SAP Datasphere MCP Server
The SAP Datasphere MCP Server enables AI assistants to explore, query, and manage SAP Datasphere environments via MCP, covering metadata discovery, data access, profiling, ETL extraction, task management, and CLI-backed administration with built-in security and PII masking.
Key capabilities:
Metadata & Data Discovery: List spaces, search tables/views, browse catalog assets, retrieve schemas, find assets by column name (lineage/impact analysis), explore analytical/relational metadata, get asset variables, list design-time and deployed objects, and browse marketplace data packages.
Data Querying: Execute read-only SQL (up to 1,000 rows), perform OData queries for ETL extraction (up to 50K records), run analytical OData queries, and use smart query routing (auto-selecting relational, analytical, or SQL fallback).
Data Profiling & Quality: Analyze column distributions, detect outliers (IQR-based), assess data quality (null rates, distinct values, percentiles).
Task & Pipeline Management: Run task chains, monitor status, retrieve detailed logs, and view execution history.
Repository & Object Management: Retrieve object definitions, list design-time/deployed objects, and create local tables via CLI (CSN generation).
Database User Administration (CLI-backed): List, create, update, delete users, and reset passwords with consent gating for high-risk operations and audit logging.
Security & PII Protection: Config-driven PII masking (redact, partial, hash, drop, tokenize), SQL sanitization (blocks writes/injections), OAuth 2.0 authentication, four permission levels, and audit logging.
Connectivity & System Info: Test connections, list external data sources and their status, retrieve current user details, tenant configuration, available OAuth scopes, and check CLI installation/authentication.
Provides tools for exploring and querying SAP Datasphere, including metadata discovery, catalog search, SQL and OData queries, ETL extraction, data lineage, column profiling, and configurable PII masking.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@SAP Datasphere MCP Server Find tables related to customer in the Sales space"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
⚠️ This repository is obsolete
MCP-Datasphere-InteractiveUser replaces this project and SAP-Datasphere-CLI. That MCP covers both former functions in one place:
Former repo
What it did
SAP-Datasphere-MCP (this repo)
Consumption / catalog — read rows, search, query
Design-time / admin via the official
datasphereCLIUse github.com/DimiDR/MCP-Datasphere-InteractiveUser instead. This repository is no longer maintained.
🚀 SAP Datasphere MCP Server
CLI + MCP are a combo. This repo owns consumption / catalog (read rows, search, profile). Its counterpart owns design-time / admin (create and change objects). Use them together — not as alternatives.
Half
Repository
MCP (this repo)
CLI
Model Context Protocol server that lets AI assistants explore and query SAP Datasphere — metadata discovery, catalog search, OData and SQL queries, ETL extraction, data lineage and column profiling — with built-in config-driven PII masking so sensitive fields never reach the LLM.
Version 1.4.0 · 42 tools advertised by default (51 with DATASPHERE_TOOL_PROFILE=full)
🙌 Shout-out: this repository is a modified copy of MarioDeFelipe/sap-datasphere-mcp. All credit for the original server goes to Mario de Felipe — this fork adapts it for a specific tenant setup and CLI integration.
Related MCP server: Semantic BI MCP
🤝 Relationship to the SAP Datasphere CLI
This server and the @sap/datasphere-cli are complementary halves, not
alternatives. They reach different API families, and nearly every difference
follows from that:
Reaches | Therefore owns | |
MCP server (this repo) | Consumption and Catalog APIs | Reading data and metadata, catalog search, profiling |
CLI | Design-time and admin APIs | Creating and changing objects, tenant administration |
What each side does
Function | MCP | CLI |
Read data rows | yes — | no — no command returns table contents |
Catalog search, asset lookup |
| — |
Column profiling, distributions, outliers |
| — |
Analytical/relational metadata (dimensions vs. measures, OData→SQL types) |
| — |
PII masking, SQL sanitizing, consent gating, audit logging | yes | — |
Create/change/delete modeling objects (18 types) | local tables only ( | yes |
Spaces, users, global & scoped roles, workload, certificates | read-only or not at all | yes |
Connections: create/change | read-only ( | yes |
Read an object definition (CSN) | — |
|
See deployed but non-exposed objects | via CLI ( |
|
Task chains, task logs |
|
|
Database users |
|
|
The CLI cannot read data rows — that is this server's reason to exist.
This server does not create objects, apart from local tables (create_table),
because the payload there is derived from data it has already read. Views,
analytic models, flows, spaces, users and roles belong to the CLI.
Neither writes data rows. Rows arrive through a data/replication flow, a database user with a SQL client, or a CSV upload in the Data Builder UI. Neither manages folders — those are UI-only.
How they combine in practice
A typical build-then-verify loop:
CLI creates the layers — staging/cleansing/integration views, target tables, transformation flows, task chain, analytic model.
CLI runs the chain and reports task status.
MCP verifies the result: row counts, value distributions, whether data quality flags actually fire — everything the CLI structurally cannot see.
Findings flow back into step 1 as CSN changes.
Keep the visibility gap in mind: Consumption and Catalog endpoints only show
objects that are deployed and exposed for consumption. A view that exists in
the repository but is not exposed is invisible here while the CLI still sees it —
that is what list_repository_objects exists for.
Guide | Content |
Authoritative capability split and routing rules | |
The two config files, two OAuth clients, and App Integration screenshots | |
Finding objects the Consumption API cannot see |
A few tools shell out to the CLI (create_table, the *_database_user* tools,
list_repository_objects). The CLI keeps its own session, separate from this
server's OAuth credentials — check it with the datasphere_cli_status tool.
🚀 Quick Start
# npm
npm install -g @mariodefe/sap-datasphere-mcp && npx @mariodefe/sap-datasphere-mcp
# PyPI
pip install sap-datasphere-mcp && sap-datasphere-mcp
# From source
git clone https://github.com/MarioDeFelipe/sap-datasphere-mcp.git
cd sap-datasphere-mcp
pip install -r requirements.txt && pip install -e .
cp .env.example .env # fill in your credentials
sap-datasphere-mcpFull walkthrough: docs/GETTING_STARTED.md · OAuth setup: docs/OAUTH_SETUP.md
Configuration
DATASPHERE_BASE_URL=https://your-tenant.eu10.hcs.cloud.sap
DATASPHERE_TENANT_ID=your-tenant-id
DATASPHERE_CLIENT_ID=your-client-id
DATASPHERE_CLIENT_SECRET=your-client-secret
DATASPHERE_TOKEN_URL=https://your-tenant.authentication.eu10.hana.ondemand.com/oauth/token
USE_MOCK_DATA=falseOptional settings for the CLI-backed tools (DATASPHERE_CLI_PATH, _HOST,
_SECRETS_FILE) are documented in .env.example and
docs/TENANT_CONFIG.md.
Never commit .env.
Claude Desktop
{
"mcpServers": {
"sap-datasphere": {
"command": "npx",
"args": ["@mariodefe/sap-datasphere-mcp"],
"env": {
"DATASPHERE_BASE_URL": "https://your-tenant.eu20.hcs.cloud.sap",
"DATASPHERE_CLIENT_ID": "your-client-id",
"DATASPHERE_CLIENT_SECRET": "your-client-secret",
"DATASPHERE_TOKEN_URL": "https://your-tenant.authentication.eu20.hana.ondemand.com/oauth/token"
}
}
}
}Config location — Windows: %APPDATA%\Claude\claude_desktop_config.json ·
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json ·
Linux: ~/.config/Claude/claude_desktop_config.json
🛠️ Tool Catalog
42 tools in the default lean profile. Set DATASPHERE_TOOL_PROFILE=full to
also advertise overlapping metadata tools, and DATASPHERE_EXPOSE_DIAGNOSTICS=true
for the endpoint probes — 51 in total. Hiding them by default improves the
model's tool selection; every handler stays reachable.
Foundation (5)
test_connection · get_current_user · get_tenant_info · get_available_scopes · list_spaces
Space discovery (3)
get_space_info · get_table_schema · search_tables
Catalog and search (5)
list_catalog_assets · get_asset_details · get_asset_by_compound_key · get_space_assets · search_catalog
Catalog search runs client-side: /catalog/search returns 404 on the tenants
tested, so these tools fetch assets and filter locally across name, label,
businessName and description.
Data discovery and quality (2)
Tool | Purpose |
| Which assets contain a given column — lineage and impact analysis across spaces |
| Null rate, distinct values, percentiles, IQR outlier detection |
Querying data (4)
Tool | Purpose |
| SQL router: picks analytical vs relational, falls back to client-side aggregation when the asset cannot aggregate |
| SELECT over one entity (columns/ |
| Relational OData, up to 50,000 records per batch for ETL |
| Analytical OData with |
Supported SQL: SELECT */column lists, WHERE, LIMIT, GROUP BY,
aggregations with and without grouping, ORDER BY. No JOINs — OData is
single-entity. Names are case-sensitive.
Metadata (7)
get_relational_metadata · list_relational_entities · get_relational_entity_metadata ·
get_analytical_metadata · get_analytical_model · list_analytical_datasets · get_asset_variables
get_relational_entity_metadata maps OData types to SQL (Edm.String →
NVARCHAR(MAX), Edm.Int64 → BIGINT, Edm.Decimal → DECIMAL(18,2), …) for
data-warehouse loading. get_asset_variables surfaces input parameters a
parameterised view or analytic model expects.
Repository (3)
Tool | Purpose |
| Lists design-time objects via the CLI, so it also sees objects not exposed for consumption |
| Deployed objects in a space |
| Object definition (deprecated — prefer |
Database users (5) — CLI-backed
list_database_users · create_database_user · update_database_user ·
delete_database_user · reset_database_user_password
High-risk operations require consent, cached for 60 minutes.
Tasks (4)
get_task_status · run_task_chain · get_task_log · get_task_history
Object provisioning (1) — CLI-backed
create_table — builds a CSN definition from your column list and runs
datasphere objects local-tables create. Local tables only; see the CLI split above.
Operations (4)
list_connections · browse_marketplace · datasphere_cli_status · get_relational_odata_service (full profile)
datasphere_cli_status reports whether the CLI is installed, which version, which
host, and whether a session exists. Run it first when a CLI-backed tool fails.
🔏 PII / Sensitive-Field Masking
A config-driven, fail-closed masking layer runs inside the response pipeline.
Every data-returning tool (smart_query, query_relational_entity,
query_analytical_data, get_space_assets, analyze_column_distribution) funnels
results through apply_masking() before they reach the LLM. No prompt bypasses it.
Defense in depth. The authoritative access control stays upstream — SAP Datasphere Data Access Controls, and not granting the technical user access to PII tables. This layer is the enforced, auditable net on top.
Environment variable | Values | Default | Purpose |
| path to YAML or JSON | (unset) | Policy file. Unset = masking fully disabled. |
|
|
|
|
| secret string | (empty) | Salt for deterministic |
If the policy file is configured but missing or unparseable, the server raises at startup and refuses to run. It never silently serves raw data with a broken policy.
mode: enforce
default_action: redact
rules:
# Most specific wins: asset > space > global; exact > glob
- space: ZDCS_08
asset: ZR_SAP_CUSTOMER
columns:
EMAIL: redact # → "***"
PHONE: partial:4 # keep last 4 → "******1234"
TAXID: hash # sha256(salt:value) — deterministic, safe for GROUP BY
SSN: drop # column removed from every row
- space: "*"
columns:
"*IBAN*": tokenize # glob on column name → "TKN_<8hex>"
allowlist:
enabled: true
assets:
ZDCS_08.ZR_OTC_CUST_MONTH: [CUSTOMER, MONTH, REVENUE] # ONLY these returned
patterns:
email: '[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}'
iban: '\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b'Precedence: allowlist (drops everything unlisted) → column rules → value-pattern scan on remaining strings.
Audit log — one structured line per call, values never logged:
[pii_masking] space=ZDCS_08 asset=ZR_SAP_CUSTOMER rows=42
masked_fields=['EMAIL', 'PHONE', 'SSN'] mode=enforceThe response also carries masked_fields, so the client can see what was withheld.
Annotated example: pii_policy.yaml.
🔒 Security
Authentication — OAuth 2.0 client credentials, tokens refreshed 60s before expiry and encrypted in memory (Fernet). No credentials in code.
Authorization — four permission levels (READ, WRITE, ADMIN, SENSITIVE), interactive consent for high-risk operations, full audit logging.
Query safety — the SQL sanitizer is fail-closed on SELECT:
INSERT/UPDATE/DELETE/DROP and SQL comments are blocked, along with 15+
injection patterns. Write paths do not exist.
🌐 Transports
stdio by default; Streamable HTTP (spec 2025-03-26) at /mcp for long-lived
service deployments.
Flag | Env var | Default | Purpose |
|
|
|
|
|
|
| Bind address |
|
|
| Bind port |
|
|
| Endpoint path |
|
| (none) | Require |
pip install 'sap-datasphere-mcp[http]'
sap-datasphere-mcp --transport http --port 8080The server warns when bound to a non-loopback interface without a token.
/health serves a plain JSON liveness probe.
📊 Architecture
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ AI Assistant │◄──►│ MCP Server │◄──►│ SAP Datasphere │
│ (Claude, Cursor)│ │ Authorization │ │ (OAuth 2.0) │
│ │ │ PII masking │ │ │
│ │ │ Caching │ │ datasphere CLI │
└─────────────────┘ └──────────────────┘ └─────────────────┘src/sap_datasphere_mcp/
├── server.py # MCP server and all tool handlers
├── cli_runner.py # Single entry point for `datasphere` CLI calls
├── pii_masking.py # Config-driven, fail-closed masking
├── cache_manager.py # TTL cache
├── telemetry.py # Request metrics
├── tool_descriptions.py # Tool metadata
├── error_helpers.py # Error formatting
├── auth/
│ ├── oauth_handler.py # Token management and refresh
│ ├── datasphere_auth_connector.py # Authenticated API connector
│ ├── authorization.py # Permission levels
│ ├── consent_manager.py # Consent tracking
│ ├── input_validator.py # Input validation
│ ├── sql_sanitizer.py # SELECT-only enforcement
│ └── data_filter.py # Credential redaction
└── config/settings.py # Environment-based settingsCaching TTLs — spaces 1h · assets 30min · metadata 15min · users 5min, LRU eviction.
Response times — cached metadata under 100ms · catalog 100–500ms · OData queries 500–2000ms depending on volume.
🧪 Testing
pytest # full suite
pytest tests/test_cli_runner.py # CLI integration layer
npx @modelcontextprotocol/inspector sap-datasphere-mcptests/test_cli_runner.py verifies every CLI command the server hardcodes
against the --help dumps in the DataphereCLI repo. Point
DATASPHERE_CLI_HELP_DIR at tools/cli-help to enable it; it skips otherwise.
Known failure: tests/test_mcp_server.py uses await server.list_resources()(),
an idiom the current MCP SDK no longer supports. Pre-existing, unrelated to the
server itself.
🚀 Deployment
docker build -t sap-datasphere-mcp:latest .
docker run -d --name sap-mcp --env-file .env sap-datasphere-mcp:latest
# or
docker-compose up -dFull guide incl. Kubernetes: docs/DEPLOYMENT.md
📚 Documentation
Guide | Content |
Setup walkthrough with examples | |
Technical API docs, Python and cURL | |
App Integration and OAuth client | |
Config files, the two identities | |
Which tool owns which task | |
Objects invisible to Consumption | |
Docker, Kubernetes, PyPI | |
Contributing to the codebase | |
Version history |
🙏 Acknowledgments
This repository started as a modified copy of MarioDeFelipe/sap-datasphere-mcp. Shout-out to Mario de Felipe for the original server — the tool catalog, PII masking design and OAuth flow this fork builds on all trace back there.
Built with Amazon Kiro (specifications and architectural steering) and Claude Code (security and authentication, tool descriptions and error handling, caching and telemetry, repository and analytics tools, CLI integration layer).
📄 License
MIT — see LICENSE.
📞 Support
Issues · Discussions · SAP Datasphere docs · Model Context Protocol
Available Tools
42 toolsanalyze_column_distributionA
Perform advanced statistical analysis of a column's data distribution including nulls, distinct values, percentiles, and outlier detection.
Use this tool when:
User asks "What's the data quality of AMOUNT column?"
Performing data profiling before analytics
Assessing column completeness and distribution
Detecting outliers and data anomalies
Understanding data patterns for ML/AI
What you'll get:
Basic statistics (count, nulls, distinct values, completeness)
Numeric statistics (min, max, mean, percentiles)
Distribution analysis (top values, frequency)
Outlier detection (IQR method)
Data quality assessment
Use cases:
Data quality assessment
Pre-analytics data profiling
Outlier and anomaly detection
Understanding value distributions
ML feature engineering preparation
Data cleansing planning
Example queries:
"Analyze the distribution of SALES_AMOUNT column"
"What's the data quality of CUSTOMER_AGE?"
"Profile the ORDER_STATUS column"
"Detect outliers in PRICE column"
"Show me statistics for QUANTITY field"
Analysis includes:
Null percentage and completeness rate
Distinct value count and cardinality
For numeric columns: min, max, mean, percentiles (p25, p50, p75)
Top value frequencies
Outlier detection using IQR method
Data quality recommendations
Performance notes:
Analyzes up to 10,000 records (configurable)
Default sample size: 1,000 records
Works with numeric, string, and date columns
Automatic type detection and appropriate statistics
Inputs: space_id (required), asset_name (required), column_name (required), sample_size, +1 more.
browse_marketplaceA
Browse and search available data packages in the SAP Datasphere marketplace.
Use this tool when:
User asks "What data packages are available?"
Looking for external reference data (benchmarks, currency rates, etc.)
Exploring marketplace offerings
Planning to enrich internal data with external sources
What you'll get:
Package IDs and names
Package descriptions and categories
Provider information
Package versions and sizes
Pricing information (Free or paid)
Categories:
Reference Data (industry benchmarks, standards)
Financial Data (currency rates, market data)
Geospatial Data
Industry-specific datasets
Example queries:
"What marketplace packages are available?"
"Find financial data packages"
"Show me industry benchmarks"
"Search for currency rate data"
Use cases:
Data enrichment planning
Finding external reference data
Competitive benchmarking
Currency conversion support
Inputs: category, search_term.
create_database_userA
Create a new database user in a SAP Datasphere space with specified permissions.
IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.
Use this tool when:
User requests "Create a database user named JEFF in SALES"
Setting up new user access for applications or analysts
Configuring data ingestion users
Establishing read-only consumption users
Required parameters:
space_id: The space where user will be created
database_user_id: User name suffix (e.g., 'JEFF', 'REPORTING_USER')
user_definition: JSON object defining permissions and settings
User definition structure:
{
"consumption": {
"consumptionWithGrant": false,
"spaceSchemaAccess": false,
"scriptServerAccess": false,
"enablePasswordPolicy": false,
"localSchemaAccess": false,
"hdiGrantorForCupsAccess": false
},
"ingestion": {
"auditing": {
"dppRead": {
"isAuditPolicyActive": false,
"retentionPeriod": 7
},
"dppChange": {
"isAuditPolicyActive": false,
"retentionPeriod": 7
}
}
}
}Permission types:
Consumption: Read access to space data
consumptionWithGrant: Allow granting privileges to others
spaceSchemaAccess: Access to space schema objects
scriptServerAccess: Execute stored procedures/UDFs
Ingestion: Write access for data loading
Audit policies for compliance (DPP read/change tracking)
Security notes:
New password is auto-generated and returned (store securely!)
Audit retention period: 1-365 days
Minimum privilege principle recommended
Password must be changed on first login
Example queries:
"Create a read-only database user named ANALYST in SALES"
"Set up a database user for data loading in FINANCE"
"Create user REPORTING with consumption access"
Note: Corresponds to CLI: datasphere dbusers create --space --databaseuser --file-path <def.json>
Inputs: space_id (required), user_definition (required), database_user_id (required), output_file.
create_tableA
Create a new local table in a SAP Datasphere space.
IMPORTANT: This is a HIGH-RISK, WRITE operation. It creates a design-time object and (optionally) deploys it, which changes the state of the tenant. Requires user consent.
Use this tool when:
User asks: "Lege eine Tabelle X in Space Y an" / "Create a table for orders in DIMITRITEST"
Provisioning new local tables for data ingestion, staging, or modelling
Bootstrapping schemas from a specification (name + columns)
What it does:
Builds a Datasphere object definition (CSN-style JSON) from your column list
Writes it to a temporary file
Calls the Datasphere CLI:
datasphere objects local-tables create --space <id> --file-path <def.json>(the table name comes from thedefinitionskey in the JSON, not from a flag)The CLI deploys the object by default so it becomes queryable;
deploy=falseadds--no-deployReturns the created table metadata
Required parameters:
space_id: Target space (must exist, uppercase, e.g., 'DIMITRITEST')
table_name: Technical name (uppercase, alphanumeric + underscore, e.g., 'BESTELLUNGEN')
columns: Array of column definitions
Column definition format:
{
"name": "BESTELL_ID", // required, uppercase
"type": "NVARCHAR", // required: NVARCHAR|VARCHAR|INTEGER|BIGINT|DECIMAL|DOUBLE|DATE|TIMESTAMP|BOOLEAN|NCLOB
"length": 20, // for NVARCHAR/VARCHAR
"precision": 15, // for DECIMAL
"scale": 2, // for DECIMAL
"nullable": false, // default true
"description": "Order ID" // optional
}Optional parameters:
primary_keys: Array of column names that form the primary key (e.g., ["BESTELL_ID"])
label: Business-friendly display name (e.g., "Bestellungen")
description: Description of the table's business purpose
deploy: If true (default), deploy the table immediately after creation so it can be queried
Example call (Bestellungen):
{
"space_id": "DIMITRITEST",
"table_name": "BESTELLUNGEN",
"label": "Bestellungen",
"description": "Kundenbestellungen mit Positionen",
"primary_keys": ["BESTELL_ID"],
"columns": [
{"name": "BESTELL_ID", "type": "NVARCHAR", "length": 20, "nullable": false},
{"name": "KUNDEN_ID", "type": "NVARCHAR", "length": 20, "nullable": false},
{"name": "BESTELLDATUM", "type": "DATE"},
{"name": "PRODUKT_ID", "type": "NVARCHAR", "length": 20},
{"name": "MENGE", "type": "INTEGER"},
{"name": "EINZELPREIS", "type": "DECIMAL", "precision": 15, "scale": 2},
{"name": "GESAMTBETRAG", "type": "DECIMAL", "precision": 15, "scale": 2},
{"name": "WAEHRUNG", "type": "NVARCHAR", "length": 3},
{"name": "STATUS", "type": "NVARCHAR", "length": 20}
],
"deploy": true
}Prerequisites (real mode):
Datasphere CLI installed and available on PATH (
datasphere --version)User logged in to the CLI (
datasphere login)User has DW Space Administrator or Modeler role in the target space
Mock mode (USE_MOCK_DATA=true):
No CLI call is made
Returns a simulated success response with the generated object definition
Perfect for testing prompts before running against a real tenant
Security & Safety:
Table name is validated to prevent injection (must match ^[A-Z][A-Z0-9_]*$)
Column names are validated identically
Data types are checked against a whitelist
HIGH-RISK: requires consent, all actions are audit-logged
Idempotency: fails if the table already exists (use datasphere objects local-tables update / delete first)
Note: Corresponds to CLI: datasphere objects local-tables create --space <id> --file-path <def.json> [--no-deploy]
Only local tables. This is the one object type the server creates, because the payload is derived from data it has already read. Views, analytic models, flows, task chains, spaces, users and roles are CLI territory — see docs/MCP_VS_CLI.md. Do not try to reshape this tool's CSN into another type.
Canonical CSN shape: the generated definition follows
examples/local-table-orders.json and Appendix E of the datasphere-cli skill
(DataphereCLI repo). That example is not just a reference — tests/test_csn_shape.py
derives this tool's arguments from it and compares the result back, so the two
cannot drift apart. If the CLI ever rejects the payload, compare against the
example rather than guessing.
Column names must be UPPERCASE (^[A-Z][A-Z0-9_]*$). The minimal SAP Help
example uses a mixed-case Name, which this tool rejects on purpose: uppercase
matches the Open SQL schema convention and needs no quoting in later queries.
Inputs: columns (required), space_id (required), table_name (required), label, +3 more.
datasphere_cli_statusA
Check whether the SAP Datasphere CLI is installed, configured and logged in.
Use this tool when:
A CLI-backed tool failed and you need to know why (
create_table, any*_database_user*tool)The user asks to create or change an object — check the CLI is usable before promising anything
Diagnosing "datasphere CLI not found" or authentication errors
Background — two separate identities: This server reads data through the Consumption/Catalog APIs using its own OAuth technical user. Creating objects and administering the tenant is the CLI's job, and the CLI keeps a separate session (interactive browser login). A working MCP connection therefore says nothing about whether CLI-backed tools will work.
What you'll get:
cli_available/cli_path— is the executable there, and which oneversion— installed CLI version (verify command syntax against it)host— the tenant the CLI is configured againstauthenticated— whether a valid session existsnotes— plain-language diagnosis and next steps
Important: if authenticated is false, the fix is an interactive login that
an agent cannot perform. Ask the user to run it themselves:
datasphere login --options-file ds-options.json --force
Division of labour: for anything this server cannot do — creating views, analytic models, flows, task chains, spaces, users, roles — the answer is a CLI command, not an MCP tool. See docs/MCP_VS_CLI.md.
Safety: never returns tokens or secrets. Session validity is checked with
config secrets check, which reports consistency without disclosing values.
Inputs: no named parameters.
delete_database_userA
Delete a database user from a SAP Datasphere space.
IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution. WARNING: This action is IRREVERSIBLE. User and all associated permissions are permanently deleted.
Use this tool when:
User explicitly requests "Delete database user JEFF from SALES"
Decommissioning user accounts
Removing unauthorized access
Cleaning up test/temporary users
User left organization
What happens:
User account is permanently deleted
All active sessions terminated immediately
All granted privileges revoked
Cannot be undone - must recreate if needed
Deletion is logged for audit
Required parameters:
space_id: The space containing the database user
database_user_id: The user to delete
force: Optional flag to skip confirmation dialog
Safety considerations:
PERMANENT deletion - no recovery possible
Verify user identity and authorization
Check if user owns any objects (may cause errors)
Document reason for deletion
Consider deactivating instead of deleting
Before deleting:
List user's current permissions (list_database_users)
Verify no applications depend on this user
Check if user owns database objects
Get management approval for production users
Document deletion in change log
Example queries:
"Delete database user JEFF from SALES space"
"Remove TEMP_USER from FINANCE"
"Delete TEST_ANALYST - no longer needed"
Best practices:
Always confirm with user before deleting
Use force=false for interactive confirmation
Keep audit trail of deletions
For temporary removal, consider update instead
Note: Corresponds to CLI: datasphere dbusers delete --space --databaseuser [--force]
Inputs: space_id (required), database_user_id (required), force.
execute_queryA
Execute read-only SQL queries against SAP Datasphere tables to retrieve and analyze data.
IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.
Use this tool when:
User explicitly requests data retrieval (e.g., "Show me customers from USA")
Need to perform data analysis with aggregations
Joining multiple tables for insights
Filtering and sorting data
Capabilities:
SELECT queries with full SQL syntax (WHERE, JOIN, GROUP BY, ORDER BY, LIMIT)
Read-only access - NO write operations allowed
Results limited to 100 rows by default (configurable via limit parameter)
Automatic query sanitization and injection prevention
Security & Restrictions:
Only SELECT statements allowed
Blocked operations: INSERT, UPDATE, DELETE, DROP, CREATE, ALTER, etc.
No SQL comments allowed (security risk)
Queries sanitized to prevent injection attacks
User consent required before execution (high-risk operation)
Query best practices:
Always specify a LIMIT to control result size
Use WHERE clauses to filter data efficiently
Check table schema first with get_table_schema()
Use qualified table names when joining
Example queries:
"SELECT * FROM CUSTOMER_DATA WHERE country = 'USA' LIMIT 10"
"SELECT customer_id, SUM(amount) as total FROM SALES_ORDERS GROUP BY customer_id ORDER BY total DESC LIMIT 20"
"SELECT c.customer_name, o.order_date, o.amount FROM CUSTOMER_DATA c JOIN SALES_ORDERS o ON c.customer_id = o.customer_id WHERE o.status = 'COMPLETED' LIMIT 50"
Error handling:
Invalid SQL syntax: Returns syntax error with guidance
Forbidden operations: Blocked with explanation
Missing tables: Suggests using search_tables() to find correct name
Permission denied: Explains consent requirement
Note: This tool uses mock data in development. Real query execution requires OAuth authentication.
Inputs: space_id (required), sql_query (required), limit.
find_assets_by_columnA
Find all assets (tables/views) containing a specific column name across SAP Datasphere spaces.
Use this tool when:
User asks "Which tables contain CUSTOMER_ID?"
Performing data lineage analysis
Impact analysis before schema changes
Finding datasets for specific use cases
Locating related data across spaces
What you'll get:
Asset names and types (View, Table, etc.)
Space IDs where assets are located
Column information (name, type, position)
Total column count per asset
Consumption URLs for data access
Use cases:
Data lineage discovery (find all uses of a column)
Impact analysis (before renaming/removing columns)
Dataset discovery (find tables with specific fields)
Cross-space data exploration
Schema relationship mapping
Example queries:
"Find all tables with CUSTOMER_ID column"
"Which views contain SALES_AMOUNT?"
"Show me assets with COUNTRY_CODE in SAP_CONTENT space"
"List tables that have ORDER_DATE column"
Performance notes:
Searches across multiple spaces by default
Uses intelligent caching for better performance
Results limited to 50 assets by default (configurable)
Case-insensitive search by default
Inputs: column_name (required), space_id, max_assets, case_sensitive.
get_analytical_metadataA
Retrieve CSDL metadata for analytical consumption of a specific asset. Returns analytical schema with dimensions, measures, hierarchies, and aggregation information for BI and analytics integration. Automatically identifies analytical elements based on SAP annotations.
Inputs: asset_id (required), space_id (required), identify_dimensions_measures.
get_analytical_modelA
Get the OData service document and metadata for a specific analytical model. Returns entity sets, dimensions, measures, and query capabilities. Parses CSDL metadata to identify analytical properties (dimensions with sap:aggregation-role='dimension', measures with sap:aggregation-role='measure').
Inputs: asset_id (required), space_id (required), include_metadata.
get_asset_by_compound_keyA
Retrieve asset using OData compound key identifier (alternative access method).
Use this tool when:
You have both space ID and asset ID ready
Want direct access without knowing the exact endpoint structure
Working with bookmarked or favorited assets
Have pre-known asset identifiers from other systems
Need to resolve cross-references quickly
What you'll get:
Same comprehensive metadata as get_asset_details
Complete asset information with consumption URLs
All dimensions, measures, and relationships
Technical and business context
Required parameters:
space_id: The space identifier
asset_id: The asset identifier
How it works:
This tool combines space_id and asset_id into an OData compound key format:
spaceId='SAP_CONTENT',assetId='SAP_SC_FI_AM_FINTRANSACTIONS'
Example queries:
"Get asset SAP_SC_FI_AM_FINTRANSACTIONS from SAP_CONTENT using compound key"
"Retrieve CUSTOMER_VIEW in SALES_SPACE"
When to use this vs get_asset_details:
Use this: When you want simplified parameter passing
Use get_asset_details: When you need expand options or prefer explicit endpoint
Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/assets({compoundKey})
Inputs: asset_id (required), space_id (required).
get_asset_detailsA
Get comprehensive metadata for a specific SAP Datasphere asset.
Use this tool when:
User asks "Show me details about the Financial Transactions asset"
Need complete asset documentation and structure
Want to understand asset dimensions, measures, and relationships
Looking for consumption URLs to access the data
Checking asset business purpose and technical details
Validating asset availability before integration
What you'll get:
Complete asset metadata (name, description, business purpose)
Space information and ownership details
Asset type and consumption type (analytical/relational)
Consumption URLs for data access
Metadata URLs for schema information
Dimensions and measures (for analytical models)
Relationships to other assets
Technical details (row count, size, refresh info)
Business context (domain, classification, retention)
Version and status information
Tags and categorization
Required parameters:
space_id: The space containing the asset (e.g., 'SAP_CONTENT')
asset_id: The asset identifier (e.g., 'SAP_SC_FI_AM_FINTRANSACTIONS')
Optional parameters:
expand_fields: Related entities to expand (e.g., ['columns', 'relationships'])
Example queries:
"Get details for SAP_SC_FI_AM_FINTRANSACTIONS in SAP_CONTENT"
"Show me the structure of the Financial Transactions asset"
"What are the dimensions and measures of this analytical model?"
"Give me the consumption URL for the Sales Data View"
Use cases:
Understand asset structure before querying
Get consumption URLs for data access
Review asset business purpose and classification
Check asset relationships and dependencies
Validate data freshness (last refresh time)
Generate asset documentation
Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/spaces('{spaceId}')/assets('{assetId}')
Inputs: asset_id (required), space_id (required), expand_fields.
get_asset_variablesA
Retrieve input parameters/variables and filter-capability annotations declared in the OData $metadata of a SAP Datasphere asset (wave 2026.10). Use this when the asset is parameterised (e.g., a view or analytic model with input variables) and you need to know what variables to bind and which fields are filterable/sortable before querying. Returns variables (name, type, default, nullable, multi_value), filter annotations, and the column list.
Inputs: asset_id (required), space_id (required).
get_available_scopesA
List available OAuth2 scopes for the current user, showing which scopes are granted and which are available but not granted. Includes scope descriptions and the token's current scopes. Use this to understand API access capabilities and troubleshoot permission issues.
Inputs: no named parameters.
get_current_userA
Get authenticated user information including user ID, email, display name, roles, permissions, and account status. Use this to understand the current user's identity and access rights in SAP Datasphere.
Inputs: no named parameters.
get_deployed_objectsA
List runtime/deployed objects that are actively running in SAP Datasphere. Returns deployment status, runtime metrics, execution history for data flows, and performance statistics. Use this for monitoring deployed assets, tracking execution status, analyzing runtime performance, and identifying active vs inactive objects.
Inputs: space_id (required), top, skip, object_types, +2 more.
get_object_definitionA
Get complete design-time object definition from SAP Datasphere repository. Retrieves detailed structure, logic, transformations, and metadata for tables (with columns, keys, indexes), views (with SQL definitions), analytical models (with dimensions/measures), and data flows (with transformation steps). Use this for understanding object implementation details, extracting schema information, or planning migrations.
Inputs: space_id (required), object_id (required), include_dependencies, include_full_definition.
get_relational_entity_metadataA
Get detailed metadata for a specific relational entity including column definitions, data types, SQL type mappings, and ETL extraction capabilities. Optimized for data warehouse loading and transformation workflows.
Inputs: asset_id (required), space_id (required), include_sql_types.
get_relational_metadataA
Retrieve CSDL metadata for relational consumption of a specific asset. Returns complete schema information including tables, columns, data types, primary/foreign keys, and relationships for relational data access and ETL planning. Includes SQL type mapping.
Inputs: asset_id (required), space_id (required), map_to_sql_types.
get_space_assetsA
List all data assets within a specific SAP Datasphere space.
Use this tool when:
User asks "What assets are in the SAP_CONTENT space?"
Browsing assets within a specific space
Creating a space-specific asset inventory
Filtering assets by type within a space
Validating space contents and available data
Understanding what data is available in a space
What you'll get:
All assets within the specified space
Asset names, descriptions, and types
Exposure status for each asset
Consumption URLs (analytical and relational)
Creation and modification timestamps
Asset counts and pagination info
This list is not the whole space. It comes from the Catalog API, which only
shows objects that are deployed and exposed for consumption. Objects created in
the modeler without that flag exist but do not appear here. If something you
expect is missing, check the repository with list_repository_objects before
telling the user it does not exist.
Required parameters:
space_id: The space to browse (e.g., 'SAP_CONTENT')
Optional parameters:
filter_expression: Filter by asset type or other criteria
top: Maximum results (default 50, max 1000)
skip: Results to skip for pagination
Example queries:
"List all assets in the SAP_CONTENT space"
"Show me analytical models in SALES_ANALYTICS"
"What tables are available in FINANCE_SPACE?"
"List exposed assets in SAP_CONTENT"
Common filters:
By type:
filter_expression="assetType eq 'AnalyticalModel'"Exposed only:
filter_expression="exposedForConsumption eq true"By name pattern:
filter_expression="contains(name, 'Financial')"Combined:
filter_expression="assetType eq 'View' and exposedForConsumption eq true"
Asset types:
AnalyticalModel: Multi-dimensional models with dimensions and measures
View: SQL views combining data from multiple sources
Table: Physical tables with business data
Fact: Fact tables in dimensional models
Dimension: Dimension tables for analysis
Use cases:
Space content discovery
Asset inventory generation
Data availability validation
Finding specific asset types
Understanding space data landscape
Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/spaces('{spaceId}')/assets
Inputs: space_id (required), top, skip, filter_expression.
get_space_infoA
Get comprehensive information about a specific SAP Datasphere space.
Use this tool when:
User asks about a specific space (e.g., "Tell me about SALES_ANALYTICS")
You need to see what tables/views exist in a space
Checking space configuration and metadata
Following up from list_spaces() results
What you'll get:
Complete space metadata (status, owner, created date)
List of all tables and views in the space
Table schemas and row counts
Connection information
Required parameter:
space_id: Must be uppercase (e.g., 'SALES_ANALYTICS', 'FINANCE_DWH')
Example queries:
"Show me the SALES_ANALYTICS space"
"What tables are in FINANCE_DWH?"
"Tell me about the HR_ANALYTICS space"
Error handling:
If space not found, list_spaces() will show available spaces
Inputs: space_id (required).
get_table_schemaA
Get detailed schema information for a specific table or view.
Use this tool when:
User asks "What columns are in CUSTOMER_DATA?"
Need to understand table structure before querying
Planning JOIN operations (need to see key columns)
Checking data types for analysis
What you'll get:
Complete column list with data types
Primary key indicators
Column descriptions
Table metadata (row count, last updated)
Required parameters:
space_id: The space containing the table (uppercase)
table_name: Exact table name (case-sensitive, usually uppercase)
Example queries:
"Show me the schema of CUSTOMER_DATA in SALES_ANALYTICS"
"What columns does SALES_ORDERS have?"
"Describe the GL_ACCOUNTS table structure"
Best practices:
Use search_tables() first if you don't know the exact table name
Check column types before writing queries
Identify key columns for JOINs
Next steps:
Use execute_query() with proper column names and types
Inputs: space_id (required), table_name (required).
get_task_historyA
Get the execution history for a specific task chain or object in SAP Datasphere.
Use this tool when:
Viewing all previous runs of a task chain
Analyzing task execution patterns
Finding failed runs to investigate
Checking historical performance
Auditing task chain executions
Understanding run frequency and duration
What you'll get:
Array of all historical task runs for the specified object
Each entry includes: logId, status, startTime, endTime, runTime
Sorted by most recent first
Shows RUNNING, COMPLETED, FAILED, CANCELLED runs
Required parameters:
space_id: The space containing the task chain
object_id: The task chain name to get history for
Response includes for each run:
logId: Unique identifier for this execution
status: RUNNING, COMPLETED, FAILED, or CANCELLED
startTime: When the task started (ISO format)
endTime: When the task finished (if completed)
runTime: Duration in milliseconds
objectId: The task chain name
applicationId: Always 'TASK_CHAINS' for task chains
activity: The activity type (e.g., 'RUN_CHAIN')
user: Who initiated the run
Example queries:
"Show me the run history for Daily_ETL_Pipeline in SALES_SPACE"
"List all executions of Customer_Sync in FINANCE"
"Get historical runs for Nested_Chain_1 in DWH_SPACE"
"How many times has Data_Refresh run this week?"
Use cases:
Identify recurring failures
Analyze execution duration trends
Find specific failed runs to debug
Audit who ran tasks and when
Plan maintenance windows
Monitor SLA compliance
Workflow example:
Get history: get_task_history(space_id='SALES', object_id='Daily_ETL')
Find failed run: Look for status='FAILED', note logId
Get details: get_task_log(space_id='SALES', log_id=<failed_logId>, detail_level='detailed')
View error messages in the response
Note: Uses API: GET /api/v1/datasphere/tasks/logs/{space_id}/objects/{object_id}
Inputs: space_id (required), object_id (required).
get_task_logA
Get detailed information about a specific task execution in SAP Datasphere.
Use this tool when:
Checking status of a running task (after run_task_chain)
Investigating why a task failed
Viewing detailed execution logs and messages
Monitoring task chain progress
Debugging data pipeline issues
What you'll get (depends on detail_level):
status (default): Simple status object {"status": "COMPLETED"}
status_only: Just the status string "COMPLETED"
detailed: Full details including messages and child nodes
extended: Extended logs with complete message details
Required parameters:
space_id: The space where the task ran
log_id: The log ID from run_task_chain or get_task_history
Optional parameters:
detail_level: Amount of detail to return
'status' (default): Status object only
'status_only': Status string only
'detailed': Full logs with messages and children
'extended': Extended logs with message details
Status values:
RUNNING: Task is currently executing
COMPLETED: Task finished successfully
FAILED: Task encountered an error
CANCELLED: Task was manually stopped
Example queries:
"Check status of task log 2295172 in SALES_SPACE"
"Get detailed logs for log ID 2295172"
"Show me why task 2326060 failed in FINANCE"
"Get extended execution details for log 2295172"
Detailed response includes:
logId, status, startTime, endTime, runTime
objectId (task chain name)
user who ran the task
children: Array of child task executions
messages: Array of log messages with severity and timestamps
Use cases:
Monitor long-running ETL jobs
Debug failed data pipelines
Audit task execution history
Track data refresh timing
Investigate error messages
Note: Uses API: GET /api/v1/datasphere/tasks/logs/{space_id}/{log_id}
Inputs: log_id (required), space_id (required), detail_level.
get_task_statusA
Get status and execution details of data integration and ETL tasks.
Use this tool when:
User asks "What tasks are running?"
Monitoring data pipeline execution
Checking when data was last refreshed
Troubleshooting failed tasks
What you'll get:
Task IDs and names
Execution status (COMPLETED, RUNNING, FAILED, SCHEDULED)
Last run timestamp and next scheduled run
Execution duration and records processed
Associated space information
Filtering options:
No parameters: Show all tasks
task_id: Get specific task details
space_id: Show all tasks for a space
Example queries:
"What tasks are currently running?"
"Show me all tasks in SALES_ANALYTICS"
"When did DAILY_SALES_ETL last run?"
"Check status of task FINANCE_RECONCILIATION"
Task types:
ETL/data loading tasks
Transformation workflows
Scheduled data refreshes
Data replication jobs
Inputs: task_id, space_id.
get_tenant_infoA
Retrieve SAP Datasphere tenant configuration and system information including tenant ID, region, version, license type, storage quota/usage, user count, space count, enabled features, and maintenance windows. Use this for system administration and capacity planning.
Inputs: no named parameters.
list_analytical_datasetsA
List all available analytical datasets within a specific asset. Discovers analytical models that can be queried for business intelligence and reporting. Returns entity sets with their names, types, and URLs for data access.
Inputs: asset_id (required), space_id (required), top, skip.
list_catalog_assetsA
Browse all data assets across all SAP Datasphere spaces.
Use this tool when:
User asks "What assets are available in Datasphere?"
Building a complete data catalog or asset inventory
Discovering available data assets across all spaces
Searching for specific asset types across the system
Understanding the overall data landscape
What you'll get:
Asset IDs and names across all spaces
Asset types (AnalyticalModel, View, Table)
Space information for each asset
Consumption URLs (analytical and relational)
Exposure status and metadata URLs
Creation and modification timestamps
Available parameters:
select_fields: Specific fields to return (e.g., ['name', 'description', 'spaceId'])
filter_expression: OData filter (e.g., "spaceId eq 'SAP_CONTENT'")
top: Maximum results (default 50, max 1000)
skip: Results to skip for pagination
include_count: Include total count of assets
Example queries:
"List all available assets in Datasphere"
"Show me all analytical models across all spaces"
"Find assets in the SAP_CONTENT space"
"List the first 20 assets with their consumption URLs"
Common filters:
By space:
filter_expression="spaceId eq 'SAP_CONTENT'"By type:
filter_expression="assetType eq 'AnalyticalModel'"Exposed only:
filter_expression="exposedForConsumption eq true"Combined:
filter_expression="spaceId eq 'SALES' and assetType eq 'View'"
Asset types you'll see:
AnalyticalModel: Multi-dimensional models for analytics
View: SQL views combining multiple data sources
Table: Physical tables with business data
Fact: Fact tables in analytical models
Dimension: Dimension tables in analytical models
Note: This uses the Catalog API: GET /api/v1/datasphere/consumption/catalog/assets
Inputs: top, skip, include_count, select_fields, +1 more.
list_connectionsA
List all external data source connections and their current status.
Use this tool when:
User asks "What data sources are connected?"
Checking connection health and availability
Understanding data lineage and sources
Troubleshooting data refresh issues
What you'll get:
Connection IDs and names
Connection types (SAP_ERP, SALESFORCE, EXTERNAL, etc.)
Connection status (CONNECTED, DISCONNECTED, ERROR)
Host information and last tested timestamp
Supported connection types:
SAP_ERP, SAP_S4HANA, SAP_BW
SALESFORCE, EXTERNAL
SNOWFLAKE, DATABRICKS
POSTGRESQL, MYSQL, ORACLE, SQLSERVER, HANA
Example queries:
"What external connections exist?"
"Show me all SAP ERP connections"
"Check if Salesforce connection is active"
Use cases:
Data integration monitoring
Connection health checks
Understanding data sources
Inputs: connection_type.
list_database_usersA
List all database users in a specific SAP Datasphere space.
Use this tool when:
User asks "What database users exist in SALES space?"
Auditing user access and permissions
Checking who has database access to a space
Before creating a new database user (avoid duplicates)
What you'll get:
Database user IDs and full names
User status (ACTIVE, INACTIVE)
Access permissions and privileges
Last login information
Audit policy settings
Required parameter:
space_id: The space ID (uppercase, e.g., 'SALES', 'FINANCE')
Example queries:
"List all database users in SALES space"
"Show me who has database access to FINANCE"
"What database users are configured?"
Database user access types:
Consumption: Read data with/without grant privileges
Ingestion: Write/load data into space
Schema access: Local and space schema access
Script server: Execute advanced analytics
Note: This corresponds to the CLI command: datasphere dbusers list --space
Inputs: space_id (required), output_file.
list_relational_entitiesA
List all available relational entities (tables/views) within a specific SAP Datasphere asset for row-level data access and ETL operations. Returns OData entity sets that can be queried for detailed data extraction.
Inputs: asset_id (required), space_id (required), top.
list_repository_objectsA
List design-time objects in a space by reading the REPOSITORY through the Datasphere CLI — not the Catalog API. Use this when an object is expected but does not show up in search_catalog, get_space_assets or smart_query: those only see objects that are deployed AND exposed for consumption, while this tool also sees objects with @DataWarehouse.consumption.external: false. Also the right tool for a true inventory of what a space actually contains. Requires the CLI to be installed and logged in — check with datasphere_cli_status. Costs one CLI call per object type, so keep object_types narrow.
Inputs: space_id (required), top, skip, object_types, +3 more.
list_spacesA
List all SAP Datasphere spaces with their status and metadata.
Use this tool when:
User asks "What spaces are available?" or "Show me all spaces"
You need to discover available Datasphere environments
Starting data exploration workflow
Checking space status and availability
What you'll get:
Space IDs and names
Space status (ACTIVE, DEVELOPMENT, etc.)
Table/view counts per space
Owner information (with include_details=True)
Example queries:
"What Datasphere spaces exist?"
"Show me all data spaces"
"Which spaces are active?"
Next steps after using this tool:
Use get_space_info() to explore a specific space
Use search_tables() to find tables across spaces
Inputs: include_details.
query_analytical_dataA
Execute OData queries on analytical models to retrieve aggregated data with dimensions and measures. Supports full OData query syntax: $select (column selection), $filter (WHERE conditions), $orderby (sorting), $top/$skip (pagination), $apply (aggregations with sum/average/min/max/count/groupby). Perfect for business intelligence, reporting, and data analysis.
Inputs: asset_id (required), space_id (required), entity_set (required), top, +6 more.
query_relational_entityA
Execute OData queries on relational entities for ETL data extraction. Supports large batch processing (up to 50,000 records), advanced filtering, column selection, and pagination. Optimized for data warehouse loading and analytics pipelines. Use list_relational_entities to discover available entity names first.
Inputs: asset_id (required), space_id (required), entity_name (required), top, +4 more.
reset_database_user_passwordA
Reset the password for an existing database user in SAP Datasphere.
IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.
Use this tool when:
User requests "Reset password for database user JEFF"
Password forgotten or compromised
Regular password rotation policy
Account locked due to failed login attempts
What happens:
Old password is invalidated immediately
New password is auto-generated securely
User must change password on next login
Action is logged for security audit
Required parameters:
space_id: The space containing the database user
database_user_id: The user whose password needs reset
Security considerations:
New password shown only once - save securely!
Recommend using output_file to save credentials
Notify user through secure channel
Enforce password change on first login
All active sessions are terminated
Example queries:
"Reset password for JEFF in SALES space"
"Generate new password for database user ANALYST"
"REPORTING_USER password expired, reset it"
Best practices:
Always save output to secure file
Communicate new password via secure channel (not email!)
Verify user identity before resetting
Document password reset in change log
Note: Corresponds to CLI: datasphere dbusers password reset --space --databaseuser
Inputs: space_id (required), database_user_id (required), output_file.
run_task_chainA
Execute a task chain in SAP Datasphere and get a log ID for tracking.
Use this tool when:
User asks to "Run the ETL pipeline" or "Execute task chain X"
Triggering scheduled data loads or transformations
Starting data replication or synchronization jobs
Automating data refresh workflows
Executing orchestrated data pipelines
What happens:
Task chain execution is initiated immediately
Returns a logId to track the execution status
Task runs asynchronously (use get_task_log to check status)
All child tasks in the chain are executed in order
Required parameters:
space_id: The space containing the task chain (e.g., 'SALES_SPACE')
object_id: The task chain name/ID (e.g., 'Daily_ETL_Pipeline')
What you'll get:
logId: Unique identifier to track this execution
Use get_task_log(space_id, logId) to monitor progress
Use get_task_history(space_id, object_id) to see all runs
Example queries:
"Run the Daily_ETL_Pipeline in SALES_SPACE"
"Execute task chain Customer_Sync in FINANCE_SPACE"
"Trigger the data refresh pipeline in ANALYTICS"
"Start the nightly batch job in DWH_SPACE"
Important notes:
Task chains run asynchronously - tool returns immediately
Check status with get_task_log using the returned logId
Requires appropriate permissions to run task chains
Failed runs can be investigated with detailed logs
Workflow example:
Run task chain: run_task_chain(space_id='SALES', object_id='Daily_ETL')
Get logId from response (e.g., 2295172)
Check status: get_task_log(space_id='SALES', log_id=2295172)
View details: get_task_log(space_id='SALES', log_id=2295172, detail_level='detailed')
Note: Uses API: POST /api/v1/datasphere/tasks/chains/{space_id}/run/{object_id}
Inputs: space_id (required), object_id (required).
search_catalogA
Universal search across all catalog items in SAP Datasphere using advanced search syntax. Supports searching across KPIs, assets, spaces, models, views, and tables. Use SCOPE:<scope_name> prefix for targeted searches. Boolean operators (AND, OR, NOT) supported.
Inputs: query (required), top, skip, facets, +3 more.
search_tablesA
Search for tables and views across all Datasphere spaces by name or description.
Use this tool when:
User asks "Find tables with customer data"
Looking for tables containing specific keywords
Don't know exact table name but know the domain
Searching across multiple spaces
Search behavior:
Searches both table names and descriptions
Case-insensitive matching
Returns results from all spaces (or specific space if filtered)
Includes table metadata (type, columns, row counts)
Search tips:
Use domain keywords: "customer", "sales", "order", "finance"
Partial matches work: "cust" finds "CUSTOMER_DATA"
Filter by space_id to narrow results
Example queries:
"Find all tables related to customers"
"Search for sales order tables"
"Show me all tables with 'finance' in the name"
Next steps:
Use get_table_schema() for detailed column information
Use execute_query() to retrieve actual data
Inputs: search_term (required), space_id.
smart_queryA
🚀 SMART QUERY - Intelligent query router that automatically selects the best execution method for your query.
NEW in v1.0.5 - This is a composite tool combining execute_query, query_relational_entity, and query_analytical_data with intelligent routing and fallback logic.
Why use smart_query instead of individual query tools?
✅ Automatic routing to the most reliable method
✅ Fallback handling if primary method fails
✅ No need to understand different query methods
✅ Better error recovery and diagnostics
✅ Performance optimization based on query type
How it works:
Analyzes your query - Detects SQL syntax, aggregations, complexity
Routes intelligently - Chooses the best execution method:
Aggregations (SUM, COUNT, GROUP BY) → Analytical endpoint
Simple SELECT → Relational endpoint (most reliable)
Complex SQL → SQL parsing with OData conversion
Falls back gracefully - If primary method fails, tries alternatives
Returns detailed logs - Shows routing decisions and execution path
Query Modes:
auto(default) - Intelligent routing based on query analysisrelational- Force use of relational endpoint (most reliable)analytical- Force use of analytical endpoint (for aggregations)sql- Force use of SQL parsing method
Use this tool when:
You want reliable query execution without worrying about method selection
You're unsure which query method to use
You need fallback handling for production reliability
You want to see execution diagnostics
Supported query patterns:
Simple SELECT:
SELECT * FROM SAP_SC_FI_V_ProductsDim LIMIT 10Filtering:
SELECT * FROM table WHERE PRICE > 1000Column selection:
SELECT PRODUCTID, PRICE FROM tableAggregations:
SELECT COMPANYNAME, SUM(GROSSAMOUNT) FROM table GROUP BY COMPANYNAMESorting:
SELECT * FROM table ORDER BY PRICE DESC LIMIT 5
Parameters:
space_id- Space ID (e.g., "SAP_CONTENT")query- SQL query or natural language requestmode- Routing mode: "auto", "relational", "analytical", "sql" (default: "auto")limit- Max rows to return (default: 1000)include_metadata- Include routing logs and decisions (default: true)fallback- Enable fallback to alternative methods (default: true)
Example queries:
# Auto-routing - simple SELECT
smart_query(space_id="SAP_CONTENT", query="SELECT * FROM SAP_SC_FI_V_ProductsDim LIMIT 5")
# Auto-routing - aggregation
smart_query(space_id="SAP_CONTENT", query="SELECT COMPANYNAME, SUM(GROSSAMOUNT) FROM SAP_SC_SALES_V_SalesOrders GROUP BY COMPANYNAME")
# Force relational mode
smart_query(space_id="SAP_CONTENT", query="SELECT * FROM SAP_SC_FI_V_ProductsDim", mode="relational")
# Disable fallback (fail fast)
smart_query(space_id="SAP_CONTENT", query="SELECT * FROM table", fallback=False)Response includes:
Query results (data)
Method used (relational, analytical, sql, or fallback)
Execution time
Rows returned
Routing decision log (if include_metadata=true)
Detected query characteristics
Error handling:
If primary method fails, automatically tries fallbacks
Returns detailed error log showing all attempted methods
Provides suggestions for fixing query issues
Shows routing decisions for debugging
Performance:
Relational: 1-5 seconds, up to 50K records
Analytical: Fast for aggregations
SQL: 1-5 seconds, up to 1K records
When to use individual tools instead:
Use
query_relational_entitywhen you need specific entity_name controlUse
query_analytical_datawhen you know you need analytical consumptionUse
execute_querywhen you need exact SQL syntax controlUse
smart_queryfor everything else (recommended for most use cases)
Note: This tool provides the same functionality as the individual query tools but with better reliability through intelligent routing and fallback handling.
Inputs: query (required), space_id (required), mode, limit, +2 more.
test_connectionA
Test the connection to SAP Datasphere and verify OAuth authentication status. Use this tool to check if the MCP server can successfully connect to SAP Datasphere.
Inputs: no named parameters.
update_database_userA
Update permissions and configuration for an existing database user.
IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.
Use this tool when:
User requests "Grant schema access to JEFF in SALES"
Modifying user permissions or access levels
Enabling/disabling audit policies
Changing retention periods
Updating user privileges
What you can update:
Consumption permissions (read access, grants)
Schema access (space, local, HDI)
Script server access
Audit policies and retention periods
Password policies
Required parameters:
space_id: The space containing the database user
database_user_id: The user to update
updated_definition: JSON with new configuration (full definition required)
Update examples:
Grant schema access:
{
"consumption": {
"spaceSchemaAccess": true,
"consumptionWithGrant": false,
...
},
"ingestion": {...}
}Enable audit logging:
{
"consumption": {...},
"ingestion": {
"auditing": {
"dppRead": {
"isAuditPolicyActive": true,
"retentionPeriod": 90
}
}
}
}Important notes:
Must provide complete user definition (not partial updates)
Changes take effect immediately
Active sessions may need reconnection
All changes are logged for audit
Example queries:
"Grant space schema access to JEFF"
"Enable audit logging for ANALYST with 90 day retention"
"Update REPORTING_USER to have consumption with grant"
Note: Corresponds to CLI: datasphere dbusers update --space --databaseuser --file-path <def.json>
Inputs: space_id (required), database_user_id (required), updated_definition (required), output_file.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 42 tools
Several tools overlap in purpose: smart_query is a composite of execute_query, query_relational_entity, and query_analytical_data, causing ambiguity about which to choose. get_asset_details and get_asset_by_compound_key are nearly identical, differing only in parameter style. Metadata tools like get_relational_metadata and get_relational_entity_metadata have unclear boundaries. However, many tools have distinct scopes and detailed descriptions that help.
Tool names mostly follow a consistent verb_noun snake_case pattern (e.g., list_spaces, create_table, get_task_log). Minor deviations exist: smart_query is a nonstandard compound name and datasphere_cli_status is a noun phrase without a verb. Overall, the naming is predictable and readable.
With 42 tools, the server is overloaded. While SAP Datasphere is a complex platform, this number exceeds the typical 3-15 well-scoped range and includes redundant tools that add confusion without adding functionality. The scope could be split into separate servers (e.g., catalog, query, administration, tasks) to reduce cognitive load.
The toolset covers data discovery, querying, task monitoring, and some administrative functions (database users, table creation), but has notable gaps. There are no tools for updating or deleting tables, managing spaces (beyond listing), creating views, or handling connections beyond listing. The write surface is thin compared to the read surface, and lifecycle operations are incomplete.
Maintenance
Related MCP Connectors
A Model Context Protocol server for Wix AI tools
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Model Context Protocol server for the Apideck Unified API. Connect any MCP-compatible agent framework to 100+ accounting systems, HRIS platforms, file storage providers, and more through one integration. More information https://www.apideck.com/mcp-server
Model Context Protocol server for Studex tools, notifications, and profile integrations
Related MCP Servers
- AlicenseAqualityCmaintenanceProduction-ready MCP server that enables AI assistants to seamlessly interact with SAP Datasphere environments for real tenant data discovery, metadata exploration, analytics operations, ETL data extraction, database user management, data lineage analysis, and column-level data profiling.3974 npm136 PyPI49MIT
- FlicenseNot gradedqualityCmaintenanceModel Context Protocol (MCP) server that gives AI assistants a safe, correct data-analyst capability over business metrics - without raw SQL improvisation.-
- AlicenseNot gradedqualityCmaintenanceProduction-ready MCP server enabling AI assistants to interact with SAP Datasphere for real tenant data discovery, metadata exploration, analytics operations, ETL data extraction, database user management, data lineage analysis, and column-level data profiling.MIT
- AlicenseNot gradedqualityBmaintenanceA Model Context Protocol server enabling AI assistants to query and explore data warehouses via Trino, with optional semantic context from metadata catalogs.5Apache 2.0