get_changeset

What get_changeset does on ServiceNow MCP Server

AI agents call get_changeset to retrieve information from ServiceNow MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_changeset is rated Low

This tool retrieves details about an update set (changeset) in ServiceNow, which is a read operation with no side effects. However, severity is elevated to 'medium' rather than 'low' because update sets in ServiceNow contain code/script definitions that could include sensitive business logic or security-relevant configurations.

From the tool's definition Tool name 'get_changeset' and description 'Get details of an update set' indicate retrieval of data without modification. The requirement flag 'SCRIPTING_ENABLED=true' suggests access to sensitive configuration data, but the action itself is read-only.

The rule that runs get_changeset safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_changeset, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_changeset": {}
  }
}

Questions about get_changeset