Review a ServiceNow update set before you commit it.
Drop the XML from Export to XML. Setcheck lists what to fix and scores how ready the set is. For developers, admins and release managers. The file is read in this browser and never uploaded.
Or paste the XML
Starts with <unload> and holds sys_update_xml records.
Example review. FAC-1042 is a made-up Fernbrook update set built into this page. Drop your own export to replace it.
FAC-1042 Work order routing
Score: start at 100. Each Blocker removes 20% of the points left, each Warning 6%, each Note 1%. Any Blocker caps the score at 49. A file Setcheck can't read, or a set with no updates, scores 0. 85 and up reads Ready, 50 to 84 Review, below 50 Hold.
Your own rules, review history and CI-ready JSON come with Team, $14.99 a month. Opens Q1 2027.
Findings
How it works
Setcheck reads the same file you would load with Import Update Set from XML, and runs a fixed set of checks on it.
Export the set
Open a Complete local update set, or a Loaded retrieved one. Use the Export to XML related link and save the file.
Drop it here
Setcheck reads the update set record and every Customer Update in it. It opens each payload to find the component, its scope and its scripts.
Fix, then commit
Each finding names the record, why it matters and how to fix it. Copy or download the report for the change record. Then preview and commit as usual.
Pricing
The free review runs every check on one update set at a time. Team adds what a release pipeline needs.
Free
Everything on this page
- One update set at a time, every check
- Readiness score and inventory by type
- Markdown and HTML report, copy to clipboard
- Runs in your browser
Team
For teams that release on a schedule
- Custom rules: your own patterns, severities and allowed values
- Review history per update set
- CI-ready JSON output for a pipeline step
Questions
Short answers. Every finding names the record it came from, so you can check it in the instance.
Does my update set leave my computer?
No. The XML is read in this page with the browser's own parser. Setcheck sends nothing over the network. It stores only your theme choice.
Does this replace the update set preview?
No. Preview runs on the target instance and finds collisions and missing records there. Setcheck can't see the target. It reads the file for patterns that preview does not judge. Run both.
Which parts of the file does it read?
The sys_remote_update_set record and each sys_update_xml record: name, type, action, target name, application, update times and the payload. Scripts inside payloads are scanned. Flow definitions are counted but not scanned.
How sure are the script checks?
They match text patterns. They don't run your code. The loop check in particular is Setcheck's own heuristic and can miss a query or flag a safe one. Each finding shows the line, so you can judge it.
Why did it flag a sys_id I meant to keep?
Any 32-character hex value in a script is listed, because it can point at a record that differs between instances. If the record travels with the set, or is the same everywhere, you can keep it. Team will let you allow-list values.
Can I trust the score as a go/no-go?
Use it as a reading aid. The formula is printed next to the dial. A Blocker always needs a person to look at it. Setcheck isn't affiliated with ServiceNow.
Sources
Checked as of November 13, 2026. ServiceNow documentation pages the checks are based on. Release names are the ones each page showed.
- Save an update set as a local XML file (Xanadu: Complete state, Export to XML, loads as a retrieved set)
- Customer Updates table (Australia: name, type, target name, payload, update set fields)
- System update sets (Xanadu: one record per customized object, per update set)
- Get started with update sets (Zurich: small to medium sets, always preview)
- Customizations tracked by update sets (Yokohama: configuration, not task or process data; one set per application)
- Default update set (Zurich: the global default should not be moved between systems)
- Preview a remote update set (Xanadu: collisions, deletes, scope validation)
- Business rules and script includes (current.update() in business rules)
- Scan Engine definitions: Performance (sn_SE10125 current.update(), sn_SE10134 gs.sleep)
- Scan Engine definitions: Manageability (sn_SE10034 hard-coded sys_ids)
- Scan Engine definitions: Security (sn_SE10023 eval(), sn_SE10541 ACL without role, script or condition)
ServiceNow's documentation describes the export but not the layout of the file. Setcheck reads the layout found in real exports: an <unload> root, one sys_remote_update_set record and sys_update_xml records with action, application, name, payload, target_name and type. A public sample with the same elements: jmbauguess on GitHub Gist (2015). The value DELETE in the action field is described in a ServiceNow Community post, not in the docs. The size thresholds, the data-table list, the instance URL and email checks and the loop check are Setcheck's own rules.