list_widget_instances

What list_widget_instances does on ServiceNow-MCP

AI agents call list_widget_instances to retrieve information from ServiceNow-MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_widget_instances is rated Low

This is a straightforward data retrieval operation that reads widget configuration or placement information from ServiceNow portal pages. It has no side effects, does not modify state, and presents no blast radius if an AI agent invokes it with any arguments. The worst case is information disclosure of portal widget metadata, which is low severity in most organizational contexts.

From the tool's definition Tool name and description indicate a retrieval operation: 'List instances of a specific widget placed on portal pages' — this queries existing widget data without modifying, deleting, or executing operations.

The rule that runs list_widget_instances safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_widget_instances, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_widget_instances": {}
  }
}

Questions about list_widget_instances