get_risk_statement

What get_risk_statement does on ServiceNow-MCP

AI agents call get_risk_statement to retrieve information from ServiceNow-MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_risk_statement is rated Low

This tool retrieves information about a risk statement using a unique identifier (sys_id). It performs a read-only query operation with no capability to modify, delete, or execute actions. The blast radius of misuse is limited to potential unauthorized information disclosure of risk data already stored in ServiceNow, which is a low-severity read vulnerability.

From the tool's definition Tool name 'get_risk_statement' and description 'Get full details of a single Risk Statement by sys_id' indicate a retrieval operation that queries and returns data without modification or side effects.

The rule that runs get_risk_statement safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_risk_statement, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_risk_statement": {}
  }
}

Questions about get_risk_statement