snow_get_by_sysid

What snow_get_by_sysid does on Serac

AI agents call snow_get_by_sysid to retrieve information from Serac without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why snow_get_by_sysid is rated Low

This tool retrieves data from ServiceNow by a unique identifier. While it can access any record (broad scope), the operation itself is read-only with no mutation, creation, deletion, or execution of code. The severity is low because data retrieval alone has minimal blast radius unless the data itself is sensitive, but misuse would manifest as information disclosure rather than system compromise or data loss.

From the tool's definition Tool name 'snow_get_by_sysid' and description 'Get any ServiceNow record by sys_id with optional field selection' indicate a retrieval operation.

The rule that runs snow_get_by_sysid safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Serac, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For snow_get_by_sysid, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "snow_get_by_sysid": {}
  }
}

Questions about snow_get_by_sysid