run_discovery_scan

What run_discovery_scan does on ServiceNow-MCP

AI agents invoke run_discovery_scan to trigger actions in ServiceNow-MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why run_discovery_scan is rated High

This tool triggers external discovery operations that scan network infrastructure. Although discovery scans are typically reversible, they are Execute-category because they initiate autonomous processes whose behavior and scope depend on configuration arguments. The scan could enumerate sensitive infrastructure, trigger unexpected agent communications, or consume significant resources.

From the tool's definition Tool description states 'Trigger a ServiceNow Discovery scan for network/infrastructure'. The verb 'Trigger' indicates the tool initiates an external operation (a network discovery scan) whose effects depend on runtime arguments and network state.

The rule that runs run_discovery_scan safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For run_discovery_scan, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "run_discovery_scan": {
      "limits": [
        {
          "counter": "run_discovery_scan_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about run_discovery_scan