scoped-apps

scoped-apps is a skill for Claude Code from serac-labs/serac. It costs 49 tokens per session (1,756 once invoked), scanned A, original, Apache-2.0.

A guide to ServiceNow scoped applications, which are isolated packages of custom tables, scripts, settings, and APIs. It explains naming, permissions between applications, REST APIs, and publishing to the ServiceNow Store.

In plain words
What is it for?
Use it to create scoped applications, name scopes and tables, allow cross-application script access, define application properties or REST APIs, and prepare a Store submission.
Why use it?
It reduces naming conflicts and makes custom ServiceNow applications easier to control, move, and publish.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the skills plugin — 56 skills shipped together

Good fit Use it to create scoped applications, name scopes and tables, allow cross-application script access, define application properties or REST APIs, and prepare a Store submission.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/serac-labs/serac/scoped-apps
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add serac-labs/serac --skill scoped-apps
Clone the repo
git clone --depth 1 https://github.com/serac-labs/serac

Made for: Claude Code.

Or install skills, the plugin that ships this one along with the rest of its 56 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for scoped-apps

README.md
[![agentmods](https://agentmods.dev/badge/skills/serac-labs/serac/scoped-apps.svg)](https://agentmods.dev/skills/serac-labs/serac/scoped-apps)
Your own site
<a href="https://agentmods.dev/skills/serac-labs/serac/scoped-apps"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/scoped-apps.svg" alt="Measured on agentmods" height="20"></a>
Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,756 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00049 $0.01756
Opus 5 $0.00024 $0.00878
Sonnet 5 $0.00010 $0.00351
Haiku 4.5 $0.00005 $0.00176

Measured 8d ago against content hash a195e7645f62, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

scoped-apps scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -X GET \
packages/skills/scoped-apps/SKILL.md · 300 lines

How it starts

The opening of the file, as written. The whole thing — 300 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Scoped Application Development for ServiceNow

Scoped applications provide isolation and portability for custom development in ServiceNow.

Why Use Scoped Apps?

Feature Global Scope Scoped App
Naming conflicts Possible Prevented (x_prefix)
Portability Difficult Easy (Update Sets)
Security Open Controlled (Cross-scope)
Store publishing No Yes
Dependencies Implicit Explicit

Creating a Scoped Application

Via Studio (Recommended)

1. Navigate: System Applications > Studio
2. Click: Create Application
3. Enter:
   - Name: "My Custom App"
   - Scope: "x_mycom_myapp" (auto-generated)
   - Version: 1.0.0
4. Configure:
   - Runtime access: Check tables needing cross-scope access

Via MCP

snow_create_application({
  name: "My Custom Application",
  scope: "x_mycom_custom",
  version: "1.0.0",
  description: "Custom application for...",
})

Scope Naming Convention

x_[vendor]_[app]

Examples:
- x_acme_hr          (ACME Corp HR App)
- x_mycom_inventory  (My Company Inventory)
- x_snc_global       (ServiceNow Global)

Table Naming

// Scoped tables are automatically prefixed
// Table name in Studio: "task_tracker"
// Actual table name: "x_mycom_myapp_task_tracker"

// Creating records
var gr = new GlideRecord("x_mycom_myapp_task_tracker")
gr.initialize()
gr.setValue("name", "My Task")
gr.insert()

Script Include in Scoped App

var TaskManager = Class.create()
TaskManager.prototype = {
  initialize: function () {
    this.tableName = "x_mycom_myapp_task_tracker"
  },

  createTask: function (name, description) {
    var gr = new GlideRecord(this.tableName)
    gr.initialize()
    gr.setValue("name", name)
    gr.setValue("description", description)
    return gr.insert()
  },

  // Mark as accessible from other scopes
  // Requires: "Accessible from: All application scopes"
  getTask: function (sysId) {
    var gr = new GlideRecord(this.tableName)
    if (gr.get(sysId)) {
      return {
        name: gr.getValue("name"),
        description: gr.getValue("description"),
      }
    }
    return null
  },

  type: "TaskManager",
}

Read the full file on GitHub · 300 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 300 lines · 49 tokens per session scan A a195e7645f62

Subscribe to this mod's changes

scoped-apps is a skill published in the GitHub repository serac-labs/serac (78 stars, last pushed 13d ago), licensed Apache-2.0. It adds 49 tokens to every session and 1,756 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

opensrc

Fetch dependency source code to give AI agents deeper implementation context. Use when the agent needs to understand how a library works internally, read source code for a package, fetch implementation details for a dependency, or explore how an npm/PyPI/crates.io package is built. Triggers include "fetch source for"…

vercel-labs/opensrc · 103 tokens

multi-tenant-architecture

Designs tenant isolation, hostname routing, custom-domain lifecycle, and plan limits on Cloudflare or Vercel. Use when asked to "isolate tenant data", "support custom domains", "build a white-label platform", or assess PSL registration. For general module structure use codebase-architecture; for SEO content use…

mblode/agent-skills · 74 tokens

technical-integrations

Hunt existing integration patterns and design vendor/framework-agnostic API, RFC, SDK, and integration plans for new external vendor integrations.

vincentkoc/dotskills · 31 tokens

axiom-network-framework-ref

Reference — Comprehensive Network.framework guide covering NetworkConnection (iOS 26+), NWConnection (iOS 12-25), TLV framing, Coder protocol, NetworkListener, NetworkBrowser, Wi-Fi Aware discovery, and migration strategies.

ComeOnOliver/skillshub · 55 tokens

axiom-networking

Use when implementing Network.framework connections, debugging connection failures, migrating from sockets/URLSession streams, or adopting structured concurrency networking patterns - prevents deprecated API usage, reachability anti-patterns, and thread-safety violations with iOS 12-26+ APIs.

ComeOnOliver/skillshub · 56 tokens

axiom-push-notifications

Use when implementing remote or local push notifications, requesting notification permission, managing APNs device tokens, adding notification actions/categories, building service extensions, or debugging push delivery failures. Covers APNs, FCM, Live Activity push transport, broadcast push, communication…

ComeOnOliver/skillshub · 62 tokens