get_discovery_run

What get_discovery_run does on ServiceNow-MCP

AI agents call get_discovery_run to retrieve information from ServiceNow-MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_discovery_run is rated Low

This tool retrieves and queries discovery run data from ServiceNow by identifier (sys_id or number), returning status information. The verb 'Get' and the absence of any side effects, modifications, or state changes makes this a Read operation. The severity is low because disclosure of discovery run metadata poses minimal risk compared to tools that execute code, delete data, or move money.

From the tool's definition Tool name 'get_discovery_run' and description 'Get one Discovery run by sys_id or number' clearly indicates a retrieval operation with no modification, deletion, or execution of arbitrary code.

The rule that runs get_discovery_run safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_discovery_run, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_discovery_run": {}
  }
}

Questions about get_discovery_run