pagination

• response_format: Output format

Common queries:

• All active users: 'active=true'

• Search by name: 'nameLIKEsmith'

• By department: 'department.name=Information Technology'

• By role: 'roles=itil'

Returns: Users with name, username, email, department, and manager

Get a ServiceNow user by username, email, or sys_id.

Args:

• identifier (string): Username (jdoe), email (jdoe@company.com), or sys_id

• response_format: Output format

Returns: Full user record including sys_id, name, email, department, manager, roles

Examples:

• Get by username → identifier="jdoe"

• Get by email → identifier="jdoe@example.com"

• Get by sys_id → identifier="abc123def456..."

List ServiceNow user groups.

Args:

• query (string): Filter (e.g., 'active=true', 'nameLIKEnetwork', 'type=itil'). Default: active groups.

• limit / offset: Pagination

• response_format: Output format

Returns: Groups with name, description, manager, type, and sys_id

Get all members of a ServiceNow user group.

Args:

• group_identifier (string): Group name, sys_id, or partial name to match

• limit / offset: Pagination

• response_format: Output format

Returns: List of users in the group with their names, usernames, and emails

Search for ServiceNow CMDB configuration items (CIs) by name, type, location, or any filter.

Args:

• query (string): Encoded query (e.g., 'nameLIKEweb-server', 'sys_class_name=cmdb_ci_server', 'location.name=Data Center'). Default: operational CIs.

• class_name (string): Filter by CI class (e.g., 'cmdb_ci_server', 'cmdb_ci_database', 'cmdb_ci_application', 'cmdb_ci_network_adapter'). Leave empty to search all classes.

• name_contains (string): Shortcut to filter by name contains

• limit / offset: Pagination

• response_format: Output format

Common class names:

• cmdb_ci_server — Physical/virtual servers

• cmdb_ci_computer — Workstations/laptops

• cmdb_ci_app_server — Application servers

• cmdb_ci_database — Database instances

• cmdb_ci_web_server — Web servers

• cmdb_ci_service — Business services

Returns: CI records with name, class, status, assignment, and location

Get detailed information about a specific CMDB configuration item by name or sys_id.

Args:

• identifier (string): CI name (exact match or contains) or sys_id

• class_name (string): CI class to narrow the lookup if name is ambiguous

• response_format: Output format

Returns: Full CI record including hardware, network, OS, and relationship details

Traverse CMDB CI relationships from a starting configuration item. Supports recursive traversal up (dependencies) or down (dependents).

Args:

• ci_sys_id (string): sys_id of the starting CI

• direction ('up'|'down'|'both'): 'up' = upstream dependencies, 'down' = downstream dependents, 'both' = full graph (default: 'both')

• depth (number): How many relationship hops to traverse (1–5, default: 2)

• response_format: Output format

Returns: Relationship tree with CI names, types, and relationship types. Visits at most 50 unique CIs to prevent runaway traversal.

Examples:

• What does this server depend on? → ci_sys_id="...", direction="up", depth=2

• What services use this database? → ci_sys_id="...", direction="down", depth=3

• Full dependency map → direction="both", depth=2

Browse available service catalog items.

Args:

• query (string): Filter (e.g., 'nameLIKElaptop', 'category.titleLIKEhardware', 'active=true'). Default: all active items.

• category (string): Filter by category title (partial match)

• limit / offset: Pagination

• response_format: Output format

Returns: Catalog items with name, description, category, and price

Examples:

• Browse hardware items → category="Hardware"

• Find software requests → query="nameLIKEsoftware"

• List by category → category="Access & Permissions"

Get full details of a service catalog item including its variables/form fields.

Args:

• identifier (string): Catalog item name (partial match) or sys_id

• response_format: Output format

Returns: Item details including description, category, variables/questions required to order

Submit a service catalog request using the ServiceNow Service Catalog API.

Args:

• catalog_item_sys_id (string): sys_id of the catalog item to order

• requested_for (string): sys_id of the user this is requested for (default: current user)

• variables (object): Form variable name→value pairs required by the catalog item (get from servicenow_get_catalog_item)

• quantity (number): Number of items to request (default: 1)

Returns: Created request number (REQ...) and request item number (RITM...)

Tip: First use servicenow_get_catalog_item to see required variables before submitting.

List service catalog requests (REQ records) with filters.

Args:

• query (string): Encoded query (e.g., 'opened_by=javascript:gs.getUserID()', 'state=1'). Default: open requests.

• limit / offset: Pagination

• response_format: Output format

Request states: 1=Open, 2=Work in Progress, 3=Closed Complete, 4=Closed Incomplete, 7=Closed Skipped

Returns: Requests with number, state, opened_by, and request items

Search the ServiceNow knowledge base for articles by keyword, category, or filter.

Args:

• search_text (string): Text to search for in article titles and content

• query (string): Encoded query for additional filters (e.g., 'workflow_state=published', 'category.labelLIKEnetwork')

• knowledge_base (string): sys_id of a specific knowledge base to search within

• limit / offset: Pagination

• response_format: Output format

Returns: Matching KB articles with title, category, author, state, and view count

Examples:

• Search VPN articles → search_text="VPN"

• Search published password resets → search_text="password reset", query="workflow_state=published"

• By category → query="category.labelLIKEsecurity"

Get the full content of a knowledge base article by number (KB...) or sys_id.

Args:

• identifier (string): Article number (KB0001234) or sys_id

• response_format: Output format

Returns: Full article content (HTML stripped to plain text) with metadata

Calculate COUNT, SUM, AVG, MIN, or MAX on any ServiceNow table — optionally grouped by a field.

Uses the ServiceNow Aggregate API (/api/now/stats) for efficient server-side aggregation without fetching records.

Args:

• table (string): Table to aggregate (e.g., incident, change_request, cmdb_ci)

• query (string): Filter query (e.g., 'state!=7', 'priority=1^assignment_group=SYS_ID')

• count (boolean): Include total record count (default: true)

• sum_fields (string): Comma-separated numeric fields to sum (e.g., 'resolve_time,business_duration')

• avg_fields (string): Comma-separated numeric fields to average

• min_fields (string): Comma-separated fields to find minimum

• max_fields (string): Comma-separated fields to find maximum

• group_by (string): Field to group by (e.g., 'state', 'priority', 'assignment_group', 'category')

• having (string): HAVING clause for grouped results (e.g., 'COUNT>5')

• response_format: Output format

Examples:

• Count open incidents by priority → table="incident", query="state!=7", group_by="priority"

• Average resolve time for P1s → table="incident", query="priority=1^state=7", avg_fields="resolve_time"

• Total open incidents by group → table="incident", query="state=1^ORstate=2", count=true, group_by="assignment_group"

• Incidents per day this week → table="incident", query="opened_atRELATIVEGE@week@ago@1", group_by="opened_at"

Inspect the field definitions (schema) of any ServiceNow table.

Returns field names, types, labels, mandatory flags, max lengths, and reference targets from sys_dictionary.

Args:

• table (string): Table to introspect (e.g., incident, change_request, cmdb_ci_server)

• include_inherited (boolean): Include fields inherited from parent tables (default: false — own fields only)

• filter_type (string): Filter by field type (e.g., 'string', 'integer', 'reference', 'boolean')

• response_format: Output format

Returns: Field definitions with name, label, type, mandatory, max_length, and reference table (for reference fields)

Examples:

• Explore incident fields → table="incident"

• Find all reference fields on change_request → table="change_request", filter_type="reference"

• Inspect a custom table → table="x_company_myapp_orders"

Return instance version, cluster nodes, recent upgrades, and key configuration properties.

No arguments required — returns a health snapshot of the connected ServiceNow instance.

Returns:

• Build/version info from sys_properties

• Cluster node status from sys_cluster_state

• Last 5 upgrade events from sys_upgrade_history

• Instance name and URL

Query the ServiceNow system log (syslog table) for errors, warnings, and debug messages.

Args:

• query (string): Encoded query filter (e.g., 'level=3', 'sourceLIKEBusinessRule', 'messageLIKEError')

• level (string): Minimum log level to include: 'debug'(0), 'info'(1), 'warning'(2), 'error'(3). Default: 'warning'

• source (string): Filter by log source (e.g., 'BusinessRule', 'ScriptInclude', 'Workflow')

• since_minutes (number): Only return logs from the last N minutes (default: 60)

• limit / offset: Pagination

• response_format: Output format

Log levels: 0=Debug, 1=Info, 2=Warning, 3=Error

Returns: Log entries with timestamp, level, source, and message

Examples:

• Recent errors → level="error"

• Business rule failures → source="BusinessRule", level="error"

• Logs for a specific operation → query="messageLIKEMyScriptInclude"

Search across ServiceNow developer artifacts — business rules, script includes, client scripts, UI actions, and scripted REST operations — by name or script content.

Args:

• search_term (string): Text to search in artifact names and scripts

• artifact_types (array): Which artifact types to search. Default: all.

  • "business_rule" — sys_business_rule

  • "script_include" — sys_script_include

  • "client_script" — sys_script_client

  • "ui_action" — sys_ui_action

  • "rest_operation" — sys_ws_operation (Scripted REST)

• table_name (string): Filter by the table the artifact applies to (e.g., 'incident')

• active_only (boolean): Only return active artifacts (default: true)

• limit (number): Max results per artifact type (default 10)

• response_format: Output format

Returns: Matching artifacts with name, type, table, and script preview

Examples:

• Find all incident business rules → artifact_types=["business_rule"], table_name="incident"

• Search for a function → search_term="calculatePriority"

• Find OAuth script includes → search_term="oauth", artifact_types=["script_include"]

List installed ServiceNow scoped applications and active plugins.

Args:

• search (string): Filter by application name or scope prefix

• include_global (boolean): Include the global scope app (default: false)

• active_only (boolean): Only return active applications (default: true)

• limit / offset: Pagination

• response_format: Output format

Returns: Applications with name, scope, version, vendor, and status

Examples:

• List all custom applications → active_only=true, include_global=false

• Find ITSM-related apps → search="ITSM"

• Check installed integrations → search="integration"

List Automated Test Framework (ATF) tests and test suites available on the instance.

Args:

• search (string): Filter by test name

• suite_only (boolean): List test suites only (default: false — lists individual tests)

• active_only (boolean): Only active tests (default: true)

• limit / offset: Pagination

• response_format: Output format

Returns: Test names, descriptions, and sys_ids (needed for servicenow_run_atf_test)

Execute an ATF test or test suite and return the result.

Requires the ATF plugin (com.glide.automated-test-framework) and appropriate role (atf_test_admin or admin).

Args:

• sys_id (string): sys_id of the test or suite to run (from servicenow_list_atf_tests)

• is_suite (boolean): True if running a test suite, false for a single test (default: false)

• browser (string): Browser to run tests in (default: "any"). Options: "any", "chrome", "firefox", "ie", "safari", "edge"

• response_format: Output format

Returns: Test run result including pass/fail status and individual step results

Note: Test execution is asynchronous. Results may not be immediately available — check sys_atf_result table if the call times out.

Search and list ServiceNow tables by name, label, or scope. Useful for exploring the data model.

Args:

• search (string): Filter by table name or label

• scope (string): Filter by application scope prefix (e.g., 'x_company', 'sn_', 'global')

• extendable_only (boolean): Only tables that can be extended (default: false)

• limit / offset: Pagination

• response_format: Output format

Returns: Table names, labels, parent classes, and scopes

Examples:

• Find all incident-related tables → search="incident"

• List custom application tables → scope="x_"

• Find CMDB tables → search="cmdb"

Update multiple records matching a query. Dry-run by default — always preview before committing.

Args:

• table (string): Target table (e.g., incident, change_request)

• query (string): Encoded query to select records (e.g., 'state=6^resolved_atRELATIVELT@dayofweek@ago@30')

• data (object): Fields to set on all matched records

• dry_run (boolean): Preview without applying (default: true). Set false to commit.

• limit (number): Safety cap — max records to process (default 20, max 100)

• response_format: Output format

Returns: Preview list (dry_run=true) or per-record success/failure results

Examples:

• Close all resolved incidents older than 30 days → table="incident", query="state=6^resolved_atRELATIVELT@dayofweek@ago@30", data={"state":"7"}

• Reassign open tickets to a new group → table="incident", query="assignment_group=OLD_SYS_ID^state!=7", data={"assignment_group":"NEW_SYS_ID"}

• Set category on unclassified incidents → table="incident", query="category=^state=1", data={"category":"software"}

Delete multiple records matching a query. Dry-run by default — always preview before committing.

Args:

• table (string): Target table

• query (string): Encoded query to select records to delete

• dry_run (boolean): Preview without deleting (default: true). Set false to commit.

• limit (number): Safety cap — max records to delete (default 20, max 100)

• response_format: Output format

⚠️ Deletion is permanent. Always run with dry_run=true first to confirm scope.

Examples:

• Preview stale test incidents → table="incident", query="short_descriptionLIKEtest^state=7^sys_created_onRELATIVELT@year@ago@2", dry_run=true

• Remove obsolete CI records → table="cmdb_ci", query="install_status=7^sys_updated_onRELATIVELT@year@ago@5", dry_run=true

List file attachments for a ServiceNow record or query across all attachments.

Args:

• table_name (string): Table the attachment belongs to (e.g., incident, change_request)

• table_sys_id (string): sys_id of the specific record. Leave empty to list all attachments for the table.

• file_name_contains (string): Filter by filename substring

• limit / offset: Pagination

• response_format: Output format

Returns: Attachment metadata including filename, content type, size, and download link

Examples:

• List attachments on INC0001234 → table_name="incident", table_sys_id=""

• Find all PDFs on change requests → table_name="change_request", file_name_contains=".pdf"

Download the content of a file attachment by its sys_id.

Args:

• sys_id (string): sys_id of the attachment (get from servicenow_list_attachments)

• response_format: Output format

Returns: File content for text files (plain text, XML, JSON, CSV, JS, etc.). Binary files return metadata and a download URL only.

Note: Use servicenow_list_attachments first to find the sys_id of the attachment.

Upload a file as an attachment to a ServiceNow record.

Args:

• table_name (string): Table of the parent record (e.g., incident, change_request)

• table_sys_id (string): sys_id of the parent record

• file_name (string): Name for the file (e.g., "report.txt", "screenshot.png")

• content (string): File content (text for text files, base64 for binary files)

• content_type (string): MIME type (e.g., "text/plain", "application/json", "image/png")

• encrypt (boolean): Encrypt the attachment at rest (default: false)

Returns: The created attachment record with sys_id and download link

Examples:

• Attach a log file to an incident → table_name="incident", table_sys_id="...", file_name="server.log", content="...", content_type="text/plain"

• Attach JSON config → file_name="config.json", content_type="application/json"