PRJ · 2026
EA Console: A Governed Workbench for the CMDB
A self-hosted console and MCP server for querying and safely updating a ServiceNow CMDB, with a grounded local AI assistant.
Ad hoc CMDB queries to Governed console


What it is
A self-hosted web console for exploring and safely updating a ServiceNow CMDB, built for enterprise architecture work. Architects query the portfolio, open any application to see its relationships drawn as a layered architecture view and scored for design conformance, and make updates through a guarded write path. AI assistants use the same tools through an MCP server, under the same guardrails.
The problem
The CMDB is the system of record, but answering an architecture question from it meant hand-built list views, exports and spreadsheets. Updating it meant clicking through forms one record at a time with no preview. And AI assistants could not touch it at all without direct credentials or copy and paste.
What I built
- Query and record drawer. Filter any table, open a record and see its relationships in both directions as a layered architecture diagram, with a conformance score.
- Guarded writes. Read-only by default. Every change is a dry-run diff, an explicitly named target, a timed write window, a confirmation bound to the record's before-state, and a read-back. Update-only.
- Snapshots and trends. A nightly local snapshot of key tables, so dashboards open instantly and "what changed" is a diff, not a guess.
- Data quality and lifecycle. Live gap counts that open as worklists, and end-of-life dates reconciled against public lifecycle data.
- An MCP server. AI assistants query and propose changes through the same guarded path, holding only a console token.
- Ask EA. A small local model that answers from the architecture knowledge base with citations, gated by an evaluation harness.
How it is built
Deliberately boring: standard-library Python and plain HTML, CSS and JavaScript — zero runtime dependencies and no build step. Thirty regression suites gate every deploy. One fails the build if an unauthenticated page ever exposes more than aggregate counts; others drive real clicks in a browser against production-shaped fixtures.
What came out of it
Portfolio questions that used to need an export now take a query. Updates have a preview and a receipt. And building the tool turned up findings of its own — several of the platform traps and testing lessons in the write-ups below came straight out of it.