ml_similar_incidents

What ml_similar_incidents does on ServiceNow MCP Server

AI agents call ml_similar_incidents to retrieve information from ServiceNow MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why ml_similar_incidents is rated Low

This is a read-only tool that searches and retrieves similar incident data from ServiceNow. It performs a query operation with no ability to create, modify, delete, or execute external code. The primary risk is information disclosure of potentially sensitive incident data, but this is typical for a search function in an enterprise system.

From the tool's definition Tool description states 'Find similar past incidents using keyword-based matching' — a retrieval operation that queries existing data without modification or side effects. The action is limited to searching and returning matching records based on keywords.

The rule that runs ml_similar_incidents safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For ml_similar_incidents, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "ml_similar_incidents": {}
  }
}

Questions about ml_similar_incidents