High-risk tools in Serac

Execute an enterprise tool by name. Use enterprise_tool_search first to discover available tools.

Attempts automated resolution of technical incidents based on known patterns and previous solutions. Includes dry-run mode for safety.

Execute a tiered incident response playbook (contain / isolate / eradicate / recover) for a known threat ID. Either runs the action set automatically and notifies the listed gro...

Send multiple REST calls in a single round-trip via /api/now/v1/batch. Each entry has method, url, and body — replies come back in order under a generated batch ID. Cuts overhea...

Unified change management (create, update_state, approve, create_task, schedule_cab)

Trigger CI/CD deployment pipeline

Sample a defined metric on-demand: runs the platform MetricBaseCollector against a metric_definition sys_id to write a fresh measurement point. Companion to snow_create_metric.

⚡ Confirms and schedules script after user approval (use after snow_execute_script with requireConfirmation=true). Note: Uses same scheduled job approach.

Convert ES6+ JavaScript to ES5 for ServiceNow compatibility. Use this when debugging SyntaxErrors.

Convert modern JavaScript (ES6+) to ES5 for ServiceNow Rhino engine

Creates a mobile action that users can trigger from the mobile app. Actions can navigate, execute scripts, or open forms.

Creates vulnerability scanning configurations. Schedules scans, sets severity thresholds, and enables auto-remediation.

Make an arbitrary REST call to any ServiceNow endpoint with the chosen method (GET/POST/PUT/PATCH/DELETE), path, query params, and JSON body. Escape hatch for endpoints that don

Execute a server-side operation that requires elevated privileges (security_admin scope — ACL modifications, high-security properties, etc.). ALWAYS returns a confirmation promp...

Initiate employee offboarding workflow

Trigger employee onboarding workflow

Executes an ATF test or test suite and returns the results. Tests run asynchronously in ServiceNow using sys_atf_test_result table.

Execute server-side JavaScript on ServiceNow. Primary: synchronous execution via Scripted REST API (~1-3s). Fallback: scheduled job if endpoint unavailable. Auto-deploys the exe...

Execute automated security response playbook with orchestrated actions

Execute transform map on import set

Build a local ServiceNow Fluent (SDK) project with now-sdk build. Compiles .now.ts Fluent sources + metadata XML

Deploy a built ServiceNow Fluent (SDK) project to the connected instance with now-sdk install. Build first with

Convert ServiceNow app metadata XML into Fluent (SDK) TypeScript code with now-sdk transform. Use after snow_fluent_init

Deploy files directly from GitHub to ServiceNow — content never passes through LLM context. Three modes: 1. Single file: source_path → one artifact field 2. Directory → Widget:...

Run a GraphQL query against /api/now/graphql with optional variables. Use when you need to fetch nested data across tables in one round-trip; for simple list/get on a single tab...

Initiates handoff from Virtual Agent to a live agent when automated assistance is insufficient.

Hash string using various algorithms

Install application from store

Install and manage IntegrationHub Spokes (Jira, Slack, Azure DevOps, etc.)

Manage IntegrationHub spoke connections: configure, test, and troubleshoot

Make ML prediction using trained model

Orchestrates complex development workflows with intelligent agent coordination, shared memory, and real-time progress tracking.

Force-redeploy the Serac scripted REST executor endpoint (/api/snow_flow_exec/execute). Use when snow_execute_script / UI policy tools fail with

Unified tool for ServiceNow report lifecycle beyond creation: list, get, run, schedule, share, and export. Wraps sys_report, sysauto_report, and sys_report_users_groups. Action...

Universal REST Message management tool. CRUD operations for: • REST Messages (list, get, create, update, delete) • HTTP Methods (list_methods, get_method, create_method, update_...

Comprehensive testing suite for REST messages including authentication, endpoints, headers, and response validation.

Retry failed operation with backoff

Run compliance scans against security frameworks (SOX, GDPR, HIPAA, PCI-DSS)

Queue a CMDB discovery scan against a discovery schedule, optionally narrowed to a target IP/range and a specific MID Server. Creates a discovery_schedule_item; the scan runs as...

Scan for security vulnerabilities

Invoke a Scripted REST API resource at /api/<namespace>/<path> with chosen method (GET/POST/PUT/PATCH/DELETE) and optional JSON body. Use for instance-defined REST endpoints; fo...

Sends a push notification to mobile devices. Can target specific users, groups, or all users.

Sends a message to Virtual Agent and gets the response. Simulates user interaction with the chatbot.

Unified tool for orchestrating Security Incident Response (SIR) playbooks on sn_si_playbook and sn_si_playbook_task. Drives a playbook step-by-step against an incident, tracking...

Sleep for specified milliseconds

Unified tool for the ServiceNow Studio Source Control plugin. Bridges git-style operations against an application

⚠️ LEGACY: Start a workflow on a record (deprecated - ServiceNow recommends Flow Designer). Workflows run asynchronously.

Test REST/SOAP integrations and external connections with validation

Test MID Server connectivity to external endpoints and diagnose network issues

🎯 Train native ServiceNow Predictive Intelligence solution. Starts ML training INSIDE ServiceNow (requires PI license). Training typically takes 10-30 minutes.

Trigger training of a Virtual Agent NLU model by model_id via /api/now/v1/va/models/{id}/train. Training runs asynchronously on the platform; this call only starts the job.

Transform data using field mappings

⚠️ UNRELIABLE: Attempts to trigger a scheduled job via sys_trigger, but CANNOT guarantee execution. The job runs asynchronously when the ServiceNow scheduler picks it up — this ...

Executes comprehensive widget testing with multiple data scenarios. Validates client/server scripts, API calls, dependencies, and generates coverage reports.