list_script_includes

What list_script_includes does on ServiceNow MCP Server

AI agents call list_script_includes to retrieve information from ServiceNow MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_script_includes is rated Low

This is fundamentally a read/query operation—it retrieves a list of existing script includes without modifying or executing them. However, the medium severity reflects that script includes are code objects whose contents may expose sensitive information (business logic, credentials, API keys). An AI agent could enumerate and analyze scripts to identify vulnerabilities or extract secrets.

From the tool's definition Tool name 'list_script_includes' and description 'List script includes' indicate a retrieval operation. However, the requirement 'SCRIPTING_ENABLED=true' and the context of accessing script includes (executable code fragments in ServiceNow) elevates risk.

The rule that runs list_script_includes safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_script_includes, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_script_includes": {}
  }
}

Questions about list_script_includes