v3.1.1

Fixed

• The outbound User-Agent no longer carries user=<user> (added in 3.1.0); it is servicenow-mcp-ai/<version> (node/<major>; <transport>) again, naming neither the MCP client nor the user. SN_USER_AGENT_SUFFIX is unchanged. tools/list: +0 B.
• MCP Registry: the server.json remote is https://{servicenow_mcp_ai_host}/mcp; the registry refused 3.1.0 because https://{host}/mcp is already registered by another server.

v3.1.0

Added

• Attachment file I/O (N-66): servicenow_upload_attachment accepts file_path — a file under SN_DOCS_DIR (the docs-store confinement, symlink check and journal-file refusal apply; the size is checked against SN_MAX_UPLOAD_BYTES before the file is read; the content type defaults by extension) — as the alternative to content_base64, and servicenow_download_attachment accepts format: "file", which writes the bytes to <profile>/exports/<name>-<stamp>.<ext> and returns the path, size, sha256 and, for text-like content, a preview instead of base64. The write journal records the effective name, type and path, never the bytes. tools/list: +60 B per profile; the five attachment tool descriptions were shortened to pay for it.
• Schema authoring through the registry (N-70): servicenow_upsert_artifact with artifactType: "table" now writes a column's internal_type, max_length, reference, column_label, mandatory, default_value, choice and attributes on the sys_dictionary child, label, plural and hint on the sys_documentation child and value, sequence and inactive on the sys_choice child — a string field with its choices is one call. internal_type and reference take the glide-object / table name (verified on a PDI); read_only is read-only on the instance and stays out. sys_db_object and sys_dictionary join the protected tables: under the confirm default a write runs only when the call itself passes apply: true (artefact upserts already do), deny refuses it and an exact SN_TABLES_ALLOW entry lifts the rule. tools/list: +0 B.
• Event queue and three prompts (N-69): servicenow_read_ops gains kind: "events" over sysevent — the ready backlog and its oldest entry (all-time), the events fired in the window by state and by name (top 10) and, for the single kind, the newest rows (name, table, state, queue, process_on, processed, processing_duration, claimed_by, user_name, parm1 / parm2 clipped); the overview carries the section as counts only and an unreadable sysevent degrades alone. Three prompts: servicenow_incident_rca (record, table, since; the history package) walks audit trail → table logic → changes in the window → error log and events → SLAs; servicenow_release_notes (update_set, audience; updatesets) groups the set by type and action, explains each script and writes Markdown for a technical or business audience; servicenow_clone_down_checklist (target, source; instance) snapshots the target, reads the mail properties and clone_data_preserver, diffs source vs target and, after the clone, the target against its snapshot. sysevent and clone_data_preserver verified on a PDI. tools/list: +11 B on all / all+tasks / all+legacy, 0 B on core / discovery; the read_ops description was shortened to stay inside the budgets.
• Multi-row and file-sourced import (N-68): servicenow_insert_import_set_row takes rows (up to 500 column/value objects) or file_path — a .csv with a header row or a .jsonl with one object per line under SN_DOCS_DIR (the docs-store confinement, symlink check and journal-file refusal apply; SN_DOCS_MAX_FILE_BYTES is checked on the stat before the read; a BOM, CRLF and RFC 4180 quoting are handled; JSONL values may be strings, numbers, booleans or null) — as the alternatives to the single values row; exactly one of the three. Several rows go through POST /api/now/import/{table}/insertMultiple in one request; an instance without the endpoint (404 / 405) gets one request per row and the call stops at the first row that fails (failed: { index, error, code }, sent of rows). The result reports mode, rows, sent, the transform results, the distinct import_sets and the run and transform maps of the last import set; the plan preview shows row_count, columns and the first row. The write journal holds one envelope per call (row count, columns, the file's path and format, a sha256 of the rows; its write-cap weight is the row count, so SN_MAX_WRITES_PER_SESSION refuses the whole call before any request) and, in the sequential mode, one line per sent row under the envelope's batch_id. insertMultiple is verified on a PDI (OD-14); the fallback covers its absence. tools/list: +339 B on all / all+tasks and +348 B on all+legacy for the two parameters, 0 B on core / discovery, paid for by shortening four shared parameter descriptions (update_set, lanes, wait_seconds and the opt-in script-type note; no tool description changed, the offline eval is unchanged) — net −472 B on all / all+tasks, −537 B on all+legacy, −144 B on core / discovery.
• Basic-auth preflight (N-75): for a basic-auth profile, servicenow-mcp-ai doctor reads the instance's basic-auth restriction (glide.authenticate.basic_auth.restriction.*, verified on a PDI) and reports whether the connected user holds an allowed role (snc_basic_auth_api_access by default) or is in allowed_users; a basic_auth check appears in doctor --json and the support bundle. Informational — the verdict does not change; an unreadable restriction renders nothing.
• Resource polish (N-80): every prompt and every ui:// app view carries the server icon (tools do not — ≈120 B per tool); servicenow://reference/tools, the servicenow://reference/tools/{name} template, servicenow://reference/encoded-query and servicenow://policy are annotated audience: ["assistant"]; docs entries in resources/list carry size and annotations.lastModified from the file on disk, and the index entry says how many documents the 100-entry cap left out; a capped schema list (servicenow://schema/{table}, servicenow://{profile}/table/{table}/schema) ends with a synthetic "N more — narrow with " entry instead of cutting silently. A not-found resource error (NOT_FOUND, UNKNOWN_PROFILE, INSTANCE_HTTP_404) adds uri to its data beside code / source / hint; the wire code stays -32602. Cursor pagination of resources/list is deferred until a client asks. prompts/list and resources/list grow by the icon data URI per prompt / view; tools/list: +0 B.
• SSE resumability on stateful HTTP sessions (N-79): each session keeps an in-memory ring of its last 256 events (at most 256 KiB, oldest dropped, gone with the session), so a client whose SSE stream drops reconnects with Last-Event-ID and gets the missed messages; an id the ring no longer holds answers 400. Clients on protocol 2025-11-25 or later now see a priming event (an id with empty data) at the start of each stream. The stateless modern wire is unchanged. tools/list +0 B.
• Task progress (N-82): tasks/get on a background run shows its progress as statusMessage ("3/12 — incident", capped at 200 characters) — for run_as_task on the 2025-11-25 wire and for the tasks extension on 2026-07-28. Advertising taskSupport waits for tools/list headroom (OD-15). tools/list +0 B.
• GEMINI.md and Cursor rules (N-76, part 3): npm run docs:instructions also renders the root GEMINI.md from AGENTS.md (the same text as .github/copilot-instructions.md) and one auto-attached Cursor rule per area, .cursor/rules/<area>.mdc (the area's title as description, its applyTo globs as globs), from .github/agent-instructions/. A generated rule whose source is gone is removed; a hand-written one is kept. -- --check covers them. tools/list +0 B; initialize instructions +0 B.
• servicenow-mcp-ai skills install --target agents|codex|cursor|gemini|claude|copilot (N-76, part 2) copies the bundled skills into that agent's skills folder in the current directory, or in the home directory with --global; a skill already there is kept unless --force. tools/list +0 B; initialize instructions +0 B.
• Skills over MCP (N-76, part 1): the eight plugin skills ship in the npm package under build/skills/ (npm run build copies them; the container image and the .mcpb bundle carry them too) and the server serves them through the Skills extension (SEP-2640, io.modelcontextprotocol/skills) — skills/list (one page; a cursor is -32602) returns each skill's verbatim frontmatter and every file with its sha256 digest and size, plus ttlMs / cacheScope on the 2026-07-28 wire; skills/get returns one skill, an unknown URI is -32602; each file reads as skill://<name>/<path> with its exact bytes and each SKILL.md is in resources/list. The skills ride on the docs package: the extension is declared unless docs is denied, and the catalog is empty while docs is off. A skill that breaks a rule (name ≠ folder, no SKILL.md, over 512 files or 16 MiB) is left out with a warning. The Docker build stage now copies tsconfig.build.json (missing since N-85, so the in-image npm run build failed), skills/ and the copy script; a test checks that the Dockerfile copies every input of npm run build. tools/list +0 B; initialize instructions +0 B.
• server.json (MCP Registry): websiteUrl, a remotes entry for a self-hosted HTTP deployment (https://{host}/mcp with a bearer header; there is no hosted instance) and, at publish time, the release bundle as an mcpb package — scripts/registry-mcpb.mjs appends it with its fileSha256 in the registry workflow (N-91).

Changed

• The outbound User-Agent no longer names the MCP client (claude-code, vscode, …): it is now servicenow-mcp-ai/<version> (node/<major>; <transport>; user=<user>), where user is the ServiceNow user the request calls as — the OAuth subject of a delegated request, otherwise the profile's SN_USER — reduced to printable ASCII without ;, (, ) or a backslash and capped at 64 characters; it is left out when no user name is configured. SN_USER_AGENT_SUFFIX is unchanged. tools/list: +0 B.
• Record watch on the 2026-07-28 wire (N-83): a subscriptions/listen filter's resourceSubscriptions...

v3.0.0

Breaking changes

These are the 3.0 changes the owner approved on 2026-10-01 (O-4). Each write-safety default has an explicit opt-out.

Upgrading from 2.x in one step: set SN_COMPAT=2 (owner, 2026-10-14). Every compat setting you leave unset then takes its 2.x default: SN_PROTECTED_TABLES_WRITE=allow, SN_DESTRUCTIVE_CONFIRM=off, SN_BATCH_UNMAPPED=allow, SN_LEGACY_TOOL_NAMES=1 and SN_TOOL_PACKAGES=core. A value you set explicitly always wins, and the prod profile still forces elicit confirmation. Unset (or 3), the 3.0 defaults below apply. servicenow-mcp-ai migrate --write carries a 2.x env file over: it moves a project-root .env to the XDG file, renames a reserved profile (B13) <name>_v2, comments out values 3.x rejects (B5) and adds SN_COMPAT=2, and does the same for the env blocks of the server in Claude Desktop, Claude Code, Cursor, VS Code and Windsurf config files; every other setting stays as it was.

Migration at a glance

One row per breaking change, from the breaking register in project/ROADMAP-V3.md. The bullets below give the details.

#	Change	Item	Migration
B1	Node ≥ 22.12	E-1	Upgrade Node; the launcher prints the requirement.
B2	Tool renames + parameter normalization (sys_id, table, fields/values)	M-7	None for a 2.x client: old names answer as hidden aliases. Generated old→new table; SN_LEGACY_TOOL_NAMES=1 also lists them.
B3	Error contract: snDetail → detail, new code; resources throw McpError	M-2	Update client parsers; codes documented in the manifest.
B4	Destructive apply:true needs a plan_token in plan mode (none → the preview); elicitation refusals fail	H-3	Call the tool without apply first and pass its plan_token; SN_DESTRUCTIVE_CONFIRM=off or SN_WRITE_MODE=apply for automation.
B5	Fail-fast safety settings (tuning values still warn); project .env deprecated	E-4	servicenow-mcp-ai migrate --write, or fix the reported value and move .env to XDG / set SN_ENV_FILE.
B6	HTTP: per-session profile; non-loopback bind refuses to start without SN_HTTP_TOKEN	H-7	Set the token; call use_instance per session.
B7	set_credentials: a new instance requires the auth material in the same call	H-2	Send user + password (or API key) with the host.
B8	batch: unmapped /api/* prefixes denied by default	H-4	SN_BATCH_UNMAPPED=allow or add the prefix to the map.
B9	Extension pinned to servicenow-mcp-ai@^3	D-6	None for users; publish the pinned extension first.
B10	Dark Jira scaffold removed (ARCH-14 = NO-GO, 2026-10-09)	E-8	None (no tools were exposed).
B11	Protected system tables need the call's own apply: true to write (sys_user, sys_user_has_role, sys_security_acl, …)	H-11	Pass apply: true, list the table in SN_TABLES_ALLOW, or set SN_PROTECTED_TABLES_WRITE=allow.
B12	use_instance no longer persists SN_ACTIVE_PROFILE to the env file	H-7	Pass persist:true; set SN_ACTIVE_PROFILE in the env file for a permanent default.
B13	Profile resources move to servicenow://profiles/{profile}/schema/{table}; profile names docs, schema, status, capabilities, reference, profiles, policy become reserved	M-7	Old template aliased for one minor; rename a reserved profile (migrate does it).
B14	ATF tools merged: list_atf_tests / list_atf_suites → servicenow_list_atf, run_atf_test / run_atf_suite → servicenow_run_atf (kind: test | suite) (O-4, 2026-10-13)	N-64	Use the new names with kind: "suite" for suites; the old names still answer as hidden aliases.
B15	servicenow_generate_fluent and the Fluent emitters removed; Fluent generation belongs to syncrona (ADR 0010, 2026-10-10)	P-26	Use syncrona fluent transform (or now-sdk transform) in the app's source repository.
B16	Cross-scope report: restricted[].status is a name (requested / denied / allowed / invalidated) instead of the raw integer choice (OD-7, 2026-10-13)	N-14	Compare against the names; an unknown value still passes through raw.
B17	UIB key fields renamed to the real columns: ux_declarative_action_definition action_name → name, ux_declarative_action_payload key → action_key, uib_event name → event_name (OD-1, 2026-10-13)	N-25	Read the new key names; the old keys were always empty.
B18	app_dependency retargeted from the absent sys_scope_dependency to sys_package_dependency_m2m, verified:true, key sys_package + dependency (OD-4, 2026-10-13)	P-2	Read the new key and meta fields; the type listed nothing before.
B19	sys_ux_form_action has one descriptor: uib_form_action merged into workspace_form_action (verified:true), the old id kept as an input alias (O-4, 2026-10-13)	N-34	Read workspace_form_action where outputs named uib_form_action.
B20	discovery (table, schema, aggregate + admin) is the default tool profile; core (the 2.x default, with attachment) stays as before (O-4, 2026-10-13; eased 2026-10-14)	N-63	Set SN_TOOL_PACKAGES=core for the 2.x set, or add attachment / enable it with servicenow_enable_package.
B21	batch: only /api/sn_cicd/testsuite and /api/sn_cicd/progress map to atf; other sn_cicd paths are unmapped, and ATF runs are refused on a production profile (O-4, 2026-10-13)	H-4	Use the dedicated tools; SN_BATCH_UNMAPPED=allow lets unmapped paths through the table and read-only checks.
B22	sys_group_has_role and sys_user_role_contains join the write-protected tables (O-4, 2026-10-13)	H-11	Pass apply: true, list the table in SN_TABLES_ALLOW, or set SN_PROTECTED_TABLES_WRITE=allow.
B23	exports map: only servicenow-mcp-ai (the entry point) and servicenow-mcp-ai/package.json resolve; sideEffects lists only the entry point (owner, 2026-10-14) ...

v3.0.0-beta.2

Breaking changes

These are the 3.0 changes the owner approved on 2026-10-01 (O-4). Each write-safety default has an explicit opt-out.

Upgrading from 2.x in one step: set SN_COMPAT=2 (owner, 2026-10-14). Every compat setting you leave unset then takes its 2.x default: SN_PROTECTED_TABLES_WRITE=allow, SN_DESTRUCTIVE_CONFIRM=off, SN_BATCH_UNMAPPED=allow, SN_LEGACY_TOOL_NAMES=1 and SN_TOOL_PACKAGES=core. A value you set explicitly always wins, and the prod profile still forces elicit confirmation. Unset (or 3), the 3.0 defaults below apply. servicenow-mcp-ai migrate --write carries a 2.x env file over: it moves a project-root .env to the XDG file, renames a reserved profile (B13) <name>_v2, comments out values 3.x rejects (B5) and adds SN_COMPAT=2, and does the same for the env blocks of the server in Claude Desktop, Claude Code, Cursor, VS Code and Windsurf config files; every other setting stays as it was.

Migration at a glance

One row per breaking change, from the breaking register in project/ROADMAP-V3.md. The bullets below give the details.

#	Change	Item	Migration
B1	Node ≥ 22.12	E-1	Upgrade Node; the launcher prints the requirement.
B2	Tool renames + parameter normalization (sys_id, table, fields/values)	M-7	None for a 2.x client: old names answer as hidden aliases. Generated old→new table; SN_LEGACY_TOOL_NAMES=1 also lists them.
B3	Error contract: snDetail → detail, new code; resources throw McpError	M-2	Update client parsers; codes documented in the manifest.
B4	Destructive apply:true needs a plan_token in plan mode (none → the preview); elicitation refusals fail	H-3	Call the tool without apply first and pass its plan_token; SN_DESTRUCTIVE_CONFIRM=off or SN_WRITE_MODE=apply for automation.
B5	Fail-fast safety settings (tuning values still warn); project .env deprecated	E-4	servicenow-mcp-ai migrate --write, or fix the reported value and move .env to XDG / set SN_ENV_FILE.
B6	HTTP: per-session profile; non-loopback bind refuses to start without SN_HTTP_TOKEN	H-7	Set the token; call use_instance per session.
B7	set_credentials: a new instance requires the auth material in the same call	H-2	Send user + password (or API key) with the host.
B8	batch: unmapped /api/* prefixes denied by default	H-4	SN_BATCH_UNMAPPED=allow or add the prefix to the map.
B9	Extension pinned to servicenow-mcp-ai@^3	D-6	None for users; publish the pinned extension first.
B10	Dark Jira scaffold removed (ARCH-14 = NO-GO, 2026-10-09)	E-8	None (no tools were exposed).
B11	Protected system tables need the call's own apply: true to write (sys_user, sys_user_has_role, sys_security_acl, …)	H-11	Pass apply: true, list the table in SN_TABLES_ALLOW, or set SN_PROTECTED_TABLES_WRITE=allow.
B12	use_instance no longer persists SN_ACTIVE_PROFILE to the env file	H-7	Pass persist:true; set SN_ACTIVE_PROFILE in the env file for a permanent default.
B13	Profile resources move to servicenow://profiles/{profile}/schema/{table}; profile names docs, schema, status, capabilities, reference, profiles, policy become reserved	M-7	Old template aliased for one minor; rename a reserved profile (migrate does it).
B14	ATF tools merged: list_atf_tests / list_atf_suites → servicenow_list_atf, run_atf_test / run_atf_suite → servicenow_run_atf (kind: test | suite) (O-4, 2026-10-13)	N-64	Use the new names with kind: "suite" for suites; the old names still answer as hidden aliases.
B15	servicenow_generate_fluent and the Fluent emitters removed; Fluent generation belongs to syncrona (ADR 0010, 2026-10-10)	P-26	Use syncrona fluent transform (or now-sdk transform) in the app's source repository.
B16	Cross-scope report: restricted[].status is a name (requested / denied / allowed / invalidated) instead of the raw integer choice (OD-7, 2026-10-13)	N-14	Compare against the names; an unknown value still passes through raw.
B17	UIB key fields renamed to the real columns: ux_declarative_action_definition action_name → name, ux_declarative_action_payload key → action_key, uib_event name → event_name (OD-1, 2026-10-13)	N-25	Read the new key names; the old keys were always empty.
B18	app_dependency retargeted from the absent sys_scope_dependency to sys_package_dependency_m2m, verified:true, key sys_package + dependency (OD-4, 2026-10-13)	P-2	Read the new key and meta fields; the type listed nothing before.
B19	sys_ux_form_action has one descriptor: uib_form_action merged into workspace_form_action (verified:true), the old id kept as an input alias (O-4, 2026-10-13)	N-34	Read workspace_form_action where outputs named uib_form_action.
B20	discovery (table, schema, aggregate + admin) is the default tool profile; core (the 2.x default, with attachment) stays as before (O-4, 2026-10-13; eased 2026-10-14)	N-63	Set SN_TOOL_PACKAGES=core for the 2.x set, or add attachment / enable it with servicenow_enable_package.
B21	batch: only /api/sn_cicd/testsuite and /api/sn_cicd/progress map to atf; other sn_cicd paths are unmapped, and ATF runs are refused on a production profile (O-4, 2026-10-13)	H-4	Use the dedicated tools; SN_BATCH_UNMAPPED=allow lets unmapped paths through the table and read-only checks.
B22	sys_group_has_role and sys_user_role_contains join the write-protected tables (O-4, 2026-10-13)	H-11	Pass apply: true, list the table in SN_TABLES_ALLOW, or set SN_PROTECTED_TABLES_WRITE=allow.
B23	exports map: only servicenow-mcp-ai (the entry point) and servicenow-mcp-ai/package.json resolve; sideEffects lists only the entry point (owner, 2026-10-14) ...

v3.0.0-beta.1

Breaking changes

These are the 3.0 changes the owner approved on 2026-10-01 (O-4). Each write-safety default has an explicit opt-out.

Upgrading from 2.x in one step: set SN_COMPAT=2 (owner, 2026-10-14). Every compat setting you leave unset then takes its 2.x default: SN_PROTECTED_TABLES_WRITE=allow, SN_DESTRUCTIVE_CONFIRM=off, SN_BATCH_UNMAPPED=allow, SN_LEGACY_TOOL_NAMES=1 and SN_TOOL_PACKAGES=core. A value you set explicitly always wins, and the prod profile still forces elicit confirmation. Unset (or 3), the 3.0 defaults below apply. servicenow-mcp-ai migrate --write carries a 2.x env file over: it moves a project-root .env to the XDG file, renames a reserved profile (B13) <name>_v2, comments out values 3.x rejects (B5) and adds SN_COMPAT=2, and does the same for the env blocks of the server in Claude Desktop, Claude Code, Cursor, VS Code and Windsurf config files; every other setting stays as it was.

Migration at a glance

One row per breaking change, from the breaking register in project/ROADMAP-V3.md. The bullets below give the details.

#	Change	Item	Migration
B1	Node ≥ 22.12	E-1	Upgrade Node; the launcher prints the requirement.
B2	Tool renames + parameter normalization (sys_id, table, fields/values)	M-7	None for a 2.x client: old names answer as hidden aliases. Generated old→new table; SN_LEGACY_TOOL_NAMES=1 also lists them.
B3	Error contract: snDetail → detail, new code; resources throw McpError	M-2	Update client parsers; codes documented in the manifest.
B4	Destructive apply:true needs a plan_token in plan mode (none → the preview); elicitation refusals fail	H-3	Call the tool without apply first and pass its plan_token; SN_DESTRUCTIVE_CONFIRM=off or SN_WRITE_MODE=apply for automation.
B5	Fail-fast safety settings (tuning values still warn); project .env deprecated	E-4	servicenow-mcp-ai migrate --write, or fix the reported value and move .env to XDG / set SN_ENV_FILE.
B6	HTTP: per-session profile; non-loopback bind refuses to start without SN_HTTP_TOKEN	H-7	Set the token; call use_instance per session.
B7	set_credentials: a new instance requires the auth material in the same call	H-2	Send user + password (or API key) with the host.
B8	batch: unmapped /api/* prefixes denied by default	H-4	SN_BATCH_UNMAPPED=allow or add the prefix to the map.
B9	Extension pinned to servicenow-mcp-ai@^3	D-6	None for users; publish the pinned extension first.
B10	Dark Jira scaffold removed (ARCH-14 = NO-GO, 2026-10-09)	E-8	None (no tools were exposed).
B11	Protected system tables need the call's own apply: true to write (sys_user, sys_user_has_role, sys_security_acl, …)	H-11	Pass apply: true, list the table in SN_TABLES_ALLOW, or set SN_PROTECTED_TABLES_WRITE=allow.
B12	use_instance no longer persists SN_ACTIVE_PROFILE to the env file	H-7	Pass persist:true; set SN_ACTIVE_PROFILE in the env file for a permanent default.
B13	Profile resources move to servicenow://profiles/{profile}/schema/{table}; profile names docs, schema, status, capabilities, reference, profiles, policy become reserved	M-7	Old template aliased for one minor; rename a reserved profile (migrate does it).
B14	ATF tools merged: list_atf_tests / list_atf_suites → servicenow_list_atf, run_atf_test / run_atf_suite → servicenow_run_atf (kind: test | suite) (O-4, 2026-10-13)	N-64	Use the new names with kind: "suite" for suites; the old names still answer as hidden aliases.
B15	servicenow_generate_fluent and the Fluent emitters removed; Fluent generation belongs to syncrona (ADR 0010, 2026-10-10)	P-26	Use syncrona fluent transform (or now-sdk transform) in the app's source repository.
B16	Cross-scope report: restricted[].status is a name (requested / denied / allowed / invalidated) instead of the raw integer choice (OD-7, 2026-10-13)	N-14	Compare against the names; an unknown value still passes through raw.
B17	UIB key fields renamed to the real columns: ux_declarative_action_definition action_name → name, ux_declarative_action_payload key → action_key, uib_event name → event_name (OD-1, 2026-10-13)	N-25	Read the new key names; the old keys were always empty.
B18	app_dependency retargeted from the absent sys_scope_dependency to sys_package_dependency_m2m, verified:true, key sys_package + dependency (OD-4, 2026-10-13)	P-2	Read the new key and meta fields; the type listed nothing before.
B19	sys_ux_form_action has one descriptor: uib_form_action merged into workspace_form_action (verified:true), the old id kept as an input alias (O-4, 2026-10-13)	N-34	Read workspace_form_action where outputs named uib_form_action.
B20	discovery (table, schema, aggregate + admin) is the default tool profile; core (the 2.x default, with attachment) stays as before (O-4, 2026-10-13; eased 2026-10-14)	N-63	Set SN_TOOL_PACKAGES=core for the 2.x set, or add attachment / enable it with servicenow_enable_package.
B21	batch: only /api/sn_cicd/testsuite and /api/sn_cicd/progress map to atf; other sn_cicd paths are unmapped, and ATF runs are refused on a production profile (O-4, 2026-10-13)	H-4	Use the dedicated tools; SN_BATCH_UNMAPPED=allow lets unmapped paths through the table and read-only checks.
B22	sys_group_has_role and sys_user_role_contains join the write-protected tables (O-4, 2026-10-13)	H-11	Pass apply: true, list the table in SN_TABLES_ALLOW, or set SN_PROTECTED_TABLES_WRITE=allow.
B23	exports map: only servicenow-mcp-ai (the entry point) and servicenow-mcp-ai/package.json resolve; sideEffects lists only the entry point (owner, 2026-10-14) ...

v2.0.0 — trust + depth + reach

v2.0 makes the breadth of v1 safe and self-aware: writes preview before they run, the server reports which capabilities it can actually achieve on your instance, and code_health audits the access-control layer. (v1 = breadth; v2 = trust + depth.)

Breaking changes

• Writes are plan-by-default. SN_WRITE_MODE=plan is the new default. The write tools — record CRUD (create/update/delete_record), change (create/update_change), CMDB CI (create/update_ci), import-set insert, email send, catalog order, attachment upload/delete, batch (when it contains writes), and the ATF run tools — now return a non-mutating before/after preview instead of executing.
  • Migration: to apply a change, pass apply: true on the call, or set SN_WRITE_MODE=apply to restore the v1.x "execute immediately" behaviour globally. Automations that relied on a write running on the first call must do one of these.

Added

• DF-0 — capability preflight. New always-on servicenow_check_capabilities tool and servicenow://capabilities resource: probe which admin-restricted sys_* tables the connected user can actually read, and report which capabilities (schema reads, script intelligence, ACL audit) are achievable — so the script/codecheck tools never promise a read they cannot make. servicenow_table_logic now degrades a 401/403 on one artefact type to an unreadable flag instead of failing the whole overview. (67 tools / 18 packages.)
• DF-2 — plan-and-apply + local audit journal. SN_WRITE_MODE (plan|apply) and a per-call apply argument gate every record-style write tool; each applied mutation is appended to a per-profile, append-only journal at <SN_DOCS_DIR>/<profile>/write-journal.{jsonl,md} — a client-side audit trail where there is no AI Control Tower.
• DF-1 — ACL security scan. servicenow_code_health now folds in a security dimension over the active ACLs (sys_security_acl): eval/side-effects/gs.getUser in ACL evaluation scripts, and roles-only ACLs (no condition and no script). The sys_security_acl read is gated behind DF-0 — when it is unreadable the scan reports the role needed rather than a silently empty all-clear.
• DF-4 — where-used / impact graph. New servicenow_where_used tool: find where a table, field or script is referenced across the instance's code — textual references in every script source, plus (for a table) the business rules, client scripts, UI policies/actions and ACLs attached to it. Read-only; optional Mermaid reference graph. The IDE-grade "find usages" the platform lacks.
• DF-5 — client-side field redaction. SN_REDACT_FIELDS masks named field values before query results are serialised for the model; SN_REDACT_PII also masks email/phone/national-id patterns inside any string value. Opt-in (off by default); the redaction count is reported in the result.
• DF-6 — HTTP transport. SN_TRANSPORT=http (port SN_PORT, default 3000) serves the MCP server over Streamable HTTP so the official ServiceNow MCP Client app and remote clients can consume it; the default stays stdio. The endpoint binds to loopback (127.0.0.1) by default (SN_HTTP_HOST to widen) and supports an optional SN_HTTP_TOKEN bearer guard (constant-time check); broader TLS/network hardening remains the operator's responsibility.
• CSV export. servicenow_query_table accepts format: "csv" for a spreadsheet-friendly export — a dependency-free RFC-4180 formatter that reuses the DF-5 redaction.
• Claude Code plugin (DX-1). A .claude-plugin/ bundle (plugin + marketplace manifest) makes the server installable with /plugin marketplace add LeassTaTT/servicenow-mcp-ai then /plugin install servicenow-mcp-ai — zero-config, the server wired up.
• DF-3 — CI drift gate. servicenow-mcp-ai drift <profileA> <profileB> promotes compare_instances to a release artifact: it prints the Markdown drift report and exits non-zero when the instances differ, so a pipeline can block a deploy on configuration drift.
• VS Code extension. An extension/ sub-package registers the MCP server with VS Code Copilot Chat (agent mode) on install (via registerMcpServerDefinitionProvider → npx -y servicenow-mcp-ai), so VS Code users get the tools with no manual mcp.json. Publishable to the VS Code Marketplace.

Changed

• The out-of-the-box posture for writes is now safe-by-default (preview first) — see Breaking changes.

Documentation

• DX-3 hero demo. A "Quick demo" section in the README and the docs site shows the three
  signature moves in one call each: find-usages (servicenow_where_used), what-runs-on-save
  (servicenow_trace_table_event) and dev-vs-prod drift (servicenow-mcp-ai drift). The matching
  screen-capture GIF is the only remaining DX-3 piece.
• CLI reference. The README now documents the servicenow-mcp-ai command-line surface — the
  server, login and drift <a> <b> invocations — with their parameters and exit codes.