Skip to main content
Glama
tedorigawa001

ServiceNow-MCP

by tedorigawa001
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

run_security_playbook

Start a Security Incident Response playbook (a Process Automation Designer definition in the sn_si_aw scope) against a security incident, the same way the SIR Analyst Workspace does: sn_playbook.PlaybookExperience.triggerPlaybook().

Instructions

Start a Security Incident Response playbook (a Process Automation Designer definition in the sn_si_aw scope) against a security incident, the same way the SIR Analyst Workspace does: sn_playbook.PlaybookExperience.triggerPlaybook(). Schedules a one-time server script, so it requires SCRIPTING_ENABLED=true. Skips if that playbook is already queued or in progress on the incident. Set wait_seconds to poll for the resulting execution (sys_pd_context). [Scripting]

Input Schema

NameRequiredDescriptionDefault
playbookNoPlaybook sys_id or scoped name (sys_pd_process_definition.name, e.g. "security_incident_malware_manual_template_v1"). See list_security_playbooks.
wait_secondsNoPoll sys_pd_context for the new execution for up to this many seconds (0-180, default 0 = return right after scheduling).
incident_sys_idYesSecurity incident (sn_si_incident) sys_id to run against
playbook_sys_idNoAlias of playbook (accepted for compatibility).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changedv1.15.1
    • changedInput schema / properties / incident_sys_id / description
      Previous value: -"Security incident sys_id to run against"New value: +"Security incident (sn_si_incident) sys_id to run against"
    • removedInput schema / properties / parameters
      Removed value: -{
-  "description": "Optional playbook input parameters",
-  "type": "object"
-}
    • addedInput schema / properties / playbook
      Added value: +{
+  "description": "Playbook sys_id or scoped name (sys_pd_process_definition.name, e.g. \"security_incident_malware_manual_template_v1\"). See list_security_playbooks.",
+  "type": "string"
+}
    • changedInput schema / properties / playbook_sys_id / description
      Previous value: -"Playbook sys_id to execute"New value: +"Alias of playbook (accepted for compatibility)."
    • addedInput schema / properties / wait_seconds
      Added value: +{
+  "description": "Poll sys_pd_context for the new execution for up to this many seconds (0-180, default 0 = return right after scheduling).",
+  "type": "number"
+}
    • changedInput schema / required
      Previous value: -[
-  "playbook_sys_id",
-  "incident_sys_id"
-]New value: +[
+  "incident_sys_id"
+]
  2. First observedv1.0.2

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond annotations: it schedules a one-time server script, requires SCRIPTING_ENABLED=true, skips when already queued or in progress, and uses wait_seconds to poll the resulting sys_pd_context. These details cover side effects, prerequisites, and duplicate-avoidance that the annotations do not.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and resource, then layers prerequisite, skip behavior, and polling in a compact sequence. The technical density is appropriate and no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating scripting tool with no output schema, it covers the key operational context: required scripting flag, duplicate-skip behavior, and polling semantics. It could say more about the returned execution information or failure behavior, but is otherwise complete enough to invoke safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameter meaning is already documented in the input schema. The description restates wait_seconds polling and points to list_security_playbooks, but adds little beyond what the schema already says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb/resource pair: start a Security Incident Response playbook against a security incident. It also names the underlying mechanism (sn_playbook.PlaybookExperience.triggerPlaybook) and scope (sn_si_aw), so it is distinguishable from list_security_playbooks and generic flow tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Makes the intended context clear: run this against a security incident, the same way SIR Analyst Workspace does. It does not explicitly compare against alternatives such as trigger_agentic_playbook or state when not to use it, so it stops short of full usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools