list_flows

What list_flows does on ServiceNow-MCP

AI agents call list_flows to retrieve information from ServiceNow-MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_flows is rated Low

This is a pure query/read operation that retrieves information about Flow Designer flows without creating, modifying, deleting, or executing them. The use of 'list' and 'filter' indicates passive data retrieval. The blast radius of misuse is minimal as it only exposes metadata about existing flows without triggering actions or changing system state.

From the tool's definition Tool description states 'List Flow Designer flows with optional filter by name, category, or active status' - this is a retrieval operation with no modification, deletion, or execution of flows, only listing and filtering existing flows.

The rule that runs list_flows safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_flows, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_flows": {}
  }
}

Questions about list_flows