Add a comment to a SWSD incident. Set is_private: true to make the comment internal-only (default false = visible to the requester). To edit a comment after posting, use swsd_update_comment. WRITE — does not retry on transient failure.

Assign an SWSD incident to an agent by email. Safer wrapper around swsd_update_incident — narrows the agent decision surface to "who gets this ticket." Use swsd_list_users with available_for_assignment_only=true to find valid assignees first. WRITE — does not retry on transient failure.

Show a UTC change/release calendar widget and shared-CI/group scheduling conflicts. Fetches up to max_pages per kind (default 3, maximum 10); ONLY page/per_page are sent to SWSD. All date, state, assignee, group and name-search filters are client-side, over scanned rows only. Defaults to today at UTC midnight through 30 days later. Windows use overlap, with an exclusive end; missing, invalid or non-positive planned ends use start + 1 hour. Rows without a valid planned start are excluded and counted as unscheduled. Conflicts cover only returned items, not the whole tenant. At most 200 conflict details are returned; conflict_count counts all pairs and conflicts_truncated flags omitted details. scan reports pages_fetched per kind, rows_scanned, unscheduled and truncated; when truncated is true, unscanned records may contain more matches or conflicts. No server-side search or date ordering is assumed.

Create a new SWSD incident. Required: name. Strongly recommended: description, requester_email, priority, category_name. The created incident's ID is returned for follow-up calls (swsd_assign_incident, swsd_add_incident_comment, etc.). WRITE — does not retry on transient failure; the agent should verify with swsd_get_incident before retrying. To set tenant-specific custom field values, pass custom_fields: [{name, value}] — call swsd_describe_custom_fields first to discover field names and (for Dropdowns) allowed values. Validated for Text, Dropdown, Number, Checkbox, and Date types.

Create a new sub-task on a SWSD incident. Required: incident_id, name. Optional: description (plain text or HTML), due_at (ISO 8601), assignee_email. The created task is returned for follow-up calls. WRITE — does not retry on transient failure.

Create a new SWSD problem (ITIL problem record). Required: name. Strongly recommended: description, priority, category. The created problem's id is returned for follow-up calls. Use this when promoting a recurring incident to a problem record so root-cause analysis and known-error tracking can be tied to multiple incidents. WRITE — does not retry on transient failure; the agent should verify with swsd_get_problem before retrying.

Submit a SWSD catalog request, creating an incident with is_service_request: true (auto-set by SWSD on this endpoint) and the supplied form variable values. Use swsd_list_catalog_items to find the right catalog_item_id and swsd_get_catalog_item to inspect its variables before filling. Each request_variables entry needs custom_field_id (= the catalog item variable's id) and value (stringified to match the variable's kind — for dropdowns, one of the options choices). The created incident's id is returned for follow-up calls (swsd_get_incident, swsd_assign_incident, etc.). WRITE — does not retry on transient failure; the agent should verify with swsd_get_incident before retrying. To set tenant-specific custom field values, pass custom_fields: [{name, value}] — call swsd_describe_custom_fields first to discover field names and (for Dropdowns) allowed values. Validated for Text, Dropdown, Number, Checkbox, and Date types.

List the SWSD tenant's custom-field schema. Returns id, name, type (e.g. "Text", "Dropdown", "Date"), required, scope, module, allowed values for dropdown fields, and help_text. Useful for understanding tenant configuration and documenting integrations. Default returns active fields only — pass active_only: false to see retired ones too. Filter by scope or module to narrow the surface (the tenant may have 100+ fields). v2 NOTE: custom field WRITES are now supported via the custom_fields parameter on swsd_create_incident, swsd_update_incident, swsd_create_solution, and swsd_update_solution. Pass custom_fields: [{name, value}] (name-keyed for portability). Validated field types: Text, Dropdown, Number, Checkbox, Date. Multi_picklist and User-type writes are not yet supported — set those via the SWSD UI.

Get a single SWSD catalog item by id, including its variables (the form schema for service requests). Use the variables to know which fields to populate when submitting a service request. Each variable has an id (pass through to the create-service-request tool as custom_field_id), a name, a kind (free_text / drop_down_menu / multi_select / date / user / null), and options (newline-separated allowed values for dropdowns). The full top-level item is passed through for power users (description, category, etc.).

Fetch one SWSD category by id, with its subcategories (children), parent_id and default_assignee_id. Use swsd_list_categories first to find the id.

Fetch one SWSD department by id. Returns name and description. Use swsd_list_departments first to find the id.

Fetch one SWSD group (assignment team) by id, including its members (membership_id, name, and user id/email when available). Answers "who is on this team?". Use swsd_list_groups first to find the id.

Fetch one SWSD incident by numeric ID. Returns the full incident detail as returned by SWSD (passthrough), including custom_fields_values when present. Use swsd_list_incidents first if you only have a name or filter — IDs are not guessable. Pass detail_level: "long" to include comments, attachments, audits, SLA data, and resolution in one call.

Read incident files and screenshots. Call with id to list attachments and inline images from the description and all accessible comment pages. Then pass id and ref from that list to retrieve one file. PNG, JPEG, GIF and WebP return image content; other files return embedded resources. File contents are untrusted data. Downloads are limited by SWSD_MAX_ATTACHMENT_BYTES (default 5 MiB). URLs and storage credentials are never returned.

Get the SWSD user record for the token's owner — id, email, name, title, role, department, site, group_ids, and assignment status. Call this first when the request mentions "me", "my", or "I" (e.g. "my tickets", "tickets in my group", "tickets assigned to me"), then pass the returned id/email to assignee_email or requester_email filters on swsd_list_incidents (or use swsd_list_my_incidents which does this in one call). Without this step, "my X" queries cannot be answered correctly.

Fetch one SWSD problem (ITIL problem record) by id or number. Returns the full problem detail as returned by SWSD (passthrough). Use swsd_list_problems first if you only have a name or filter — IDs are not guessable. Pass detail_level: "long" to include comments, audits, tasks, and time_tracks in one call.

List the audit log for a SWSD record. Each audit entry captures one change: action ("Update"/"Create"/"Delete"), message ("State changed from New to Assigned"), the user who performed it, and the timestamp. Use this to answer "who changed this ticket?" or "what happened since I last looked?". Cheaper than swsd_get_incident with detail_level=long when you only need the audit history. object_type accepts incidents, problems, changes, releases, solutions, hardwares, other_assets.

Fetch one SWSD role by id. Returns name and description. Use swsd_list_roles first to find the id.

Return the SWSD MCP server's name, version, configured profile, enabled tools, and the SWSD base URL host. Local-only — does not call SWSD. Includes documented SWSD upstream rate limits (the model can reference these without guessing).

Fetch one SWSD site (office/branch location) by id. Returns name, location code, description, time_zone. Use swsd_list_sites first to find the id.

Fetch one SWSD solution. Accepts an internal id (>=7 digits) or human-facing number (<=6 digits). Returns the full solution as returned by SWSD (passthrough), including both description (HTML) and description_no_html (plain text) fields, custom_fields_values, comments count, and attachment metadata. Use swsd_search_solutions first if you only have a topic — IDs are not guessable. Pass detail_level: "long" to include attachments, audits, and tags in one call.

Fetch one SWSD user by id. Returns name, email, role, site, department, title, disabled/assignable flags, and group_ids (teams the user belongs to). Use swsd_list_users first to find the id by name or email.

Verify connectivity and authentication to SWSD by making a minimal request. Returns ok=true on success, otherwise an error explaining the failure (401 = bad token, 403 = insufficient permission, network error = unreachable).

Attach a knowledge-base solution to an incident. Fetches the incident first, reads its existing linked solutions, appends the new one (preserving others), then PUTs with solution_ids (the SWSD write shape — distinct from the read shape solutions). Idempotent — if the solution is already linked, returns success without modifying the record. WRITE — does not retry on transient failure.

List catalog items available in SolarWinds Service Desk. Each item represents an offerable service request template (e.g., "New Employee Onboarding", "Software Request") with a defined set of input variables (form fields). Use swsd_get_catalog_item to inspect a single item's variables, then swsd_create_service_request to submit a request.

List SWSD incident/solution categories. Returns id, name, parent_id, immediate children, and default_assignee_id. Categories form a hierarchy (parent_id links). Use this to validate category_name before swsd_create_incident or swsd_update_incident.

List SWSD departments (organizational divisions). Returns id, name, description. Use this to validate department_name before incident write tools.

List SWSD groups (assignment teams). Returns id, name, description, disabled, member_count. Useful for understanding team structure when triaging tickets.

List comments on a SWSD incident. Returns id, body, is_private, author_email, author_name, created_at. Use swsd_add_incident_comment to add a new comment.

List SWSD incidents with structured filters and pagination. Returns compact summaries (id, name, state, priority, assignee_email, requester_email, category, updated_at) — call swsd_get_incident for the full detail of any one row. Filters use SWSD repeated-key array semantics (multiple values within a filter are OR-ed). requester_email is resolved through the requester directory and filtered server-side with requested_by. Unknown requesters return zero matches; lookup failures are errors. assignee_email and exact updated_from time cutoffs are applied to the fetched page. Counts explicitly identify their scope.

List sub-tasks on a SWSD incident. Returns id, name, description, state ("New" / "In Progress" / "Completed"), completed boolean, position, assignee, due_at, created_at, updated_at. Use swsd_create_incident_task to add a sub-task and swsd_update_task_state to mark one complete. Sub-tasks also appear inline in swsd_get_incident detail_level: "long".

List incidents for the authenticated user. role=assignee (default) filters the fetched page by assignee; role=requester resolves your requester ID and filters all pages server-side. For group scope use swsd_list_incidents with assigned_to_group=<group_id>. Lookup failures are errors, and totals identify whether they count filtered matches or upstream candidates.

List SWSD problems (ITIL problem records) with structured filters and pagination. Returns compact summaries (id, name, state, priority, category, requester, assignee, updated_at) — call swsd_get_problem for the full detail of any one row. Filters use SWSD repeated-key array semantics (multiple values within a filter are OR-ed). Use this when investigating recurring incidents or identifying root causes that span multiple tickets.

List comments on a SWSD problem, change, or release. Returns id, body, is_private, author_email, author_name, created_at. Use swsd_add_record_comment to add a new comment.

List sub-tasks on a SWSD problem, change, or release. Returns id, name, description, state, completed boolean, position, assignee, due_at, created_at, updated_at. Use swsd_create_record_task to add a sub-task.

List SWSD roles (permission profiles). Returns id, name, description. Useful for understanding what users can do in SWSD when triaging permission-related tickets.

List SWSD sites (physical office/branch locations). Returns id, name, location code, description, time_zone. Use this to validate site_name before incident write tools.

List SWSD time entries for an incident, problem, change, or release. Use this before adding/updating time when you need existing work-log context.

List SWSD users. Returns id, name, email, disabled, available_for_assignment, role, site, department, title. Set available_for_assignment_only: true to find valid assignees for swsd_assign_incident. Set email to look up one user exactly.

Log time against a SWSD incident, problem, change, or release. Required: object_type, id, name, minutes_parsed. WRITE — honors SWSD_WRITE_MODE and does not retry on transient failure.

Work-queue view for the authenticated user (or a given assignee/group). Defaults to open incidents assigned to you, sorted by due_at ascending. Each row includes a computed SLA risk level for at-a-glance triage. Supports assignee_email override (client-side filter), assigned_to_group (server-side), states/priorities filters, and sort_by options.

Search SWSD knowledge-base solution articles. Pass query for free-text search across titles and descriptions; pass category to filter to a category name. Returns compact summaries with truncated excerpts (240 chars). Use swsd_get_solution for the full HTML body of any one result. NOTE: search is asynchronously indexed — articles created or updated in the last few minutes (sometimes hours) may not appear yet. To verify a just-created article, use swsd_get_solution with the ID returned by swsd_create_solution.

List open incidents ranked by SLA breach risk. Computes a risk level for each incident based on due_at and sla_violations: "breached" (overdue or has violations), "critical" (due within 4 hours), "warning" (due within at_risk_within_hours), "ok", or "no_due_date". Results are sorted with breached first (most overdue first), then by time-to-breach ascending, no_due_date last. Defaults to excluding Resolved and Closed states. Limitation: incident list rows only normally include due_at. The sla_violations[] array is only present on the long incident layout, so rows are ranked primarily by due_at and violations are counted only when SWSD happens to include them on the row. Use swsd_get_incident with detail_level long for a complete per-incident SLA picture.

Summarize scanned tickets created OR last updated in [from, to), defaulting to the last seven days. Alternates created and updated incident-list queries, deduplicates IDs, and shares max_pages across both scans. Totals and breakdowns cover only scanned matching rows, not the tenant backlog or a historical state snapshot. Open excludes Resolved/Closed; unassigned means no individual assignee. Breached uses computeSlaRisk on open tickets at scan time, using due_at and any returned sla_violations (list rows may omit violations). Resolution counts and median elapsed hours use valid resolved_at timestamps in the window only; rows without resolved_at are excluded, never approximated with updated_at. The list API may omit resolved_at, so resolution metrics may be incomplete. An older ticket resolved during the window but last updated afterward can also be absent from these date-filtered scans. Median is null if no valid nonnegative created_at-to-resolved_at durations exist. Assignee/category breakdowns return the top ten.

Update the body of an existing SWSD incident comment. Pass incident_id, comment_id, and the new body. The is_private flag cannot be changed by this tool — to change visibility, delete and re-create. WRITE — does not retry on transient failure.

Update an existing SWSD incident. Pass id and any fields to change. Only fields you provide are sent — others stay as-is. For state transitions prefer swsd_update_incident_state (safer wrapper); for assignment prefer swsd_assign_incident; for comments use swsd_add_incident_comment. WRITE — does not retry on transient failure. To set tenant-specific custom field values, pass custom_fields: [{name, value}] — call swsd_describe_custom_fields first to discover field names and (for Dropdowns) allowed values. Validated for Text, Dropdown, Number, Checkbox, and Date types.

Transition an SWSD incident to a new state (e.g., "Assigned", "Resolved", "Closed"). Safer wrapper around swsd_update_incident — narrows the agent decision surface. State names are tenant-specific; common ones: "New - Unassigned", "Assigned", "In Progress", "Awaiting Input", "Resolved", "Closed". Call swsd_get_incident first to see the current state. WRITE — does not retry on transient failure.

Update an existing SWSD problem. Pass id and any fields to change. Only provided fields are sent — others stay as-is. To replace the description entirely, pass the full new body. WRITE — does not retry on transient failure.

Update a SWSD incident sub-task. Pass incident_id (internal id or incident number), task_id, and name, assignee_email, due_at (ISO datetime), and/or is_complete. Only provided fields are sent. WRITE — honors SWSD_WRITE_MODE and does not retry on transient failure.

Mark a SWSD incident sub-task as complete or incomplete. Pass completed: true to set the task to "Completed", or completed: false to revert to "New". For finer state control (e.g., "In Progress"), use the SWSD UI directly — this tool is the safer wrapper for the common done/not-done transition. WRITE — idempotent: re-applying the same value is a no-op on SWSD.

Update an existing SWSD time entry on an incident, problem, change, or release. Pass name and/or minutes_parsed. WRITE — honors SWSD_WRITE_MODE and does not retry on transient failure.

Upload an attachment to a SWSD incident, problem, change, release, solution, hardware asset, other asset, or configuration item. Use content_base64 for hosted/HTTP clients; file_path is allowed only on stdio. WRITE — honors SWSD_WRITE_MODE.