run_discovery_scan

What run_discovery_scan does on NowAIKit — ServiceNow AI Toolkit

AI agents invoke run_discovery_scan to trigger actions in NowAIKit — ServiceNow AI Toolkit. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why run_discovery_scan is rated High

Although labeled [Write], triggering a discovery scan is fundamentally an Execute action: it runs an external operation (network scanning) whose blast radius depends on what systems are in scope. The scan itself does not create or modify persistent data in a reversible manner — it initiates a potentially invasive security probe across infrastructure. This exceeds simple data creation and warrants Execute severity.

From the tool's definition 'Trigger a ServiceNow Discovery scan for network/infrastructure' — the tool initiates a scan operation that probes network and infrastructure systems, an active operation whose scope and effects depend on configuration arguments.

The rule that runs run_discovery_scan safely

PolicyLayer is an MCP gateway: it sits between your AI agents and NowAIKit — ServiceNow AI Toolkit, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For run_discovery_scan, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "run_discovery_scan": {
      "limits": [
        {
          "counter": "run_discovery_scan_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about run_discovery_scan