list_security_incidents

What list_security_incidents does on ServiceNow-MCP

AI agents call list_security_incidents to retrieve information from ServiceNow-MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_security_incidents is rated Low

Listing or querying existing incidents is a read-only operation that retrieves data without modifying, deleting, or executing any actions. The blast radius of misuse is minimal — an agent could only retrieve security incident information that likely exists within the ServiceNow instance, not create, modify, or delete records.

From the tool's definition Tool name includes 'list' and description states 'List security incidents with filters' — this is a retrieval operation with no side effects. The filters (severity, state, category) are query parameters, not mutation operations.

The rule that runs list_security_incidents safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_security_incidents, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_security_incidents": {}
  }
}

Questions about list_security_incidents