Create a new ServiceNow incident.

Args: short_description: Brief summary of the incident (required). description: Full description of the issue. urgency: "1" (High), "2" (Medium), or "3" (Low). impact: "1" (High), "2" (Medium), or "3" (Low). category: Incident category, e.g. "software", "hardware", "network". assignment_group: Name or sys_id of the assignment group. caller_id: Name or sys_id of the user reporting the incident.

Fetch a ServiceNow incident by its number (e.g. INC0010023) or sys_id.

Update fields on an existing incident.

Args: number_or_sys_id: Incident number (e.g. INC0010023) or sys_id. fields: Field name -> new value, e.g. {"state": "2", "priority": "1"}.

Search incidents using a ServiceNow encoded query.

Args: query: ServiceNow encoded query string (sysparm_query), e.g. "active=true^priority=1" or "assigned_to.nameLIKEJohn". Leave empty to list the most recent incidents. limit: Max number of records to return (default 10). offset: Number of records to skip, for pagination.

Add a customer-visible comment or an internal work note to an incident.

Args: number_or_sys_id: Incident number or sys_id. comment: Text to add. work_note: If True, adds as an internal work note instead of a customer-visible comment.

Resolve an incident by setting its state to Resolved.

Args: number_or_sys_id: Incident number or sys_id. close_notes: Notes describing the resolution. close_code: Resolution code, e.g. "Solved (Permanently)", "Solved (Workaround)".