list_script_includes

What list_script_includes does on NowAIKit — ServiceNow AI Toolkit

AI agents call list_script_includes to retrieve information from NowAIKit — ServiceNow AI Toolkit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_script_includes is rated Low

This tool retrieves or enumerates script includes from ServiceNow—a read operation with no side effects. However, severity is elevated to 'medium' (rather than 'low') because script includes in ServiceNow can contain sensitive business logic and security mechanisms; an attacker who learns what scripts exist and their names could use that intelligence for further exploitation.

From the tool's definition Tool name 'list_script_includes' and description 'List script includes' indicate retrieval/query of existing data. The conditional requirement '(requires SCRIPTING_ENABLED=true)' shows this is a read operation gated by a security flag.

The rule that runs list_script_includes safely

PolicyLayer is an MCP gateway: it sits between your AI agents and NowAIKit — ServiceNow AI Toolkit, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_script_includes, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_script_includes": {}
  }
}

Questions about list_script_includes