Skip to main content
Glama
SAP Datasphere MCP Server

SAP Datasphere MCP Server

by DimiDR

⚠️ This repository is obsolete

MCP-Datasphere-InteractiveUser replaces this project and SAP-Datasphere-CLI. That MCP covers both former functions in one place:

Former repo

What it did

SAP-Datasphere-MCP (this repo)

Consumption / catalog — read rows, search, query

SAP-Datasphere-CLI

Design-time / admin via the official datasphere CLI

Use github.com/DimiDR/MCP-Datasphere-InteractiveUser instead. This repository is no longer maintained.

🚀 SAP Datasphere MCP Server

CLI + MCP are a combo. This repo owns consumption / catalog (read rows, search, profile). Its counterpart owns design-time / admin (create and change objects). Use them together — not as alternatives.

PyPI version npm version Python 3.10+ MCP Protocol License: MIT

Model Context Protocol server that lets AI assistants explore and query SAP Datasphere — metadata discovery, catalog search, OData and SQL queries, ETL extraction, data lineage and column profiling — with built-in config-driven PII masking so sensitive fields never reach the LLM.

Version 1.4.0 · 42 tools advertised by default (51 with DATASPHERE_TOOL_PROFILE=full)

🙌 Shout-out: this repository is a modified copy of MarioDeFelipe/sap-datasphere-mcp. All credit for the original server goes to Mario de Felipe — this fork adapts it for a specific tenant setup and CLI integration.


Related MCP server: Semantic BI MCP

🤝 Relationship to the SAP Datasphere CLI

This server and the @sap/datasphere-cli are complementary halves, not alternatives. They reach different API families, and nearly every difference follows from that:

Reaches

Therefore owns

MCP server (this repo)

Consumption and Catalog APIs

Reading data and metadata, catalog search, profiling

CLI

Design-time and admin APIs

Creating and changing objects, tenant administration

What each side does

Function

MCP

CLI

Read data rows

yes — execute_query, smart_query, query_relational_entity, query_analytical_data

no — no command returns table contents

Catalog search, asset lookup

search_catalog, find_assets_by_column, get_asset_details, …

—

Column profiling, distributions, outliers

analyze_column_distribution

—

Analytical/relational metadata (dimensions vs. measures, OData→SQL types)

get_analytical_metadata, get_relational_metadata

—

PII masking, SQL sanitizing, consent gating, audit logging

yes

—

Create/change/delete modeling objects (18 types)

local tables only (create_table)

yes

Spaces, users, global & scoped roles, workload, certificates

read-only or not at all

yes

Connections: create/change

read-only (list_connections, test_connection)

yes

Read an object definition (CSN)

—

objects <type> read

See deployed but non-exposed objects

via CLI (list_repository_objects)

objects <type> list

Task chains, task logs

run_task_chain, get_task_log, get_task_status, get_task_history

tasks …

Database users

create_database_user, …

dbusers

The CLI cannot read data rows — that is this server's reason to exist. This server does not create objects, apart from local tables (create_table), because the payload there is derived from data it has already read. Views, analytic models, flows, spaces, users and roles belong to the CLI.

Neither writes data rows. Rows arrive through a data/replication flow, a database user with a SQL client, or a CSV upload in the Data Builder UI. Neither manages folders — those are UI-only.

How they combine in practice

A typical build-then-verify loop:

  1. CLI creates the layers — staging/cleansing/integration views, target tables, transformation flows, task chain, analytic model.

  2. CLI runs the chain and reports task status.

  3. MCP verifies the result: row counts, value distributions, whether data quality flags actually fire — everything the CLI structurally cannot see.

  4. Findings flow back into step 1 as CSN changes.

Keep the visibility gap in mind: Consumption and Catalog endpoints only show objects that are deployed and exposed for consumption. A view that exists in the repository but is not exposed is invisible here while the CLI still sees it — that is what list_repository_objects exists for.

Guide

Content

docs/MCP_VS_CLI.md

Authoritative capability split and routing rules

docs/TENANT_CONFIG.md

The two config files, two OAuth clients, and App Integration screenshots

docs/CLI_LINEAGE_LOOKUP.md

Finding objects the Consumption API cannot see

A few tools shell out to the CLI (create_table, the *_database_user* tools, list_repository_objects). The CLI keeps its own session, separate from this server's OAuth credentials — check it with the datasphere_cli_status tool.


🚀 Quick Start

# npm
npm install -g @mariodefe/sap-datasphere-mcp && npx @mariodefe/sap-datasphere-mcp

# PyPI
pip install sap-datasphere-mcp && sap-datasphere-mcp

# From source
git clone https://github.com/MarioDeFelipe/sap-datasphere-mcp.git
cd sap-datasphere-mcp
pip install -r requirements.txt && pip install -e .
cp .env.example .env      # fill in your credentials
sap-datasphere-mcp

Full walkthrough: docs/GETTING_STARTED.md · OAuth setup: docs/OAUTH_SETUP.md

Configuration

DATASPHERE_BASE_URL=https://your-tenant.eu10.hcs.cloud.sap
DATASPHERE_TENANT_ID=your-tenant-id
DATASPHERE_CLIENT_ID=your-client-id
DATASPHERE_CLIENT_SECRET=your-client-secret
DATASPHERE_TOKEN_URL=https://your-tenant.authentication.eu10.hana.ondemand.com/oauth/token
USE_MOCK_DATA=false

Optional settings for the CLI-backed tools (DATASPHERE_CLI_PATH, _HOST, _SECRETS_FILE) are documented in .env.example and docs/TENANT_CONFIG.md.

Never commit .env.

Claude Desktop

{
  "mcpServers": {
    "sap-datasphere": {
      "command": "npx",
      "args": ["@mariodefe/sap-datasphere-mcp"],
      "env": {
        "DATASPHERE_BASE_URL": "https://your-tenant.eu20.hcs.cloud.sap",
        "DATASPHERE_CLIENT_ID": "your-client-id",
        "DATASPHERE_CLIENT_SECRET": "your-client-secret",
        "DATASPHERE_TOKEN_URL": "https://your-tenant.authentication.eu20.hana.ondemand.com/oauth/token"
      }
    }
  }
}

Config location — Windows: %APPDATA%\Claude\claude_desktop_config.json · macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Linux: ~/.config/Claude/claude_desktop_config.json


🛠️ Tool Catalog

42 tools in the default lean profile. Set DATASPHERE_TOOL_PROFILE=full to also advertise overlapping metadata tools, and DATASPHERE_EXPOSE_DIAGNOSTICS=true for the endpoint probes — 51 in total. Hiding them by default improves the model's tool selection; every handler stays reachable.

Foundation (5)

test_connection · get_current_user · get_tenant_info · get_available_scopes · list_spaces

Space discovery (3)

get_space_info · get_table_schema · search_tables

Catalog and search (5)

list_catalog_assets · get_asset_details · get_asset_by_compound_key · get_space_assets · search_catalog

Catalog search runs client-side: /catalog/search returns 404 on the tenants tested, so these tools fetch assets and filter locally across name, label, businessName and description.

Data discovery and quality (2)

Tool

Purpose

find_assets_by_column

Which assets contain a given column — lineage and impact analysis across spaces

analyze_column_distribution

Null rate, distinct values, percentiles, IQR outlier detection

Querying data (4)

Tool

Purpose

smart_query

SQL router: picks analytical vs relational, falls back to client-side aggregation when the asset cannot aggregate

execute_query

SELECT over one entity (columns/*, WHERE, ORDER BY, LIMIT), max 1000 rows. JOIN / GROUP BY / aggregates are rejected with a pointer to the right tool

query_relational_entity

Relational OData, up to 50,000 records per batch for ETL

query_analytical_data

Analytical OData with $apply, $filter, $orderby

Supported SQL: SELECT */column lists, WHERE, LIMIT, GROUP BY, aggregations with and without grouping, ORDER BY. No JOINs — OData is single-entity. Names are case-sensitive.

Metadata (7)

get_relational_metadata · list_relational_entities · get_relational_entity_metadata · get_analytical_metadata · get_analytical_model · list_analytical_datasets · get_asset_variables

get_relational_entity_metadata maps OData types to SQL (Edm.String → NVARCHAR(MAX), Edm.Int64 → BIGINT, Edm.Decimal → DECIMAL(18,2), …) for data-warehouse loading. get_asset_variables surfaces input parameters a parameterised view or analytic model expects.

Repository (3)

Tool

Purpose

list_repository_objects

Lists design-time objects via the CLI, so it also sees objects not exposed for consumption

get_deployed_objects

Deployed objects in a space

get_object_definition

Object definition (deprecated — prefer get_asset_details)

Database users (5) — CLI-backed

list_database_users · create_database_user · update_database_user · delete_database_user · reset_database_user_password

High-risk operations require consent, cached for 60 minutes.

Tasks (4)

get_task_status · run_task_chain · get_task_log · get_task_history

Object provisioning (1) — CLI-backed

create_table — builds a CSN definition from your column list and runs datasphere objects local-tables create. Local tables only; see the CLI split above.

Operations (4)

list_connections · browse_marketplace · datasphere_cli_status · get_relational_odata_service (full profile)

datasphere_cli_status reports whether the CLI is installed, which version, which host, and whether a session exists. Run it first when a CLI-backed tool fails.


🔏 PII / Sensitive-Field Masking

A config-driven, fail-closed masking layer runs inside the response pipeline. Every data-returning tool (smart_query, query_relational_entity, query_analytical_data, get_space_assets, analyze_column_distribution) funnels results through apply_masking() before they reach the LLM. No prompt bypasses it.

Defense in depth. The authoritative access control stays upstream — SAP Datasphere Data Access Controls, and not granting the technical user access to PII tables. This layer is the enforced, auditable net on top.

Environment variable

Values

Default

Purpose

DATASPHERE_PII_POLICY

path to YAML or JSON

(unset)

Policy file. Unset = masking fully disabled.

DATASPHERE_PII_MODE

enforce | audit_only | off

enforce when a policy is present

audit_only logs what would be masked without changing data

DATASPHERE_PII_SALT

secret string

(empty)

Salt for deterministic hash/tokenize. Treat as a secret.

If the policy file is configured but missing or unparseable, the server raises at startup and refuses to run. It never silently serves raw data with a broken policy.

mode: enforce
default_action: redact

rules:
  # Most specific wins: asset > space > global; exact > glob
  - space: ZDCS_08
    asset: ZR_SAP_CUSTOMER
    columns:
      EMAIL:  redact       # → "***"
      PHONE:  partial:4    # keep last 4 → "******1234"
      TAXID:  hash         # sha256(salt:value) — deterministic, safe for GROUP BY
      SSN:    drop         # column removed from every row
  - space: "*"
    columns:
      "*IBAN*": tokenize   # glob on column name → "TKN_<8hex>"

allowlist:
  enabled: true
  assets:
    ZDCS_08.ZR_OTC_CUST_MONTH: [CUSTOMER, MONTH, REVENUE]   # ONLY these returned

patterns:
  email: '[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}'
  iban:  '\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b'

Precedence: allowlist (drops everything unlisted) → column rules → value-pattern scan on remaining strings.

Audit log — one structured line per call, values never logged:

[pii_masking] space=ZDCS_08 asset=ZR_SAP_CUSTOMER rows=42
              masked_fields=['EMAIL', 'PHONE', 'SSN'] mode=enforce

The response also carries masked_fields, so the client can see what was withheld. Annotated example: pii_policy.yaml.


🔒 Security

Authentication — OAuth 2.0 client credentials, tokens refreshed 60s before expiry and encrypted in memory (Fernet). No credentials in code.

Authorization — four permission levels (READ, WRITE, ADMIN, SENSITIVE), interactive consent for high-risk operations, full audit logging.

Query safety — the SQL sanitizer is fail-closed on SELECT: INSERT/UPDATE/DELETE/DROP and SQL comments are blocked, along with 15+ injection patterns. Write paths do not exist.


🌐 Transports

stdio by default; Streamable HTTP (spec 2025-03-26) at /mcp for long-lived service deployments.

Flag

Env var

Default

Purpose

--transport

MCP_TRANSPORT

stdio

stdio or http

--host

MCP_HTTP_HOST

127.0.0.1

Bind address

--port

MCP_HTTP_PORT

8080

Bind port

--path

MCP_HTTP_PATH

/mcp

Endpoint path

--auth-token

MCP_HTTP_AUTH_TOKEN

(none)

Require Authorization: Bearer <token>

pip install 'sap-datasphere-mcp[http]'
sap-datasphere-mcp --transport http --port 8080

The server warns when bound to a non-loopback interface without a token. /health serves a plain JSON liveness probe.


📊 Architecture

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   AI Assistant  │◄──►│   MCP Server     │◄──►│  SAP Datasphere │
│ (Claude, Cursor)│    │  Authorization   │    │   (OAuth 2.0)   │
│                 │    │  PII masking     │    │                 │
│                 │    │  Caching         │    │  datasphere CLI │
└─────────────────┘    └──────────────────┘    └─────────────────┘
src/sap_datasphere_mcp/
├── server.py              # MCP server and all tool handlers
├── cli_runner.py          # Single entry point for `datasphere` CLI calls
├── pii_masking.py         # Config-driven, fail-closed masking
├── cache_manager.py       # TTL cache
├── telemetry.py           # Request metrics
├── tool_descriptions.py   # Tool metadata
├── error_helpers.py       # Error formatting
├── auth/
│   ├── oauth_handler.py             # Token management and refresh
│   ├── datasphere_auth_connector.py # Authenticated API connector
│   ├── authorization.py             # Permission levels
│   ├── consent_manager.py           # Consent tracking
│   ├── input_validator.py           # Input validation
│   ├── sql_sanitizer.py             # SELECT-only enforcement
│   └── data_filter.py               # Credential redaction
└── config/settings.py     # Environment-based settings

Caching TTLs — spaces 1h · assets 30min · metadata 15min · users 5min, LRU eviction.

Response times — cached metadata under 100ms · catalog 100–500ms · OData queries 500–2000ms depending on volume.


🧪 Testing

pytest                                              # full suite
pytest tests/test_cli_runner.py                     # CLI integration layer
npx @modelcontextprotocol/inspector sap-datasphere-mcp

tests/test_cli_runner.py verifies every CLI command the server hardcodes against the --help dumps in the DataphereCLI repo. Point DATASPHERE_CLI_HELP_DIR at tools/cli-help to enable it; it skips otherwise.

Known failure: tests/test_mcp_server.py uses await server.list_resources()(), an idiom the current MCP SDK no longer supports. Pre-existing, unrelated to the server itself.


🚀 Deployment

docker build -t sap-datasphere-mcp:latest .
docker run -d --name sap-mcp --env-file .env sap-datasphere-mcp:latest
# or
docker-compose up -d

Full guide incl. Kubernetes: docs/DEPLOYMENT.md


📚 Documentation

Guide

Content

Getting Started

Setup walkthrough with examples

API Reference

Technical API docs, Python and cURL

OAuth Setup

App Integration and OAuth client

Tenant Config

Config files, the two identities

MCP vs CLI

Which tool owns which task

CLI Lineage Lookup

Objects invisible to Consumption

Deployment

Docker, Kubernetes, PyPI

Developer Guide

Contributing to the codebase

Changelog

Version history


🙏 Acknowledgments

This repository started as a modified copy of MarioDeFelipe/sap-datasphere-mcp. Shout-out to Mario de Felipe for the original server — the tool catalog, PII masking design and OAuth flow this fork builds on all trace back there.

Built with Amazon Kiro (specifications and architectural steering) and Claude Code (security and authentication, tool descriptions and error handling, caching and telemetry, repository and analytics tools, CLI integration layer).


📄 License

MIT — see LICENSE.

📞 Support

Issues · Discussions · SAP Datasphere docs · Model Context Protocol

Available Tools

42 tools
analyze_column_distributionA

Perform advanced statistical analysis of a column's data distribution including nulls, distinct values, percentiles, and outlier detection.

Use this tool when:

  • User asks "What's the data quality of AMOUNT column?"

  • Performing data profiling before analytics

  • Assessing column completeness and distribution

  • Detecting outliers and data anomalies

  • Understanding data patterns for ML/AI

What you'll get:

  • Basic statistics (count, nulls, distinct values, completeness)

  • Numeric statistics (min, max, mean, percentiles)

  • Distribution analysis (top values, frequency)

  • Outlier detection (IQR method)

  • Data quality assessment

Use cases:

  • Data quality assessment

  • Pre-analytics data profiling

  • Outlier and anomaly detection

  • Understanding value distributions

  • ML feature engineering preparation

  • Data cleansing planning

Example queries:

  • "Analyze the distribution of SALES_AMOUNT column"

  • "What's the data quality of CUSTOMER_AGE?"

  • "Profile the ORDER_STATUS column"

  • "Detect outliers in PRICE column"

  • "Show me statistics for QUANTITY field"

Analysis includes:

  • Null percentage and completeness rate

  • Distinct value count and cardinality

  • For numeric columns: min, max, mean, percentiles (p25, p50, p75)

  • Top value frequencies

  • Outlier detection using IQR method

  • Data quality recommendations

Performance notes:

  • Analyzes up to 10,000 records (configurable)

  • Default sample size: 1,000 records

  • Works with numeric, string, and date columns

  • Automatic type detection and appropriate statistics

Inputs: space_id (required), asset_name (required), column_name (required), sample_size, +1 more.

browse_marketplaceA

Browse and search available data packages in the SAP Datasphere marketplace.

Use this tool when:

  • User asks "What data packages are available?"

  • Looking for external reference data (benchmarks, currency rates, etc.)

  • Exploring marketplace offerings

  • Planning to enrich internal data with external sources

What you'll get:

  • Package IDs and names

  • Package descriptions and categories

  • Provider information

  • Package versions and sizes

  • Pricing information (Free or paid)

Categories:

  • Reference Data (industry benchmarks, standards)

  • Financial Data (currency rates, market data)

  • Geospatial Data

  • Industry-specific datasets

Example queries:

  • "What marketplace packages are available?"

  • "Find financial data packages"

  • "Show me industry benchmarks"

  • "Search for currency rate data"

Use cases:

  • Data enrichment planning

  • Finding external reference data

  • Competitive benchmarking

  • Currency conversion support

Inputs: category, search_term.

create_database_userA

Create a new database user in a SAP Datasphere space with specified permissions.

IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.

Use this tool when:

  • User requests "Create a database user named JEFF in SALES"

  • Setting up new user access for applications or analysts

  • Configuring data ingestion users

  • Establishing read-only consumption users

Required parameters:

  • space_id: The space where user will be created

  • database_user_id: User name suffix (e.g., 'JEFF', 'REPORTING_USER')

  • user_definition: JSON object defining permissions and settings

User definition structure:

{
  "consumption": {
    "consumptionWithGrant": false,
    "spaceSchemaAccess": false,
    "scriptServerAccess": false,
    "enablePasswordPolicy": false,
    "localSchemaAccess": false,
    "hdiGrantorForCupsAccess": false
  },
  "ingestion": {
    "auditing": {
      "dppRead": {
        "isAuditPolicyActive": false,
        "retentionPeriod": 7
      },
      "dppChange": {
        "isAuditPolicyActive": false,
        "retentionPeriod": 7
      }
    }
  }
}

Permission types:

  • Consumption: Read access to space data

    • consumptionWithGrant: Allow granting privileges to others

    • spaceSchemaAccess: Access to space schema objects

    • scriptServerAccess: Execute stored procedures/UDFs

  • Ingestion: Write access for data loading

    • Audit policies for compliance (DPP read/change tracking)

Security notes:

  • New password is auto-generated and returned (store securely!)

  • Audit retention period: 1-365 days

  • Minimum privilege principle recommended

  • Password must be changed on first login

Example queries:

  • "Create a read-only database user named ANALYST in SALES"

  • "Set up a database user for data loading in FINANCE"

  • "Create user REPORTING with consumption access"

Note: Corresponds to CLI: datasphere dbusers create --space --databaseuser --file-path <def.json>

Inputs: space_id (required), user_definition (required), database_user_id (required), output_file.

create_tableA

Create a new local table in a SAP Datasphere space.

IMPORTANT: This is a HIGH-RISK, WRITE operation. It creates a design-time object and (optionally) deploys it, which changes the state of the tenant. Requires user consent.

Use this tool when:

  • User asks: "Lege eine Tabelle X in Space Y an" / "Create a table for orders in DIMITRITEST"

  • Provisioning new local tables for data ingestion, staging, or modelling

  • Bootstrapping schemas from a specification (name + columns)

What it does:

  1. Builds a Datasphere object definition (CSN-style JSON) from your column list

  2. Writes it to a temporary file

  3. Calls the Datasphere CLI: datasphere objects local-tables create --space <id> --file-path <def.json> (the table name comes from the definitions key in the JSON, not from a flag)

  4. The CLI deploys the object by default so it becomes queryable; deploy=false adds --no-deploy

  5. Returns the created table metadata

Required parameters:

  • space_id: Target space (must exist, uppercase, e.g., 'DIMITRITEST')

  • table_name: Technical name (uppercase, alphanumeric + underscore, e.g., 'BESTELLUNGEN')

  • columns: Array of column definitions

Column definition format:

{
  "name": "BESTELL_ID",          // required, uppercase
  "type": "NVARCHAR",            // required: NVARCHAR|VARCHAR|INTEGER|BIGINT|DECIMAL|DOUBLE|DATE|TIMESTAMP|BOOLEAN|NCLOB
  "length": 20,                  // for NVARCHAR/VARCHAR
  "precision": 15,               // for DECIMAL
  "scale": 2,                    // for DECIMAL
  "nullable": false,             // default true
  "description": "Order ID"      // optional
}

Optional parameters:

  • primary_keys: Array of column names that form the primary key (e.g., ["BESTELL_ID"])

  • label: Business-friendly display name (e.g., "Bestellungen")

  • description: Description of the table's business purpose

  • deploy: If true (default), deploy the table immediately after creation so it can be queried

Example call (Bestellungen):

{
  "space_id": "DIMITRITEST",
  "table_name": "BESTELLUNGEN",
  "label": "Bestellungen",
  "description": "Kundenbestellungen mit Positionen",
  "primary_keys": ["BESTELL_ID"],
  "columns": [
    {"name": "BESTELL_ID",   "type": "NVARCHAR", "length": 20, "nullable": false},
    {"name": "KUNDEN_ID",    "type": "NVARCHAR", "length": 20, "nullable": false},
    {"name": "BESTELLDATUM", "type": "DATE"},
    {"name": "PRODUKT_ID",   "type": "NVARCHAR", "length": 20},
    {"name": "MENGE",        "type": "INTEGER"},
    {"name": "EINZELPREIS",  "type": "DECIMAL", "precision": 15, "scale": 2},
    {"name": "GESAMTBETRAG", "type": "DECIMAL", "precision": 15, "scale": 2},
    {"name": "WAEHRUNG",     "type": "NVARCHAR", "length": 3},
    {"name": "STATUS",       "type": "NVARCHAR", "length": 20}
  ],
  "deploy": true
}

Prerequisites (real mode):

  • Datasphere CLI installed and available on PATH (datasphere --version)

  • User logged in to the CLI (datasphere login)

  • User has DW Space Administrator or Modeler role in the target space

Mock mode (USE_MOCK_DATA=true):

  • No CLI call is made

  • Returns a simulated success response with the generated object definition

  • Perfect for testing prompts before running against a real tenant

Security & Safety:

  • Table name is validated to prevent injection (must match ^[A-Z][A-Z0-9_]*$)

  • Column names are validated identically

  • Data types are checked against a whitelist

  • HIGH-RISK: requires consent, all actions are audit-logged

  • Idempotency: fails if the table already exists (use datasphere objects local-tables update / delete first)

Note: Corresponds to CLI: datasphere objects local-tables create --space <id> --file-path <def.json> [--no-deploy]

Only local tables. This is the one object type the server creates, because the payload is derived from data it has already read. Views, analytic models, flows, task chains, spaces, users and roles are CLI territory — see docs/MCP_VS_CLI.md. Do not try to reshape this tool's CSN into another type.

Canonical CSN shape: the generated definition follows examples/local-table-orders.json and Appendix E of the datasphere-cli skill (DataphereCLI repo). That example is not just a reference — tests/test_csn_shape.py derives this tool's arguments from it and compares the result back, so the two cannot drift apart. If the CLI ever rejects the payload, compare against the example rather than guessing.

Column names must be UPPERCASE (^[A-Z][A-Z0-9_]*$). The minimal SAP Help example uses a mixed-case Name, which this tool rejects on purpose: uppercase matches the Open SQL schema convention and needs no quoting in later queries.

Inputs: columns (required), space_id (required), table_name (required), label, +3 more.

datasphere_cli_statusA

Check whether the SAP Datasphere CLI is installed, configured and logged in.

Use this tool when:

  • A CLI-backed tool failed and you need to know why (create_table, any *_database_user* tool)

  • The user asks to create or change an object — check the CLI is usable before promising anything

  • Diagnosing "datasphere CLI not found" or authentication errors

Background — two separate identities: This server reads data through the Consumption/Catalog APIs using its own OAuth technical user. Creating objects and administering the tenant is the CLI's job, and the CLI keeps a separate session (interactive browser login). A working MCP connection therefore says nothing about whether CLI-backed tools will work.

What you'll get:

  • cli_available / cli_path — is the executable there, and which one

  • version — installed CLI version (verify command syntax against it)

  • host — the tenant the CLI is configured against

  • authenticated — whether a valid session exists

  • notes — plain-language diagnosis and next steps

Important: if authenticated is false, the fix is an interactive login that an agent cannot perform. Ask the user to run it themselves: datasphere login --options-file ds-options.json --force

Division of labour: for anything this server cannot do — creating views, analytic models, flows, task chains, spaces, users, roles — the answer is a CLI command, not an MCP tool. See docs/MCP_VS_CLI.md.

Safety: never returns tokens or secrets. Session validity is checked with config secrets check, which reports consistency without disclosing values.

Inputs: no named parameters.

delete_database_userA

Delete a database user from a SAP Datasphere space.

IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution. WARNING: This action is IRREVERSIBLE. User and all associated permissions are permanently deleted.

Use this tool when:

  • User explicitly requests "Delete database user JEFF from SALES"

  • Decommissioning user accounts

  • Removing unauthorized access

  • Cleaning up test/temporary users

  • User left organization

What happens:

  • User account is permanently deleted

  • All active sessions terminated immediately

  • All granted privileges revoked

  • Cannot be undone - must recreate if needed

  • Deletion is logged for audit

Required parameters:

  • space_id: The space containing the database user

  • database_user_id: The user to delete

  • force: Optional flag to skip confirmation dialog

Safety considerations:

  • PERMANENT deletion - no recovery possible

  • Verify user identity and authorization

  • Check if user owns any objects (may cause errors)

  • Document reason for deletion

  • Consider deactivating instead of deleting

Before deleting:

  1. List user's current permissions (list_database_users)

  2. Verify no applications depend on this user

  3. Check if user owns database objects

  4. Get management approval for production users

  5. Document deletion in change log

Example queries:

  • "Delete database user JEFF from SALES space"

  • "Remove TEMP_USER from FINANCE"

  • "Delete TEST_ANALYST - no longer needed"

Best practices:

  • Always confirm with user before deleting

  • Use force=false for interactive confirmation

  • Keep audit trail of deletions

  • For temporary removal, consider update instead

Note: Corresponds to CLI: datasphere dbusers delete --space --databaseuser [--force]

Inputs: space_id (required), database_user_id (required), force.

execute_queryA

Execute read-only SQL queries against SAP Datasphere tables to retrieve and analyze data.

IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.

Use this tool when:

  • User explicitly requests data retrieval (e.g., "Show me customers from USA")

  • Need to perform data analysis with aggregations

  • Joining multiple tables for insights

  • Filtering and sorting data

Capabilities:

  • SELECT queries with full SQL syntax (WHERE, JOIN, GROUP BY, ORDER BY, LIMIT)

  • Read-only access - NO write operations allowed

  • Results limited to 100 rows by default (configurable via limit parameter)

  • Automatic query sanitization and injection prevention

Security & Restrictions:

  • Only SELECT statements allowed

  • Blocked operations: INSERT, UPDATE, DELETE, DROP, CREATE, ALTER, etc.

  • No SQL comments allowed (security risk)

  • Queries sanitized to prevent injection attacks

  • User consent required before execution (high-risk operation)

Query best practices:

  1. Always specify a LIMIT to control result size

  2. Use WHERE clauses to filter data efficiently

  3. Check table schema first with get_table_schema()

  4. Use qualified table names when joining

Example queries:

  • "SELECT * FROM CUSTOMER_DATA WHERE country = 'USA' LIMIT 10"

  • "SELECT customer_id, SUM(amount) as total FROM SALES_ORDERS GROUP BY customer_id ORDER BY total DESC LIMIT 20"

  • "SELECT c.customer_name, o.order_date, o.amount FROM CUSTOMER_DATA c JOIN SALES_ORDERS o ON c.customer_id = o.customer_id WHERE o.status = 'COMPLETED' LIMIT 50"

Error handling:

  • Invalid SQL syntax: Returns syntax error with guidance

  • Forbidden operations: Blocked with explanation

  • Missing tables: Suggests using search_tables() to find correct name

  • Permission denied: Explains consent requirement

Note: This tool uses mock data in development. Real query execution requires OAuth authentication.

Inputs: space_id (required), sql_query (required), limit.

find_assets_by_columnA

Find all assets (tables/views) containing a specific column name across SAP Datasphere spaces.

Use this tool when:

  • User asks "Which tables contain CUSTOMER_ID?"

  • Performing data lineage analysis

  • Impact analysis before schema changes

  • Finding datasets for specific use cases

  • Locating related data across spaces

What you'll get:

  • Asset names and types (View, Table, etc.)

  • Space IDs where assets are located

  • Column information (name, type, position)

  • Total column count per asset

  • Consumption URLs for data access

Use cases:

  • Data lineage discovery (find all uses of a column)

  • Impact analysis (before renaming/removing columns)

  • Dataset discovery (find tables with specific fields)

  • Cross-space data exploration

  • Schema relationship mapping

Example queries:

  • "Find all tables with CUSTOMER_ID column"

  • "Which views contain SALES_AMOUNT?"

  • "Show me assets with COUNTRY_CODE in SAP_CONTENT space"

  • "List tables that have ORDER_DATE column"

Performance notes:

  • Searches across multiple spaces by default

  • Uses intelligent caching for better performance

  • Results limited to 50 assets by default (configurable)

  • Case-insensitive search by default

Inputs: column_name (required), space_id, max_assets, case_sensitive.

get_analytical_metadataA

Retrieve CSDL metadata for analytical consumption of a specific asset. Returns analytical schema with dimensions, measures, hierarchies, and aggregation information for BI and analytics integration. Automatically identifies analytical elements based on SAP annotations.

Inputs: asset_id (required), space_id (required), identify_dimensions_measures.

get_analytical_modelA

Get the OData service document and metadata for a specific analytical model. Returns entity sets, dimensions, measures, and query capabilities. Parses CSDL metadata to identify analytical properties (dimensions with sap:aggregation-role='dimension', measures with sap:aggregation-role='measure').

Inputs: asset_id (required), space_id (required), include_metadata.

get_asset_by_compound_keyA

Retrieve asset using OData compound key identifier (alternative access method).

Use this tool when:

  • You have both space ID and asset ID ready

  • Want direct access without knowing the exact endpoint structure

  • Working with bookmarked or favorited assets

  • Have pre-known asset identifiers from other systems

  • Need to resolve cross-references quickly

What you'll get:

  • Same comprehensive metadata as get_asset_details

  • Complete asset information with consumption URLs

  • All dimensions, measures, and relationships

  • Technical and business context

Required parameters:

  • space_id: The space identifier

  • asset_id: The asset identifier

How it works: This tool combines space_id and asset_id into an OData compound key format: spaceId='SAP_CONTENT',assetId='SAP_SC_FI_AM_FINTRANSACTIONS'

Example queries:

  • "Get asset SAP_SC_FI_AM_FINTRANSACTIONS from SAP_CONTENT using compound key"

  • "Retrieve CUSTOMER_VIEW in SALES_SPACE"

When to use this vs get_asset_details:

  • Use this: When you want simplified parameter passing

  • Use get_asset_details: When you need expand options or prefer explicit endpoint

Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/assets({compoundKey})

Inputs: asset_id (required), space_id (required).

get_asset_detailsA

Get comprehensive metadata for a specific SAP Datasphere asset.

Use this tool when:

  • User asks "Show me details about the Financial Transactions asset"

  • Need complete asset documentation and structure

  • Want to understand asset dimensions, measures, and relationships

  • Looking for consumption URLs to access the data

  • Checking asset business purpose and technical details

  • Validating asset availability before integration

What you'll get:

  • Complete asset metadata (name, description, business purpose)

  • Space information and ownership details

  • Asset type and consumption type (analytical/relational)

  • Consumption URLs for data access

  • Metadata URLs for schema information

  • Dimensions and measures (for analytical models)

  • Relationships to other assets

  • Technical details (row count, size, refresh info)

  • Business context (domain, classification, retention)

  • Version and status information

  • Tags and categorization

Required parameters:

  • space_id: The space containing the asset (e.g., 'SAP_CONTENT')

  • asset_id: The asset identifier (e.g., 'SAP_SC_FI_AM_FINTRANSACTIONS')

Optional parameters:

  • expand_fields: Related entities to expand (e.g., ['columns', 'relationships'])

Example queries:

  • "Get details for SAP_SC_FI_AM_FINTRANSACTIONS in SAP_CONTENT"

  • "Show me the structure of the Financial Transactions asset"

  • "What are the dimensions and measures of this analytical model?"

  • "Give me the consumption URL for the Sales Data View"

Use cases:

  • Understand asset structure before querying

  • Get consumption URLs for data access

  • Review asset business purpose and classification

  • Check asset relationships and dependencies

  • Validate data freshness (last refresh time)

  • Generate asset documentation

Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/spaces('{spaceId}')/assets('{assetId}')

Inputs: asset_id (required), space_id (required), expand_fields.

get_asset_variablesA

Retrieve input parameters/variables and filter-capability annotations declared in the OData $metadata of a SAP Datasphere asset (wave 2026.10). Use this when the asset is parameterised (e.g., a view or analytic model with input variables) and you need to know what variables to bind and which fields are filterable/sortable before querying. Returns variables (name, type, default, nullable, multi_value), filter annotations, and the column list.

Inputs: asset_id (required), space_id (required).

get_available_scopesA

List available OAuth2 scopes for the current user, showing which scopes are granted and which are available but not granted. Includes scope descriptions and the token's current scopes. Use this to understand API access capabilities and troubleshoot permission issues.

Inputs: no named parameters.

get_current_userA

Get authenticated user information including user ID, email, display name, roles, permissions, and account status. Use this to understand the current user's identity and access rights in SAP Datasphere.

Inputs: no named parameters.

get_deployed_objectsA

List runtime/deployed objects that are actively running in SAP Datasphere. Returns deployment status, runtime metrics, execution history for data flows, and performance statistics. Use this for monitoring deployed assets, tracking execution status, analyzing runtime performance, and identifying active vs inactive objects.

Inputs: space_id (required), top, skip, object_types, +2 more.

get_object_definitionA

Get complete design-time object definition from SAP Datasphere repository. Retrieves detailed structure, logic, transformations, and metadata for tables (with columns, keys, indexes), views (with SQL definitions), analytical models (with dimensions/measures), and data flows (with transformation steps). Use this for understanding object implementation details, extracting schema information, or planning migrations.

Inputs: space_id (required), object_id (required), include_dependencies, include_full_definition.

get_relational_entity_metadataA

Get detailed metadata for a specific relational entity including column definitions, data types, SQL type mappings, and ETL extraction capabilities. Optimized for data warehouse loading and transformation workflows.

Inputs: asset_id (required), space_id (required), include_sql_types.

get_relational_metadataA

Retrieve CSDL metadata for relational consumption of a specific asset. Returns complete schema information including tables, columns, data types, primary/foreign keys, and relationships for relational data access and ETL planning. Includes SQL type mapping.

Inputs: asset_id (required), space_id (required), map_to_sql_types.

get_space_assetsA

List all data assets within a specific SAP Datasphere space.

Use this tool when:

  • User asks "What assets are in the SAP_CONTENT space?"

  • Browsing assets within a specific space

  • Creating a space-specific asset inventory

  • Filtering assets by type within a space

  • Validating space contents and available data

  • Understanding what data is available in a space

What you'll get:

  • All assets within the specified space

  • Asset names, descriptions, and types

  • Exposure status for each asset

  • Consumption URLs (analytical and relational)

  • Creation and modification timestamps

  • Asset counts and pagination info

This list is not the whole space. It comes from the Catalog API, which only shows objects that are deployed and exposed for consumption. Objects created in the modeler without that flag exist but do not appear here. If something you expect is missing, check the repository with list_repository_objects before telling the user it does not exist.

Required parameters:

  • space_id: The space to browse (e.g., 'SAP_CONTENT')

Optional parameters:

  • filter_expression: Filter by asset type or other criteria

  • top: Maximum results (default 50, max 1000)

  • skip: Results to skip for pagination

Example queries:

  • "List all assets in the SAP_CONTENT space"

  • "Show me analytical models in SALES_ANALYTICS"

  • "What tables are available in FINANCE_SPACE?"

  • "List exposed assets in SAP_CONTENT"

Common filters:

  • By type: filter_expression="assetType eq 'AnalyticalModel'"

  • Exposed only: filter_expression="exposedForConsumption eq true"

  • By name pattern: filter_expression="contains(name, 'Financial')"

  • Combined: filter_expression="assetType eq 'View' and exposedForConsumption eq true"

Asset types:

  • AnalyticalModel: Multi-dimensional models with dimensions and measures

  • View: SQL views combining data from multiple sources

  • Table: Physical tables with business data

  • Fact: Fact tables in dimensional models

  • Dimension: Dimension tables for analysis

Use cases:

  • Space content discovery

  • Asset inventory generation

  • Data availability validation

  • Finding specific asset types

  • Understanding space data landscape

Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/spaces('{spaceId}')/assets

Inputs: space_id (required), top, skip, filter_expression.

get_space_infoA

Get comprehensive information about a specific SAP Datasphere space.

Use this tool when:

  • User asks about a specific space (e.g., "Tell me about SALES_ANALYTICS")

  • You need to see what tables/views exist in a space

  • Checking space configuration and metadata

  • Following up from list_spaces() results

What you'll get:

  • Complete space metadata (status, owner, created date)

  • List of all tables and views in the space

  • Table schemas and row counts

  • Connection information

Required parameter:

  • space_id: Must be uppercase (e.g., 'SALES_ANALYTICS', 'FINANCE_DWH')

Example queries:

  • "Show me the SALES_ANALYTICS space"

  • "What tables are in FINANCE_DWH?"

  • "Tell me about the HR_ANALYTICS space"

Error handling:

  • If space not found, list_spaces() will show available spaces

Inputs: space_id (required).

get_table_schemaA

Get detailed schema information for a specific table or view.

Use this tool when:

  • User asks "What columns are in CUSTOMER_DATA?"

  • Need to understand table structure before querying

  • Planning JOIN operations (need to see key columns)

  • Checking data types for analysis

What you'll get:

  • Complete column list with data types

  • Primary key indicators

  • Column descriptions

  • Table metadata (row count, last updated)

Required parameters:

  • space_id: The space containing the table (uppercase)

  • table_name: Exact table name (case-sensitive, usually uppercase)

Example queries:

  • "Show me the schema of CUSTOMER_DATA in SALES_ANALYTICS"

  • "What columns does SALES_ORDERS have?"

  • "Describe the GL_ACCOUNTS table structure"

Best practices:

  • Use search_tables() first if you don't know the exact table name

  • Check column types before writing queries

  • Identify key columns for JOINs

Next steps:

  • Use execute_query() with proper column names and types

Inputs: space_id (required), table_name (required).

get_task_historyA

Get the execution history for a specific task chain or object in SAP Datasphere.

Use this tool when:

  • Viewing all previous runs of a task chain

  • Analyzing task execution patterns

  • Finding failed runs to investigate

  • Checking historical performance

  • Auditing task chain executions

  • Understanding run frequency and duration

What you'll get:

  • Array of all historical task runs for the specified object

  • Each entry includes: logId, status, startTime, endTime, runTime

  • Sorted by most recent first

  • Shows RUNNING, COMPLETED, FAILED, CANCELLED runs

Required parameters:

  • space_id: The space containing the task chain

  • object_id: The task chain name to get history for

Response includes for each run:

  • logId: Unique identifier for this execution

  • status: RUNNING, COMPLETED, FAILED, or CANCELLED

  • startTime: When the task started (ISO format)

  • endTime: When the task finished (if completed)

  • runTime: Duration in milliseconds

  • objectId: The task chain name

  • applicationId: Always 'TASK_CHAINS' for task chains

  • activity: The activity type (e.g., 'RUN_CHAIN')

  • user: Who initiated the run

Example queries:

  • "Show me the run history for Daily_ETL_Pipeline in SALES_SPACE"

  • "List all executions of Customer_Sync in FINANCE"

  • "Get historical runs for Nested_Chain_1 in DWH_SPACE"

  • "How many times has Data_Refresh run this week?"

Use cases:

  • Identify recurring failures

  • Analyze execution duration trends

  • Find specific failed runs to debug

  • Audit who ran tasks and when

  • Plan maintenance windows

  • Monitor SLA compliance

Workflow example:

  1. Get history: get_task_history(space_id='SALES', object_id='Daily_ETL')

  2. Find failed run: Look for status='FAILED', note logId

  3. Get details: get_task_log(space_id='SALES', log_id=<failed_logId>, detail_level='detailed')

  4. View error messages in the response

Note: Uses API: GET /api/v1/datasphere/tasks/logs/{space_id}/objects/{object_id}

Inputs: space_id (required), object_id (required).

get_task_logA

Get detailed information about a specific task execution in SAP Datasphere.

Use this tool when:

  • Checking status of a running task (after run_task_chain)

  • Investigating why a task failed

  • Viewing detailed execution logs and messages

  • Monitoring task chain progress

  • Debugging data pipeline issues

What you'll get (depends on detail_level):

  • status (default): Simple status object {"status": "COMPLETED"}

  • status_only: Just the status string "COMPLETED"

  • detailed: Full details including messages and child nodes

  • extended: Extended logs with complete message details

Required parameters:

  • space_id: The space where the task ran

  • log_id: The log ID from run_task_chain or get_task_history

Optional parameters:

  • detail_level: Amount of detail to return

    • 'status' (default): Status object only

    • 'status_only': Status string only

    • 'detailed': Full logs with messages and children

    • 'extended': Extended logs with message details

Status values:

  • RUNNING: Task is currently executing

  • COMPLETED: Task finished successfully

  • FAILED: Task encountered an error

  • CANCELLED: Task was manually stopped

Example queries:

  • "Check status of task log 2295172 in SALES_SPACE"

  • "Get detailed logs for log ID 2295172"

  • "Show me why task 2326060 failed in FINANCE"

  • "Get extended execution details for log 2295172"

Detailed response includes:

  • logId, status, startTime, endTime, runTime

  • objectId (task chain name)

  • user who ran the task

  • children: Array of child task executions

  • messages: Array of log messages with severity and timestamps

Use cases:

  • Monitor long-running ETL jobs

  • Debug failed data pipelines

  • Audit task execution history

  • Track data refresh timing

  • Investigate error messages

Note: Uses API: GET /api/v1/datasphere/tasks/logs/{space_id}/{log_id}

Inputs: log_id (required), space_id (required), detail_level.

get_task_statusA

Get status and execution details of data integration and ETL tasks.

Use this tool when:

  • User asks "What tasks are running?"

  • Monitoring data pipeline execution

  • Checking when data was last refreshed

  • Troubleshooting failed tasks

What you'll get:

  • Task IDs and names

  • Execution status (COMPLETED, RUNNING, FAILED, SCHEDULED)

  • Last run timestamp and next scheduled run

  • Execution duration and records processed

  • Associated space information

Filtering options:

  • No parameters: Show all tasks

  • task_id: Get specific task details

  • space_id: Show all tasks for a space

Example queries:

  • "What tasks are currently running?"

  • "Show me all tasks in SALES_ANALYTICS"

  • "When did DAILY_SALES_ETL last run?"

  • "Check status of task FINANCE_RECONCILIATION"

Task types:

  • ETL/data loading tasks

  • Transformation workflows

  • Scheduled data refreshes

  • Data replication jobs

Inputs: task_id, space_id.

get_tenant_infoA

Retrieve SAP Datasphere tenant configuration and system information including tenant ID, region, version, license type, storage quota/usage, user count, space count, enabled features, and maintenance windows. Use this for system administration and capacity planning.

Inputs: no named parameters.

list_analytical_datasetsA

List all available analytical datasets within a specific asset. Discovers analytical models that can be queried for business intelligence and reporting. Returns entity sets with their names, types, and URLs for data access.

Inputs: asset_id (required), space_id (required), top, skip.

list_catalog_assetsA

Browse all data assets across all SAP Datasphere spaces.

Use this tool when:

  • User asks "What assets are available in Datasphere?"

  • Building a complete data catalog or asset inventory

  • Discovering available data assets across all spaces

  • Searching for specific asset types across the system

  • Understanding the overall data landscape

What you'll get:

  • Asset IDs and names across all spaces

  • Asset types (AnalyticalModel, View, Table)

  • Space information for each asset

  • Consumption URLs (analytical and relational)

  • Exposure status and metadata URLs

  • Creation and modification timestamps

Available parameters:

  • select_fields: Specific fields to return (e.g., ['name', 'description', 'spaceId'])

  • filter_expression: OData filter (e.g., "spaceId eq 'SAP_CONTENT'")

  • top: Maximum results (default 50, max 1000)

  • skip: Results to skip for pagination

  • include_count: Include total count of assets

Example queries:

  • "List all available assets in Datasphere"

  • "Show me all analytical models across all spaces"

  • "Find assets in the SAP_CONTENT space"

  • "List the first 20 assets with their consumption URLs"

Common filters:

  • By space: filter_expression="spaceId eq 'SAP_CONTENT'"

  • By type: filter_expression="assetType eq 'AnalyticalModel'"

  • Exposed only: filter_expression="exposedForConsumption eq true"

  • Combined: filter_expression="spaceId eq 'SALES' and assetType eq 'View'"

Asset types you'll see:

  • AnalyticalModel: Multi-dimensional models for analytics

  • View: SQL views combining multiple data sources

  • Table: Physical tables with business data

  • Fact: Fact tables in analytical models

  • Dimension: Dimension tables in analytical models

Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/assets

Inputs: top, skip, include_count, select_fields, +1 more.

list_connectionsA

List all external data source connections and their current status.

Use this tool when:

  • User asks "What data sources are connected?"

  • Checking connection health and availability

  • Understanding data lineage and sources

  • Troubleshooting data refresh issues

What you'll get:

  • Connection IDs and names

  • Connection types (SAP_ERP, SALESFORCE, EXTERNAL, etc.)

  • Connection status (CONNECTED, DISCONNECTED, ERROR)

  • Host information and last tested timestamp

Supported connection types:

  • SAP_ERP, SAP_S4HANA, SAP_BW

  • SALESFORCE, EXTERNAL

  • SNOWFLAKE, DATABRICKS

  • POSTGRESQL, MYSQL, ORACLE, SQLSERVER, HANA

Example queries:

  • "What external connections exist?"

  • "Show me all SAP ERP connections"

  • "Check if Salesforce connection is active"

Use cases:

  • Data integration monitoring

  • Connection health checks

  • Understanding data sources

Inputs: connection_type.

list_database_usersA

List all database users in a specific SAP Datasphere space.

Use this tool when:

  • User asks "What database users exist in SALES space?"

  • Auditing user access and permissions

  • Checking who has database access to a space

  • Before creating a new database user (avoid duplicates)

What you'll get:

  • Database user IDs and full names

  • User status (ACTIVE, INACTIVE)

  • Access permissions and privileges

  • Last login information

  • Audit policy settings

Required parameter:

  • space_id: The space ID (uppercase, e.g., 'SALES', 'FINANCE')

Example queries:

  • "List all database users in SALES space"

  • "Show me who has database access to FINANCE"

  • "What database users are configured?"

Database user access types:

  • Consumption: Read data with/without grant privileges

  • Ingestion: Write/load data into space

  • Schema access: Local and space schema access

  • Script server: Execute advanced analytics

Note: This corresponds to the CLI command: datasphere dbusers list --space

Inputs: space_id (required), output_file.

list_relational_entitiesA

List all available relational entities (tables/views) within a specific SAP Datasphere asset for row-level data access and ETL operations. Returns OData entity sets that can be queried for detailed data extraction.

Inputs: asset_id (required), space_id (required), top.

list_repository_objectsA

List design-time objects in a space by reading the REPOSITORY through the Datasphere CLI — not the Catalog API. Use this when an object is expected but does not show up in search_catalog, get_space_assets or smart_query: those only see objects that are deployed AND exposed for consumption, while this tool also sees objects with @DataWarehouse.consumption.external: false. Also the right tool for a true inventory of what a space actually contains. Requires the CLI to be installed and logged in — check with datasphere_cli_status. Costs one CLI call per object type, so keep object_types narrow.

Inputs: space_id (required), top, skip, object_types, +3 more.

list_spacesA

List all SAP Datasphere spaces with their status and metadata.

Use this tool when:

  • User asks "What spaces are available?" or "Show me all spaces"

  • You need to discover available Datasphere environments

  • Starting data exploration workflow

  • Checking space status and availability

What you'll get:

  • Space IDs and names

  • Space status (ACTIVE, DEVELOPMENT, etc.)

  • Table/view counts per space

  • Owner information (with include_details=True)

Example queries:

  • "What Datasphere spaces exist?"

  • "Show me all data spaces"

  • "Which spaces are active?"

Next steps after using this tool:

  • Use get_space_info() to explore a specific space

  • Use search_tables() to find tables across spaces

Inputs: include_details.

query_analytical_dataA

Execute OData queries on analytical models to retrieve aggregated data with dimensions and measures. Supports full OData query syntax: $select (column selection), $filter (WHERE conditions), $orderby (sorting), $top/$skip (pagination), $apply (aggregations with sum/average/min/max/count/groupby). Perfect for business intelligence, reporting, and data analysis.

Inputs: asset_id (required), space_id (required), entity_set (required), top, +6 more.

query_relational_entityA

Execute OData queries on relational entities for ETL data extraction. Supports large batch processing (up to 50,000 records), advanced filtering, column selection, and pagination. Optimized for data warehouse loading and analytics pipelines. Use list_relational_entities to discover available entity names first.

Inputs: asset_id (required), space_id (required), entity_name (required), top, +4 more.

reset_database_user_passwordA

Reset the password for an existing database user in SAP Datasphere.

IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.

Use this tool when:

  • User requests "Reset password for database user JEFF"

  • Password forgotten or compromised

  • Regular password rotation policy

  • Account locked due to failed login attempts

What happens:

  • Old password is invalidated immediately

  • New password is auto-generated securely

  • User must change password on next login

  • Action is logged for security audit

Required parameters:

  • space_id: The space containing the database user

  • database_user_id: The user whose password needs reset

Security considerations:

  • New password shown only once - save securely!

  • Recommend using output_file to save credentials

  • Notify user through secure channel

  • Enforce password change on first login

  • All active sessions are terminated

Example queries:

  • "Reset password for JEFF in SALES space"

  • "Generate new password for database user ANALYST"

  • "REPORTING_USER password expired, reset it"

Best practices:

  • Always save output to secure file

  • Communicate new password via secure channel (not email!)

  • Verify user identity before resetting

  • Document password reset in change log

Note: Corresponds to CLI: datasphere dbusers password reset --space --databaseuser

Inputs: space_id (required), database_user_id (required), output_file.

run_task_chainA

Execute a task chain in SAP Datasphere and get a log ID for tracking.

Use this tool when:

  • User asks to "Run the ETL pipeline" or "Execute task chain X"

  • Triggering scheduled data loads or transformations

  • Starting data replication or synchronization jobs

  • Automating data refresh workflows

  • Executing orchestrated data pipelines

What happens:

  • Task chain execution is initiated immediately

  • Returns a logId to track the execution status

  • Task runs asynchronously (use get_task_log to check status)

  • All child tasks in the chain are executed in order

Required parameters:

  • space_id: The space containing the task chain (e.g., 'SALES_SPACE')

  • object_id: The task chain name/ID (e.g., 'Daily_ETL_Pipeline')

What you'll get:

  • logId: Unique identifier to track this execution

  • Use get_task_log(space_id, logId) to monitor progress

  • Use get_task_history(space_id, object_id) to see all runs

Example queries:

  • "Run the Daily_ETL_Pipeline in SALES_SPACE"

  • "Execute task chain Customer_Sync in FINANCE_SPACE"

  • "Trigger the data refresh pipeline in ANALYTICS"

  • "Start the nightly batch job in DWH_SPACE"

Important notes:

  • Task chains run asynchronously - tool returns immediately

  • Check status with get_task_log using the returned logId

  • Requires appropriate permissions to run task chains

  • Failed runs can be investigated with detailed logs

Workflow example:

  1. Run task chain: run_task_chain(space_id='SALES', object_id='Daily_ETL')

  2. Get logId from response (e.g., 2295172)

  3. Check status: get_task_log(space_id='SALES', log_id=2295172)

  4. View details: get_task_log(space_id='SALES', log_id=2295172, detail_level='detailed')

Note: Uses API: POST /api/v1/datasphere/tasks/chains/{space_id}/run/{object_id}

Inputs: space_id (required), object_id (required).

search_catalogA

Universal search across all catalog items in SAP Datasphere using advanced search syntax. Supports searching across KPIs, assets, spaces, models, views, and tables. Use SCOPE:<scope_name> prefix for targeted searches. Boolean operators (AND, OR, NOT) supported.

Inputs: query (required), top, skip, facets, +3 more.

search_tablesA

Search for tables and views across all Datasphere spaces by name or description.

Use this tool when:

  • User asks "Find tables with customer data"

  • Looking for tables containing specific keywords

  • Don't know exact table name but know the domain

  • Searching across multiple spaces

Search behavior:

  • Searches both table names and descriptions

  • Case-insensitive matching

  • Returns results from all spaces (or specific space if filtered)

  • Includes table metadata (type, columns, row counts)

Search tips:

  • Use domain keywords: "customer", "sales", "order", "finance"

  • Partial matches work: "cust" finds "CUSTOMER_DATA"

  • Filter by space_id to narrow results

Example queries:

  • "Find all tables related to customers"

  • "Search for sales order tables"

  • "Show me all tables with 'finance' in the name"

Next steps:

  • Use get_table_schema() for detailed column information

  • Use execute_query() to retrieve actual data

Inputs: search_term (required), space_id.

smart_queryA

🚀 SMART QUERY - Intelligent query router that automatically selects the best execution method for your query.

NEW in v1.0.5 - This is a composite tool combining execute_query, query_relational_entity, and query_analytical_data with intelligent routing and fallback logic.

Why use smart_query instead of individual query tools?

  • ✅ Automatic routing to the most reliable method

  • ✅ Fallback handling if primary method fails

  • ✅ No need to understand different query methods

  • ✅ Better error recovery and diagnostics

  • ✅ Performance optimization based on query type

How it works:

  1. Analyzes your query - Detects SQL syntax, aggregations, complexity

  2. Routes intelligently - Chooses the best execution method:

    • Aggregations (SUM, COUNT, GROUP BY) → Analytical endpoint

    • Simple SELECT → Relational endpoint (most reliable)

    • Complex SQL → SQL parsing with OData conversion

  3. Falls back gracefully - If primary method fails, tries alternatives

  4. Returns detailed logs - Shows routing decisions and execution path

Query Modes:

  • auto (default) - Intelligent routing based on query analysis

  • relational - Force use of relational endpoint (most reliable)

  • analytical - Force use of analytical endpoint (for aggregations)

  • sql - Force use of SQL parsing method

Use this tool when:

  • You want reliable query execution without worrying about method selection

  • You're unsure which query method to use

  • You need fallback handling for production reliability

  • You want to see execution diagnostics

Supported query patterns:

  • Simple SELECT: SELECT * FROM SAP_SC_FI_V_ProductsDim LIMIT 10

  • Filtering: SELECT * FROM table WHERE PRICE > 1000

  • Column selection: SELECT PRODUCTID, PRICE FROM table

  • Aggregations: SELECT COMPANYNAME, SUM(GROSSAMOUNT) FROM table GROUP BY COMPANYNAME

  • Sorting: SELECT * FROM table ORDER BY PRICE DESC LIMIT 5

Parameters:

  • space_id - Space ID (e.g., "SAP_CONTENT")

  • query - SQL query or natural language request

  • mode - Routing mode: "auto", "relational", "analytical", "sql" (default: "auto")

  • limit - Max rows to return (default: 1000)

  • include_metadata - Include routing logs and decisions (default: true)

  • fallback - Enable fallback to alternative methods (default: true)

Example queries:

# Auto-routing - simple SELECT
smart_query(space_id="SAP_CONTENT", query="SELECT * FROM SAP_SC_FI_V_ProductsDim LIMIT 5")

# Auto-routing - aggregation
smart_query(space_id="SAP_CONTENT", query="SELECT COMPANYNAME, SUM(GROSSAMOUNT) FROM SAP_SC_SALES_V_SalesOrders GROUP BY COMPANYNAME")

# Force relational mode
smart_query(space_id="SAP_CONTENT", query="SELECT * FROM SAP_SC_FI_V_ProductsDim", mode="relational")

# Disable fallback (fail fast)
smart_query(space_id="SAP_CONTENT", query="SELECT * FROM table", fallback=False)

Response includes:

  • Query results (data)

  • Method used (relational, analytical, sql, or fallback)

  • Execution time

  • Rows returned

  • Routing decision log (if include_metadata=true)

  • Detected query characteristics

Error handling:

  • If primary method fails, automatically tries fallbacks

  • Returns detailed error log showing all attempted methods

  • Provides suggestions for fixing query issues

  • Shows routing decisions for debugging

Performance:

  • Relational: 1-5 seconds, up to 50K records

  • Analytical: Fast for aggregations

  • SQL: 1-5 seconds, up to 1K records

When to use individual tools instead:

  • Use query_relational_entity when you need specific entity_name control

  • Use query_analytical_data when you know you need analytical consumption

  • Use execute_query when you need exact SQL syntax control

  • Use smart_query for everything else (recommended for most use cases)

Note: This tool provides the same functionality as the individual query tools but with better reliability through intelligent routing and fallback handling.

Inputs: query (required), space_id (required), mode, limit, +2 more.

test_connectionA

Test the connection to SAP Datasphere and verify OAuth authentication status. Use this tool to check if the MCP server can successfully connect to SAP Datasphere.

Inputs: no named parameters.

update_database_userA

Update permissions and configuration for an existing database user.

IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.

Use this tool when:

  • User requests "Grant schema access to JEFF in SALES"

  • Modifying user permissions or access levels

  • Enabling/disabling audit policies

  • Changing retention periods

  • Updating user privileges

What you can update:

  • Consumption permissions (read access, grants)

  • Schema access (space, local, HDI)

  • Script server access

  • Audit policies and retention periods

  • Password policies

Required parameters:

  • space_id: The space containing the database user

  • database_user_id: The user to update

  • updated_definition: JSON with new configuration (full definition required)

Update examples:

Grant schema access:

{
  "consumption": {
    "spaceSchemaAccess": true,
    "consumptionWithGrant": false,
    ...
  },
  "ingestion": {...}
}

Enable audit logging:

{
  "consumption": {...},
  "ingestion": {
    "auditing": {
      "dppRead": {
        "isAuditPolicyActive": true,
        "retentionPeriod": 90
      }
    }
  }
}

Important notes:

  • Must provide complete user definition (not partial updates)

  • Changes take effect immediately

  • Active sessions may need reconnection

  • All changes are logged for audit

Example queries:

  • "Grant space schema access to JEFF"

  • "Enable audit logging for ANALYST with 90 day retention"

  • "Update REPORTING_USER to have consumption with grant"

Note: Corresponds to CLI: datasphere dbusers update --space --databaseuser --file-path <def.json>

Inputs: space_id (required), database_user_id (required), updated_definition (required), output_file.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.7/5.0

    Scored across 42 tools

    Disambiguation3/5

    Several tools overlap in purpose: smart_query is a composite of execute_query, query_relational_entity, and query_analytical_data, causing ambiguity about which to choose. get_asset_details and get_asset_by_compound_key are nearly identical, differing only in parameter style. Metadata tools like get_relational_metadata and get_relational_entity_metadata have unclear boundaries. However, many tools have distinct scopes and detailed descriptions that help.

    Naming Consistency4/5

    Tool names mostly follow a consistent verb_noun snake_case pattern (e.g., list_spaces, create_table, get_task_log). Minor deviations exist: smart_query is a nonstandard compound name and datasphere_cli_status is a noun phrase without a verb. Overall, the naming is predictable and readable.

    Tool Count2/5

    With 42 tools, the server is overloaded. While SAP Datasphere is a complex platform, this number exceeds the typical 3-15 well-scoped range and includes redundant tools that add confusion without adding functionality. The scope could be split into separate servers (e.g., catalog, query, administration, tasks) to reduce cognitive load.

    Completeness3/5

    The toolset covers data discovery, querying, task monitoring, and some administrative functions (database users, table creation), but has notable gaps. There are no tools for updating or deleting tables, managing spaces (beyond listing), creating views, or handling connections beyond listing. The write surface is thin compared to the read surface, and lifecycle operations are incomplete.

    Maintenance

    ActivityStale
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      A
      quality
      C
      maintenance
      Production-ready MCP server that enables AI assistants to seamlessly interact with SAP Datasphere environments for real tenant data discovery, metadata exploration, analytics operations, ETL data extraction, database user management, data lineage analysis, and column-level data profiling.
      39
      74 npm
      136 PyPI
      49
      MIT
    • F
      license
      Not graded
      quality
      C
      maintenance
      Model Context Protocol (MCP) server that gives AI assistants a safe, correct data-analyst capability over business metrics - without raw SQL improvisation.
      -
    • A
      license
      Not graded
      quality
      C
      maintenance
      Production-ready MCP server enabling AI assistants to interact with SAP Datasphere for real tenant data discovery, metadata exploration, analytics operations, ETL data extraction, database user management, data lineage analysis, and column-level data profiling.
      MIT
    • A
      license
      Not graded
      quality
      B
      maintenance
      A Model Context Protocol server enabling AI assistants to query and explore data warehouses via Trino, with optional semantic context from metadata catalogs.
      5
      Apache 2.0