list_oauth_applications

What list_oauth_applications does on ServiceNow MCP Server

AI agents call list_oauth_applications to retrieve information from ServiceNow MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_oauth_applications is rated Low

While this tool only retrieves (read) OAuth application configurations without modifying them, the sensitivity of the information exposed (authentication credentials, client applications) warrants a high severity rating. An adversary gaining access to this list could identify and target OAuth applications, potentially extract credentials, or understand the authentication landscape.

From the tool's definition Tool name contains 'list' and description states 'List OAuth application registry entries', indicating a retrieval operation. However, the data retrieved—OAuth client applications and authentication credentials—is highly sensitive.

The rule that runs list_oauth_applications safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_oauth_applications, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_oauth_applications": {}
  }
}

Questions about list_oauth_applications