--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Alert remediation # Alert remediation with an MCP Client {#ariaid-title1} Release version: Australia Updated July 9, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Alert remediation with an MCP Client The Alert remediation tool enables ServiceNow customers to obtain AI-driven remediation suggestions for alerts directly through an MCP Client without switching to the ServiceNow user interface. It leverages the same remediation agent used in Service Operations Workspace to provide consistent recommendations. This tool allows operators to interact naturally with AI agents to receive actionable suggestions grounded in existing workflows, knowledge base articles, and alert context. Show full answer Show less ## Key Features * Accepts requests for specific alerts and returns remediation suggestions based on ServiceNow workflows and knowledge articles. * Delivers remediation recommendations directly within the MCP Client interface, prompting operators to execute or dismiss the suggested actions. * Allows execution of remediation actions through the MCP Client, streamlining the response process without switching applications. * Provides fallback actions, such as incident creation, if remediation execution fails, with operator confirmation required before proceeding. * Ensures that remediation suggestions are scoped according to the operator's authorization and alert visibility. ## Key Outcomes * Operators can quickly and efficiently respond to alerts using natural language queries within MCP Clients like AWS Claude. * Consistent remediation advice is maintained across different channels by routing requests to the same remediation agent used in Service Operations Workspace. * Streamlined remediation workflows reduce context switching and improve response times. * Role-based access control ensures secure and appropriate handling of alert remediation requests. ## Workflow The remediation process follows these steps: * An operator queries an external AI agent about a specific alert. * The MCP Client sends this request via the Model Context Protocol (MCP) to the ITOM MCP Server Console. * The Server Console authenticates the request against ServiceNow's role-based access control. * The remediation agent evaluates the alert using workflows, knowledge articles, and related context to generate a suggestion. * The recommendation is returned to the MCP Client, which prompts the operator to execute or dismiss the action. ## Considerations * Initial support may be limited to certain alert types and remediation actions. * AI-generated suggestions should be reviewed carefully as they may be incomplete or inaccurate. Get remediation suggestions for an alert from an AI agent or MCP Client, matching what's available in Service Operations Workspace. ## Alert remediation tool overview MCP tools retrieve data from your ServiceNow instance and perform alert actions. The Alert remediation tool lets you request a remediation suggestion for an alert through natural-language prompts in your MCP Client, without switching to the ServiceNow UI. The tool routes your request to the existing remediation agent that already runs in Service Operations Workspace, so you get the same suggestion regardless of channel. Important: The Alert remediation tool suggests actions through an AI agent or MCP Client. You're interacting with AI. AI-generated responses may be inaccurate or incomplete. Review the suggestion and the linked alert before taking action. ## Supported capabilities {#itom-mcp-server-alert-remediation__section_capabilities} The Alert remediation tool supports the following capabilities: * Accepts a request for a specified alert and returns a remediation suggestion based on existing workflows, knowledge base articles, and related context. * Returns the remediation recommendation directly in the response and prompts you to execute or dismiss it. * Lets you execute the suggested remediation directly through the MCP Client. * If a remediation fails to execute, the tool offers a fallback action, such as creating an incident, and requests confirmation before running it. ## Considerations {#itom-mcp-server-alert-remediation__section_considerations} Consider the following when using the Alert remediation tool: * Initial availability may cover only a subset of alert types or remediation actions. * Remediation suggestions are scoped to the alerts you're authorized to view. ## Use cases {#itom-mcp-server-alert-remediation__section_use_cases} The Alert remediation tool is useful in the following scenarios: * An operator asks their MCP Client, such as AWS Claude, "What should I do about this alert?" and receives a remediation suggestion grounded in existing workflows and knowledge base articles. * An operator working from an external AI agent reviews a suggested remediation and confirms before executing it. ## Workflow {#itom-mcp-server-alert-remediation__section_workflow} The Alert remediation tool operates as part of the ITOM MCP Server Console workflow: 1. An operator asks the external agent what to do about a specified alert. 2. The MCP Client sends the request to the ITOM MCP Server Console using the Model Context Protocol (MCP). 3. The ITOM MCP Server Console authenticates the request against ServiceNow role-based access control. 4. The request is routed to the existing remediation agent, which evaluates the alert against workflows, knowledge base articles, and related context. 5. The ITOM MCP Server Console returns the remediation recommendation to the MCP Client, which prompts the operator to execute or dismiss it. **Related concepts** * [Use the ITOM MCP Server Console](https://www.servicenow.com/docs/DaYRmyZyj6avCkpX8KedrQ "Connect an AI-enabled MCP Client application to your ServiceNow environment using the ITOM MCP Server Console. Use the MCP Client to investigate alerts, review configuration item (CI) reliability, assess incident impact, and create service level objectives (SLOs).") * [Alert actions through an MCP Client](https://www.servicenow.com/docs/8YlV9rVWTik9IFkSkpq04w "Manage alerts through an AI agent or MCP Client. The Alert Actions tool lets the agent or client act on alerts directly.")