snow_push_artifact

What snow_push_artifact does on Serac

AI agents use snow_push_artifact to create or update resources in Serac, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Serac environment.

Why snow_push_artifact is rated Medium

This tool modifies existing artifacts in ServiceNow by uploading locally edited versions. While it changes data, the action is reversible (artifacts can be edited again or reverted), placing it in the Write category rather than Destructive. Severity is high because a compromised agent could push malicious or incorrect artifacts to ServiceNow, affecting enterprise configurations, workflows, or deployments.

From the tool's definition Tool name 'snow_push_artifact' with description 'Push locally edited artifact files back to ServiceNow' indicates creation or modification of data in ServiceNow. The verb 'push' combined with 'edited artifact files' demonstrates reversible data mutation.

The rule that runs snow_push_artifact safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Serac, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For snow_push_artifact, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "snow_push_artifact": {
      "limits": [
        {
          "counter": "snow_push_artifact_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about snow_push_artifact