ServiceNow Discovery pattern intelligence MCP server — Python NDL parser/writer + 28 MCP tools (read, search, validate, author, surgical-edit, emulate)
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# sn-patterns-mcp > Pattern-intelligence MCP server for ServiceNow Discovery. Gives any AI agent the ability to read, search, validate, author, surgically edit, and reason about ServiceNow Discovery patterns — including the NDL grammar, 117 cataloged operation closures, the SNMP OIDs they touch, the WMI / shell / registry / REST data sources they ingest, the libraries / extensions / pre-post scripts that surround them, and Tier-3 sidecar emulator blueprints for behavioral testing without real targets. []() []() []() [](LICENSE) ## What it does ServiceNow Discovery patterns are procedural definitions written in **NDL** (Network Discovery Language) that tell the MID Server how to identify, classify, and inventory configuration items (CIs). This project gives AI agents a comprehensive understanding of those patterns through 28 stdio MCP tools: - **Read & explain** — step-by-step breakdown of any pattern, with operation-level semantics, inline OID resolution for SNMP steps, and source-tagged data (PDI live vs local index). - **Search** — semantic search across the pattern corpus by intent ("Tomcat on Linux") and across the 847K-OID MIB knowledge base by keyword or natural language. - **Validate** — Tier-1 local checks (syntax, parser/writer roundtrip, metadata, refids, closure required-inputs, variable read-before-write with discovery-context awareness) and Tier-2 PDI compile testing in a sandboxed `sa_pattern` row with self-healing role grants. - **Plan target emulation** — Tier-3 sidecar emulator catalog and pattern-specific blueprints: exact TCP/UDP listeners, WMI / command / registry / SNMP / file / HTTP / LDAP fixtures, and MIB-backed OID responses for Windows, Unix/Linux, F5, NetScaler, Cisco, ESXi, and generi…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.