Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/serac-labs/seracWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/serac-labs/serac/skills)<a href="https://agentmods.dev/plugins/serac-labs/serac/skills"><img src="https://agentmods.dev/badge/plugins/serac-labs/serac/skills/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/serac-labs/serac/skills"><img src="https://agentmods.dev/badge/plugins/serac-labs/serac/skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
servicenow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
"name": "servicenow",
"displayName": "ServiceNow",
"description": "400+ snow_* MCP tools for ServiceNow, plus the 70 skill guides that teach an agent to use them.",
"author": {
"name": "Serac Labs",
"url": "https://github.com/serac-labs"
},
"homepage": "https://serac.build",
"repository": "https://github.com/serac-labs/serac",
"license": "Apache-2.0",
"keywords": ["servicenow", "mcp", "itsm", "glide", "skills"],
"skills": ["./"]
}
What it installs
The manifest is a name and a version. 70 skills travel with it, and installing the plugin installs all of them — 3,384 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill inbound-email A 43 tokens
- Skill instance-performance-triage A 55 tokens
- Skill mcp-tool-discovery A 53 tokens
- Skill workspace-builder A 62 tokens
- Skill background-script-execution A 54 tokens
- Skill change-rollback A 51 tokens
- Skill csdm-modeling A 53 tokens
- Skill document-management A 61 tokens
- Skill table-api-reads A 63 tokens
- Skill agent-workspace A 40 tokens
- Skill blast-radius A 39 tokens
- Skill change-management A 37 tokens
- Skill cmdb-patterns A 43 tokens
- Skill hr-service-delivery A 42 tokens
- Skill incident-management A 42 tokens
- Skill problem-management A 53 tokens
- Skill transform-maps A 49 tokens
- Skill acl-security A 55 tokens
- Skill approval-workflows A 40 tokens
- Skill asset-management A 43 tokens
- Skill atf-testing A 45 tokens
- Skill catalog-items A 32 tokens
- Skill client-scripts A 45 tokens
- Skill csm-patterns A 39 tokens
- Skill data-policies A 43 tokens
- Skill discovery-patterns A 40 tokens
- Skill domain-separation A 38 tokens
- Skill email-notifications A 39 tokens
- Skill event-management A 39 tokens
- Skill field-service A 42 tokens
- Skill flow-designer A 54 tokens
- Skill fluent-brownfield-migration A 79 tokens
- Skill grc-compliance A 42 tokens
- Skill import-export A 42 tokens
- Skill instance-security A 40 tokens
- Skill integration-hub A 46 tokens
- Skill knowledge-management A 41 tokens
- Skill mid-server A 46 tokens
- Skill mobile-development A 45 tokens
- Skill notification-events A 43 tokens
- Skill performance-analytics A 44 tokens
- Skill predictive-intelligence A 48 tokens
- Skill reporting-dashboards A 43 tokens
- Skill request-management A 46 tokens
- Skill scheduled-jobs A 37 tokens
- Skill script-include-patterns A 40 tokens
- Skill security-operations A 48 tokens
- Skill sla-management A 41 tokens
- Skill ui-actions-policies A 46 tokens
- Skill ui-builder-patterns A 44 tokens
- Skill vendor-management A 40 tokens
- Skill virtual-agent A 44 tokens
- Skill agile-development A 68 tokens
- Skill classic-workflow A 60 tokens
- Skill fluent-ci-cd A 78 tokens
- Skill fluent-development A 77 tokens
- Skill form-list-layout A 70 tokens
- Skill scoped-apps A 49 tokens
- Skill studio-source-control A 59 tokens
- Skill business-rule-patterns A 43 tokens
- Skill code-review A 43 tokens
- Skill gliderecord-patterns A 46 tokens
- Skill oncall-scheduling A 65 tokens
- Skill rest-integration A 51 tokens
- Skill service-portal-pages A 63 tokens
- Skill update-set-workflow A 46 tokens
- Skill user-group-administration A 56 tokens
- Skill widget-coherence A 41 tokens
- Skill es5-compliance A 49 tokens
- Skill debugging-mutations A 41 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 16 lines scan A e3ecf5f033ce
servicenow is a plugin published in the GitHub repository serac-labs/serac (78 stars, last pushed 1mo ago), licensed Apache-2.0. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other plugins, from other repositories
servicenow-mcp-ai
Drive ServiceNow from your AI assistant — 100 tools over the full REST surface, with plan-and-apply write safety, capability preflight, an ACL security scan, eight workflow skills (discover, triage, impact, drift, safe write, UI Builder review, upgrade review, security) and two read-only subagents (investigator…
servicenow
ServiceNow developer data plane for the Now Platform — tables and schema, CMDB data quality, update sets, access reviews. 19 MCP tools, 5 resources, 4 Agent Skills served over MCP, read-only mode, OAuth client credentials, audit log.
synapsor
Turn one application data change into a disabled, reviewable Synapsor Safe Action without giving the Cursor agent SQL or commit authority.
hubspot
Every HubSpot Sales Hub feature, plus offline cross-object queries, property-change-history reporting, and an agent-native data layer no other HubSpot tool has.
lively
A Lively plugin that connects AI sessions with an organisation's knowledge, projects, and domain map.
sanction
Independent authorization plane for AI agents — approve, escalate, or deny spend, tools, credentials, and provisioning. Wires the hosted wallet MCP; the host must ask before acting.