MCP Abap Adt

Community

MCP server for SAP ABAP ADT: full CRUD for RAP and classic ABAP, supporting SAP BTP ABAP Cloud and On-Premise ECC/S/4HANA with JWT/XSUAA and service-key auth.

How to install ↓ Compare GitHub source repository ↗

Category: Dev Tools #108 of 438
Stars: ★ 97 Popular
Transport: stdio (local process) · SSE · Streamable HTTP
Runtime: Node.js
Credentials: API key / credential required
License: Apache-2.0
Last commit: today
Tools: 65

61FMRS · C

This server provides powerful CRUD capabilities for SAP ABAP systems, suitable for AI-assisted development, but requires secure configuration and careful oversight. It supports multiple authentication methods and three transports.

Strongest · Documentation 15/20 Weakest · Reliability 8/20

Reliability

8/20

Security and permissions

12/20

Maintenance

13/20

Documentation

15/20

Setup experience

13/20

Why each score

Reliability 8/20: The server.json manifest is coherent and uses the 2025-12-11 schema, declaring an npm package, stdio transport, and structured environment variables, and describing a graceful tool-inspection-only mode when SAP_URL is absent. However, the supplied material contains no CI workflows or committed test files, so the static calibration caps this dimension; the project itself discloses that certificate and Kerberos auth are unvalidated on live systems. There is also a minor inconsistency: SAP_AUTH_TYPE choices list only xsuaa/basic while README .env examples use jwt/certificate/kerberos. Deducted for missing verifiable execution evidence and admitted-untested paths.
Security and permissions 12/20: Credentials are passed via environment variables flagged isSecret (SAP_JWT_TOKEN, SAP_PASSWORD); sessions default to in-memory storage with disk persistence only via an explicit --unsafe flag; NTLM is hard-rejected to avoid silent downgrade; install examples use placeholders only, no real tokens; handler groups (readonly/high/low/compact) and dedup strategies provide a least-privilege lever, and the auth-broker with browser OAuth limits long-lived credential exposure. Deducted because the full-CRUD surface includes destructive Delete* tools without documented server-side confirmation/guardrails, and GetSqlQuery permits arbitrary SQL with no guidance on scoping SAP roles. No red-line trigger was found, so the score stays above 4.
Maintenance 13/20: MIT license, repo not archived, and version 8.13.0 indicate sustained release practice; CHANGELOG.md, CONTRIBUTORS.md, and release-notes docs are referenced, and companion npm packages (connection, adt-clients) plus a separate configurator repo show an ecosystem. Deducted because commit history, issue-response timeliness, and dependency-update records are not visible in the supplied material; stars are a discovery signal only and never add points.
Documentation 15/20: The README is unusually deep: architecture, quick start, six auth modes (basic/JWT/service-key/RFC/mTLS/Kerberos), env resolution order, CLI options, Unix/Windows platform paths, service-key-to-env generation, and explicit limitations (ABAP Cloud data preview blocked by backend policy; certificate/Kerberos not yet validated on a live system). It indexes layered docs (installation, user, deployment, architecture, development). Deducted because per-tool parameter docs and troubleshooting pages are referenced but not supplied, and the README is by default untrusted evidence.
Setup experience 13/20: A clear path exists: two global npm installs, a configurator CLI (mcp-conf) to auto-write client config, or explicit manual CLI examples; destination-based auth documents standard service-key directories; mcp-auth generates .env from a service key; runnable examples are given for stdio, HTTP, and SSE transports. Deducted because the combination of auth-broker, destinations, transports, and multiple auth modes is inherently complex and depends on a real SAP system, and no CI/test execution evidence is available (static cap of 15 applies without committed verification).

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkConnects to a database

Best for

ABAP developers and architects
RAP developers
Team leads and tech leads needing fast repository visibility
Teams building RAG/agent workflows for SAP landscapes

Not for

Users without SAP systems
Users who require read-only access (this server provides full CRUD)
Users relying on unsupported authentication methods

Required permissions

Requires access to the SAP system URL (SAP_URL)
Requires authentication credentials: JWT token (XSUAA) or basic auth username/password
Requires an ABAP client number (SAP_CLIENT)
Requires transport request privileges for on-premise systems (SAP_MASTER_SYSTEM, SAP_RESPONSIBLE)
Can create, read, update, and delete ABAP objects, so needs appropriate permissions in the ABAP system

Risks and side effects

AI agents may unintentionally modify or delete ABAP objects if given overly broad permissions
Exposed credentials (passwords, JWT tokens) may be leaked if not handled securely
Frequent access to SAP systems could cause performance or lock issues
Code generation quality may not meet production standards and requires human review

Setup

Before you start

Runtime：Node.js

SAP_URL required Base URL of the ABAP system (BTP ABAP service URL or on-prem host). Required; comes from your SAP system/BTP instance.

SAP_JWT_TOKEN optionalsecret JWT bearer token for SAP_AUTH_TYPE=xsuaa, derived from a BTP service key.

SAP_PASSWORD optionalsecret Password for basic auth on on-prem systems, from your SAP admin.

SAP_CERT_PASSPHRASE optionalsecret Passphrase for the PKCS#12 certificate file.

Other optional settings (19)

SAP_AUTH_TYPE optional Auth method: xsuaa (BTP JWT/OAuth2, default) or basic (on-prem username/password).

SAP_SYSTEM_TYPE optional System type cloud/onprem/legacy controlling which tools are exposed; default cloud.

SAP_CLIENT optional ABAP client/mandant number (e.g. 100); optional for BTP ABAP Cloud.

SAP_USERNAME optional Username for basic auth on on-prem systems, from your SAP admin.

SAP_LANGUAGE optional Logon language (ISO code like 'en'), default en.

SAP_MASTER_SYSTEM optional System context for on-prem create/update operations (e.g. DEV).

SAP_RESPONSIBLE optional Responsible user for on-prem create/update operations.

SAP_CERT_PATH optional Path to mTLS client certificate (PEM .crt); on-prem HTTP only.

SAP_CERT_KEY_PATH optional Path to mTLS client private key (PEM .key); on-prem HTTP only.

SAP_CERT_PFX_PATH optional Path to PKCS#12 certificate file (alternative to PEM).

SAP_KERBEROS_SPN optional Optional Kerberos service principal name (default HTTP@<host>).

SAP_KERBEROS_SERVICE optional Optional service class used to derive the SPN (default HTTP).

SAP_CONNECTION_TYPE optional Connection transport: http (default) or rfc (legacy systems need SAP NW RFC SDK).

MCP_ENV_PATH optional Alternative way to point at an explicit .env file path.

AUTH_LOG_LEVEL optional Handler logger level (error/warn/info/debug).

DEBUG_AUTH_LOG optional Set true to enable debug auth logging.

HANDLER_LOG_SILENT optional Set true to fully disable handler logging.

DEBUG_CONNECTORS optional Set true for verbose connection logging in high-level handlers.

DEBUG_HANDLERS optional Set true for verbose logs in selected read-only/system handlers.

Install the server and configurator globally: npm install -g @mcp-abap-adt/core and npm install -g @mcp-abap-adt/configurator.
Use the configurator to auto-configure your client, e.g., mcp-conf --client cline --name abap --mcp TRIAL.
Or configure manually: set up a stdio server in your MCP client with command mcp-abap-adt and configure environment variables (e.g., SAP_URL).

Refer to the official documentation for details.

Check that it works

Start the server with mcp-abap-adt --transport=stdio --mcp=<destination>; tools such as GetWhereUsed and GetClass should appear in your MCP client's tool list. Then ask e.g. "Use SearchObject to search for classes ZCL_*" — returned system data confirms the connection.

Troubleshooting

Ensure SAP_URL is correct and accessible from the machine running the MCP server
Verify authentication method: use XSUAA/JWT for BTP ABAP Cloud and basic for on-premise
Check that the ABAP client number is correct
Ensure sufficient transport request privileges for on-premise systems
Read the authentication and configuration sections in the official documentation

Things to try

Once connected, you can ask your AI assistant things like:

Use GetWhereUsed to find all objects referencing class CL_MY_HANDLER
Use GetPackageTree to show the subpackage structure of package Z_DEV_PKG
Create a new ABAP class ZCL_TEST_001 and activate it with ActivateObject
Use GetSqlQuery to fetch the first rows of table T000 via the ADT Data Preview API

Tools 65

GetWhereUsed read-only

Perform where-used analysis, mapping object usage and potential impact.

DescribeByList read-only

List object metadata information.

GetObjectStructure read-only

Get the internal structure of an object.

GetObjectInfo read-only

Get detailed information about an object.

SearchObject read-only

Search for ABAP objects.

GetPackageTree read-only

Get the package hierarchy.

GetPackageContents read-only

Get the list of package contents.

GetAbapAST read-only

Get the ABAP syntax tree.

Show 57 more tools

GetAbapSemanticAnalysis read-only

Get semantic analysis results for ABAP code.

GetIncludesList read-only

Recursively discover includes.

CreateBehaviorDefinition writes

Create a behavior definition.

UpdateBehaviorDefinition writes

Update a behavior definition.

CreateBehaviorImplementation writes

Create a behavior implementation.

UpdateBehaviorImplementation writes

Update a behavior implementation.

CreateServiceDefinition writes

Create a service definition.

UpdateServiceDefinition writes

Update a service definition.

CreateMetadataExtension writes

Create a metadata extension.

UpdateMetadataExtension writes

Update a metadata extension.

CreateView writes

Create a CDS or classic view.

UpdateView writes

Update a CDS or classic view.

GetView read-only

Get view information.

DeleteView destructive

Delete a view.

CreateClass writes

Create an ABAP class.

UpdateClass writes

Update an ABAP class.

GetClass read-only

Get ABAP class information.

DeleteClass destructive

Delete an ABAP class.

CreateInterface writes

Create an ABAP interface.

UpdateInterface writes

Update an ABAP interface.

GetInterface read-only

Get ABAP interface information.

DeleteInterface destructive

Delete an ABAP interface.

CreateFunctionGroup writes

Create a function group.

UpdateFunctionGroup writes

Update a function group.

GetFunctionGroup read-only

Get function group information.

DeleteFunctionGroup destructive

Delete a function group.

CreateFunctionModule writes

Create a function module.

UpdateFunctionModule writes

Update a function module.

GetFunctionModule read-only

Get function module information.

DeleteFunctionModule destructive

Delete a function module.

CreateTransport writes

Create a transport request.

GetTransport read-only

Get transport request information.

ActivateObject writes

Activate an ABAP object.

GetDomain read-only

Get a domain.

CreateDomain writes

Create a domain.

UpdateDomain writes

Update a domain.

GetDataElement read-only

Get a data element.

CreateDataElement writes

Create a data element.

UpdateDataElement writes

Update a data element.

GetTable read-only

Get a database table.

CreateTable writes

Create a database table.

GetTableContents read-only

Preview table data.

GetStructure read-only

Get a structure.

CreateStructure writes

Create a structure.

GetBehaviorDefinition read-only

Get a behavior definition.

GetEnhancements read-only

Analyze enhancements.

GetEnhancementImpl read-only

Get enhancement implementation.

GetEnhancementSpot read-only

Get enhancement spot.

GetInactiveObjects read-only

Monitor inactive objects waiting for activation.

RuntimeCreateProfilerTraceParameters writes

Create profiler trace parameters.

RuntimeListProfilerTraceFiles read-only

List profiler trace files.

RuntimeGetProfilerTraceData read-only

Get profiler trace data.

RuntimeGetDumpById read-only

Get dump data by ID.

RuntimeListFeeds read-only

List runtime feeds (dumps, system messages, gateway errors).

RuntimeListSystemMessages read-only

Get SM02 system messages.

RuntimeGetGatewayErrorLog read-only

Get gateway error log.

GetSqlQuery read-only

Execute custom SQL queries via the ADT Data Preview API.

Use cases

Impact analysis / where-used before changes to map object usage

Dependency audit across classes, interfaces, DDIC, CDS/views, and RAP artifacts

Extract repository facts to plan refactoring or cloud-readiness

Iterative RAP and ABAP development with fast ADT-backed CRUD

Automated documentation and RAG ingestion from ABAP systems

Supported clients

Claude Desktop

Listed from the project's documentation, not tested by this site.

Overview

mcp-abap-adt is an MCP server for ABAP ADT in SAP ECC/S/4HANA (on-premise) and SAP BTP ABAP Cloud systems. It gives agents controlled access to real ABAP repositories through ADT, grounding analysis and changes in system data. It is built for AI-assisted pair programming, not autopilot vibe coding.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →

NPM Sentinel MCP Server 79 · B

AI-powered NPM package analysis MCP server

★ 18 · Tools 19 Compare with this →

MartinLoop MCP Server 79 · B

An independent control layer that gives AI coding agents budgets, brakes, and receipts

★ 410 Compare with this →

GitHub MCP Server 76 · B

GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language

★ 33.5k · Tools 15 Compare with this →

Compare with other MCP servers

Source revision c53697c5cfef Data synced 2026-10-12 Read the FMRS scoring method