jsnBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

npm install -g @jacebenson/jsn

npm install -g github:jacebenson/jsn#main        # merged but not yet tagged
npm install -g github:jacebenson/jsn#    # any PR/feature branch

npm install -g @jacebenson/jsn

jsn midservers add --install-method direct --name worker1

jsn setup                                    # Interactive: add, switch, remove, modify instances
jsn incidents list --query "priority=1"      # Critical incidents

# Core ticket work
jsn incidents list --query 

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: servicenow
description: |
  Interact with ServiceNow instances via the jsn CLI. Use when working with ServiceNow
  development, administration, or data exploration. Handles tables, records, business rules,
  flows, script includes, ACLs, update sets, and more. Triggered by ServiceNow URLs
  (service-now.com, servicenow.com) or when the user mentions ServiceNow, jsn, servicenow,
  or related terms like tables, records, business rules, flows, script includes, ACLs,
  update sets, or encoded queries.
license: MIT
compatibility: |
  Requires jsn CLI (github.com/jacebenson/jsn). Install via:
  npm install -g @jacebenson/jsn
  Works with Claude Code, OpenCode, Cursor, and agentskills-compatible tools.
metadata:
  author: jacebenson
  version: "4.3.6"
  repository: https://github.com/jacebenson/jsn
---

# Jace's ServiceNow CLI (jsn)

Explore and manage ServiceNow instances. Interactive paginated pickers with server-side search on all list commands.

## Discovery

```bash
jsn --help                # All commands grouped by domain
jsn <command> --help      # Flags, subcommands, and examples
```

## Interactive Picker

All `list` subcommands use a paginated interactive picker in TTY mode:
- Arrow through items (10 per page)
- Type to search (server-side LIKE query)
- Scroll past last loaded item to load next page
- Enter to select, Esc to cancel
- Falls back to table output with `--json`

## Agent Rules

1. **Output modes** — `--json` when parsing data; text when presenting to humans
2. **Use sys_id for updates** — All update/delete operations require sys_id
3. **Check auth first** — Run `jsn auth status` before operations
4. **NEVER logout** — Only run `jsn auth logout` if the user explicitly asks
5. **Use `--profile <name>`** to target a specific instance, or `jsn auth switch <name>` to change the default
6. **Before using `eval` or `rest`** — Ask: *"Is there a more specific jsn command?"* Prefer specific over generic over escape hatch over eval.
7. **CONFIRM before destructive operations** — Show what will be created/updated/deleted and ask for approval.

## Command Hierarchy

Pick the most specific tool for the job. **Never default to eval** — it's the last resort:

1. **Specific commands** — `jsn flows`, `jsn rules`, `jsn catalogitems`, etc.
2. **`jsn records --table <name>`** — generic CRUD on any table
3. **`jsn docs search <query>`** — offline ServiceNow documentation search (no instance needed)
4. **`jsn rest`** — raw Table API escape hatch
5. **`jsn eval`** — ⚠️ **LAST RESORT ONLY**
6. **Ask the human** — if none of the above work

## Key Commands

| Domain | Commands |
|--------|---------|
| **Core** | `incidents`, `changes`, `requests`, `tasks` |
| **Catalog** | `catalogitems list/show/create` — items with variables and flow info |
| **Automation** | `flows`, `actions`, `rules`, `triggers`, `scheduledjobs` |
| **Access** | `acls`, `b4rules`, `roles`, `groups`, `users` |
| **UX** | `forms` (section/element layout), `lists`, `clientscripts`, `uipolicies` |
| **Data** | `tables`, `columns`, `includes`, `logs`, `properties`, `records` |
| **Config** | `setup`, `auth`, `updatesets`, `scopes` |
| **Docs** | `docs sync`, `docs status`, `docs search`, `docs serve` |
| **Developer** | `eval`, `rest`, `skill`, `version` |

### Table and raw REST examples

```bash
# Query a table with the normal records command
jsn records list --table incident --query "active=true" --limit 5 --json

# Get a single record
jsn records get --table incident --sys-id abc123... --json

# Raw endpoint access when no specific command fits
jsn rest "/api/now/table/incident?sysparm_limit=3" --json
```

### `jsn docs` — offline documentation search

No ServiceNow instance required. Searches the full ServiceNow docs locally with FTS5 + semantic hybrid search.

```bash
# First run: download docs and build the index (~45k files, ~3-5 min)
jsn docs sync

# Check state
jsn docs status

# Search (keyword + semantic hybrid)
jsn docs search "GlideRecord query" --limit 5 --json

# Filter by bundle
jsn docs search "REST API" --bundle it-service-management --json

# Start the web UI
jsn docs serve

```

**Re-running `jsn docs sync`** does a smart incremental refresh — pulls latest docs and only rebuilds changed files (seconds, not minutes).

## Troubleshooting Field Behavior

Check order (priority):

1. **Before-query business rules** — `sys_script` with `when=before`, `action=query`
   ```bash
   jsn b4rules list --query "collection=sys_user"
   ```
2. **ACLs** — `jsn acls list --query "name=incident"`
3. **Dictionary overrides** — `jsn records list --table sys_dictionary --query "name=incident^element=caller_id"`
4. **Client scripts** / **UI policies** — form-level field behavior

## Configuration

```
~/.config/servicenow/
├── config.json               # Profiles and settings
└── credentials/              # Auth tokens (fallback, one file per key)
```

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (6 observation(s))

Shell

declared (3 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (12)

const parsed = yaml.load(raw);

const secret = 'super-secret-token-and-cookie';

.eleventy.js

import { getStringField } from '../../helpers.js';

import { parseFrontmatter, stringifyFrontmatter } from '../../frontmatter.js';

import { declareCapabilities } from '../../capabilities.js';

import { parseFrontmatter } from '../../frontmatter.js';

import { parseFrontmatter } from '../../frontmatter.js';

...(served && { served: 'http://127.0.0.1:3000' }),

@11ty/eleventy

@inquirer/core, @inquirer/prompts, better-sqlite3, js-yaml, turndown, @eslint/js, globals

`auth status` uses safe metadata and a read-only current-user probe. It does not refresh tokens, update `last_seen`, migrate credentials, or persist credentials. JSON diagnostics contain method, sourc

Gates applied: no_behavioural_pass.