get_security_incident

What get_security_incident does on NowAIKit — ServiceNow AI Toolkit

AI agents call get_security_incident to retrieve information from NowAIKit — ServiceNow AI Toolkit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_security_incident is rated Low

This tool retrieves security incident information without side effects. While the data retrieved may be sensitive (security incidents), the action itself is read-only. Severity is marked 'high' due to the sensitive nature of security incident data that could be misused if exposed to an unauthorized agent, but the category is definitively Read per the classification rules.

From the tool's definition Tool name 'get_security_incident' combined with description 'Get full details of a security incident by number or sys_id' — uses verb 'Get' and explicitly states retrieval of incident data with no modification or deletion.

The rule that runs get_security_incident safely

PolicyLayer is an MCP gateway: it sits between your AI agents and NowAIKit — ServiceNow AI Toolkit, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_security_incident, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_security_incident": {}
  }
}

Questions about get_security_incident