servicenow-incident-management

name	servicenow-incident-management
skill_type	skill
description	ITSM incident operations on the ServiceNow Incident API via the servicenow-api MCP server — list, read, and create incident records with the domain-typed tool (not raw table calls). Use when the agent must triage active incidents, fetch one incident by sys_id, or open a new incident with fields like short_description, urgency, impact, and caller_id. Do NOT use for generic record CRUD on arbitrary tables (use servicenow-table-api), change requests (servicenow-change-management), CMDB CIs (servicenow-cmdb), or knowledge articles (servicenow-knowledge); prefer those.
license	MIT
tags	["servicenow","incident","itsm","rest-api","mcp"]
metadata	{"author":"Genius","version":"0.1.0"}

ServiceNow Incident Management

Domain-typed access to the ServiceNow Incident table (incident) for ITSM triage and intake. Prefer these tools over raw table CRUD — they carry the incident field conventions and return incident-shaped records.

When to use

• List / triage active incidents (e.g. ordered by priority).
• Fetch a single incident by sys_id.
• Create a new incident (short_description + urgency/impact/caller_id).

When NOT to use

• Generic CRUD on any other table → servicenow-table-api.
• Change requests, CMDB CIs, or knowledge articles → their dedicated skills (servicenow-change-management, servicenow-cmdb, servicenow-knowledge).
• Bulk state transitions or fields the typed tool doesn't expose → fall back to servicenow-table-api against the incident table.

Prerequisites & environment

Connect via the mcp-client skill against the servicenow-api MCP server.

Variable	Required	Notes
SERVICENOW_INSTANCE	✅	Instance URL (alias SERVICENOW_URL)
SERVICENOW_USERNAME	✅	Basic-auth user
SERVICENOW_PASSWORD	✅	Basic-auth password
SERVICENOW_CLIENT_ID / SERVICENOW_CLIENT_SECRET	optional	OAuth2
SERVICENOW_SSL_VERIFY	optional	TLS verification toggle

Full env/tag matrix (do not re-document here): the mcp-client reference agent-tools/mcp-client/references/servicenow-api.md. MCP_TOOL_MODE (condensed|verbose|both) selects the condensed surface (used below) vs. the one-to-one verbose tools.

Tools & actions

Prefer the condensed tool; it takes action + a params_json JSON string whose keys are passed straight to the client method.

Condensed tool	Actions
servicenow_incidents	get_incidents, get_incident, create_incident

Key parameters

• sys_id — required for get_incident.
• data — object of field→value for create_incident (short_description, urgency, impact, caller_id, …).
• Query/pagination controls (sysparm_query, sysparm_fields, sysparm_limit, sysparm_offset, sysparm_display_value) follow Table-API encoded-query syntax — see servicenow-table-api for the cheat-sheet.

Recipes (params_json)

List active incidents ordered by priority (newest first, few fields):

{"sysparm_query":"active=true^ORDERBYpriority^ORDERBYDESCsys_created_on","sysparm_fields":"number,short_description,priority,state,assigned_to","sysparm_limit":25,"sysparm_display_value":"true"}

Get one incident by sys_id (with both raw + display values):

{"sys_id":"<sys_id>","sysparm_display_value":"all"}

Create an incident:

{"data":{"short_description":"VPN gateway unreachable from HQ","urgency":"1","impact":"2","caller_id":"<user_sys_id>"}}

Gotchas

• params_json is a string of JSON, not an object — serialize it.
• urgency/impact are choice values (typically 1=High … 3=Low); the derived priority is calculated by the platform, not set directly.
• caller_id expects a sys_user sys_id (or a value the instance can resolve); look it up via servicenow-table-api on sys_user if you only have a name.
• Prefer sysparm_fields + a sane sysparm_limit; unbounded reads are slow.

Related

• An internal ingest_incidents_to_kg misc tool exists for KG plumbing (pull incidents into the knowledge graph). It is not part of the operational surface — use it only for ingestion, not for the triage/intake recipes above.
• Composed by: the universal-skills servicenow_incident_tracker workflow composes this skill for end-to-end incident tracking.