list_changesets

What list_changesets does on NowAIKit — ServiceNow AI Toolkit

AI agents call list_changesets to retrieve information from NowAIKit — ServiceNow AI Toolkit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_changesets is rated Low

This is a Read operation—it retrieves and lists existing changesets without creating, modifying, or deleting data. However, severity is elevated to medium because changesets in ServiceNow represent code/configuration changes in a controlled deployment system, and listing them could reveal sensitive system architecture, deployment history, and change details that an attacker could leverage for further exploitation.

From the tool's definition Tool name 'list_changesets' and description 'List update sets (changesets)' indicate a retrieval/query operation that returns data about update sets in ServiceNow without modifying them.

The rule that runs list_changesets safely

PolicyLayer is an MCP gateway: it sits between your AI agents and NowAIKit — ServiceNow AI Toolkit, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_changesets, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_changesets": {}
  }
}

Questions about list_changesets