sap-abap-mcp
Provides tools for interacting with SAP ABAP systems, including WebGUI login, navigation, table browsing, running reports, and executing commands via SOAP/RFC.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@sap-abap-mcp@sap-abap-mcp Read table T001 and show company codes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
sap-abap-mcp
A custom MCP server that connects IBM Bob to any SAP ABAP system via SOAP/RFC and SAP WebGUI (ITS).
No SAP system details are hardcoded — everything is configured through environment variables, so each user connects to their own system with their own credentials.
Prerequisites
Node.js v18 or later
Git (to clone)
IBM Bob IDE extension installed
A valid SAP user account on the target system
Related MCP server: MCP SAP GUI Server
Setup (first time)
Option A — via npx (easiest, no clone needed)
No installation required. Just set your environment variables (Step 3 below) and open the folder in Bob — npx will automatically download and run the latest version.
Option B — via GitHub clone (for development / offline use)
git clone https://github.com/JayGandhi285/sap-abap-mcp.git
cd sap-abap-mcp
npm install
npm run buildThen in .bob/mcp.json, change the command from npx to node and args to ["./build/index.js"].
3. Set your SAP connection details as environment variables
These five variables tell the server which SAP system to connect to and how to log in. Each person sets their own — never share credentials.
Variable | Required | Description | Example |
| ✅ Yes | Full WebGUI URL of your SAP system |
|
| ✅ Yes | SAP client number |
|
| ✅ Yes | Your SAP username |
|
| ✅ Yes | Your SAP password |
|
| ❌ Optional | Logon language (default: |
|
Windows PowerShell — add to your $PROFILE for persistence:
$env:SAP_WEBGUI_URL = "https://your-sap-host/sap/bc/gui/sap/its/webgui"
$env:SAP_CLIENT = "100"
$env:SAP_USERNAME = "your_sap_username"
$env:SAP_PASSWORD = "your_sap_password"
$env:SAP_LANGUAGE = "EN"Mac / Linux — add to ~/.zshrc or ~/.bashrc:
export SAP_WEBGUI_URL="https://your-sap-host/sap/bc/gui/sap/its/webgui"
export SAP_CLIENT="100"
export SAP_USERNAME="your_sap_username"
export SAP_PASSWORD="your_sap_password"
export SAP_LANGUAGE="EN"⚠️ The server will refuse to start and print a clear error message if any required variable is missing.
4. Open the sap-abap-mcp folder in Bob
Bob automatically detects .bob/mcp.json in the workspace root and connects to the server.
The SAP tools will appear in Bob's tool list immediately.
Available tools
Tool | Description |
| Log in via SAP WebGUI (establishes a session) |
| Navigate to any SAP transaction code (SE16, SM30, SU01, …) |
| Browse any transparent SAP table — no login required |
| Full-power table reader: field selection, WHERE filters, pagination |
| Run an ABAP report/program via SA38 |
| Send an OK-code / transaction command to the current WebGUI session |
| Fetch any SAP WebGUI URL and return the rendered page text |
Example prompts in Bob
Show me all users in the SAP system
Read table T001 and show the company codes
Show me all failed background jobs
List all transport requests owned by RAJATHow it works
SOAP/RFC (
sap_rfc_read_table,sap_se16_browse): UsesRFC_READ_TABLEvia SOAP with HTTP Basic Auth — stateless, no login session needed.WebGUI session (
sap_login,sap_navigate, etc.): Performs a full login via SAP ITS WebGUI and keeps session cookies in a local temp file.
Project structure
sap-abap-mcp/
├── src/
│ └── index.ts ← MCP server source (TypeScript)
├── build/
│ └── index.js ← Compiled output (generated — not in Git)
├── .bob/
│ └── mcp.json ← Bob MCP config (all placeholders — safe to share)
├── .gitignore
├── package.json
├── tsconfig.json
└── README.mdRebuilding after source changes
npm run buildThen in Bob: Settings → MCP → Restart server.
Updating to the latest version
git pull
npm install
npm run buildSecurity notes
✅ No credentials or system URLs are hardcoded anywhere in the source.
✅
.gitignoreexcludesbuild/,node_modules/, session files, and data dumps.✅
.bob/mcp.jsoncontains only${ENV_VAR}placeholders — safe to commit to Git.⚠️ Never add real credentials to any file that gets committed to Git.
Available Tools
7 toolssap_execute_commandA
Submit an arbitrary command string (OK code / transaction) to the current SAP WebGUI session, as if typed in the command field.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | SAP command / OK code, e.g. '/nSE11', '=back', '/nEXIT' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It clearly states that the tool submits arbitrary commands as if typed in the command field, but it does not disclose potential side effects, session requirements, or the fact that commands may navigate, mutate state, or log out. For an 'arbitrary command' tool, more cautionary transparency would be valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence that front-loads the action and object. Every part contributes meaning, and there is no redundant filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one well-described parameter and an output schema is absent. However, the description omits guidance about side effects, when to use sap_execute_command versus sap_navigate, and what happens if no session exists. Given the tool's arbitrary-command nature, this leaves meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for the single 'command' parameter with a clear description and examples ('/nSE11', '=back', '/nEXIT'). The tool description does not add extra parameter semantics beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the verb ('Submit'), the resource ('arbitrary command string'), and the target context ('current SAP WebGUI session'). The phrase 'as if typed in the command field' precisely conveys the tool's scope and distinguishes it from sibling tools like sap_navigate or sap_run_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—whenever an arbitrary OK code or transaction command needs to be submitted to the current session. However, it does not explicitly state when to prefer this over alternatives like sap_navigate, nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_get_pageC
Fetch any SAP WebGUI URL and return the rendered page text.
| Name | Required | Description | Default |
|---|---|---|---|
| url_path | Yes | URL path/query relative to WebGUI base, e.g. '?~transaction=SU01&sap-client=100' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavioral traits DNA. It only states the action and output, but omits critical details such as authentication requirements, error handling, potential side effects (e.g., session state changes), or rate limits. It also fails to note whether it modifies data or is purely read-only, which is significant given the WebGUI context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence, concise, and front-loads the primary action. However, it omits essential details that could be included without bloat, so it's efficient but potentially under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (interfacing with SAP WebGUI), the description is insufficient. There is no output schema and no annotations; the description does not explain return format, potential errors, session dependencies, or navigation side effects. Sibling tools suggest a need for orchestration (e.g., login before fetch), but that is not documented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, url_path, has a schema description that covers 100% of its content (explains it's a relative path with example). The tool description adds no additional semantics beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Fetch any SAP WebGUI URL and return the rendered page text' clearly states the verb (fetch) and resource (SAP WebGUI URL), and specifies the output (rendered page text). It distinguishes from siblings like sap_run_report or sap_execute_command, which perform other actions, though it does not explicitly contrast with them. The scope 'any' implies flexibility but not exact differentiation from other fetch-like tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is provided on when to use this tool versus alternatives. The description does not mention exclusions, prerequisites (e.g., requiring sap_login first), or when to choose sap_execute_command or sap_run_report instead. The context of 'any URL' implies broad use, but there is no roadmap for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_loginA
Log in to the SAP system via WebGUI. Must be called before using any other SAP tool. Returns the welcome screen text on success.
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | SAP password (defaults to SAP_PASSWORD env var) | |
| username | No | SAP username (defaults to SAP_USERNAME env var) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden and does well: it discloses side effects (logs in), prerequisite behavior (must be called first), and return value ('Returns the welcome screen text on success'). It falls slightly short by not describing failure modes or authentication error handling, otherwise this would be a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each with a distinct purpose: core action + prerequisite, ordering constraint, and return value. Zero wasted words; everything earns its place. This is a model of concise, front-loaded technical writing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with moderate complexity, this covers all critical aspects: purpose, prerequisite, ordering, and return value. It could add failure/error details, but given the tool's simplicity and the absence of an output schema, this is more than sufficient for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, placing us at the baseline of 3. However, the description goes beyond by explaining that the username and password default to environment variables (SAP_USERNAME/SAP_PASSWORD), which isn't just a repeat—it's the key to understanding why the parameters are optional. This adds genuine semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Log in to the SAP system via WebGUI'), instantly distinguishing it from the sibling tools, which all start with different actions (navigate, browse, run, etc.). It clearly states the tool handles authentication and provides a success condition, leaving no ambiguity about its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Must be called before using any other SAP tool' provides an explicit when-to-use directive and establishes a hard ordering requirement. While it doesn't name alternatives, the sibling list makes it obvious no other tool handles login, making this guidance highly effective.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_rfc_read_tableA
Read data from any SAP transparent database table using RFC_READ_TABLE over SOAP. Supports field selection, WHERE filters, row limits and offsets. No session required — uses Basic Auth directly.
| Name | Required | Description | Default |
|---|---|---|---|
| where | No | WHERE clause lines in ABAP syntax, e.g. ["MANDT EQ '100'"] | |
| fields | No | Field names to return (empty = all fields) | |
| max_rows | No | Max rows to return (default 20, max 1000) | |
| row_skips | No | Rows to skip from the start (for pagination, default 0) | |
| table_name | Yes | SAP table name, e.g. 'T001', 'MARA', 'USR02' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the underlying mechanism (RFC_READ_TABLE over SOAP), authentication (Basic Auth), and statelessness (no session). However, it does not describe return format, error handling, or potential side effects, which are notable gaps for a read operation without an output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, opening with the core purpose and followed by a concise feature list. Every word adds value; no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has moderate complexity (5 params, no output schema). The description covers key aspects like filtering, pagination, and auth, but omits the shape of the returned data, which a user might need to know to integrate with the tool. Given the lack of an output schema, this is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for all five parameters (100% coverage), so the baseline is 3. The description reinforces the purpose of fields, where, max_rows, and row_skips at a high level but adds no new per-parameter detail beyond what the schema offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: reading data from any SAP transparent database table via RFC_READ_TABLE over SOAP. It enumerates specific capabilities (field selection, WHERE filters, row limits, offsets) and distinguishes itself from siblings by noting it requires no session and uses Basic Auth directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool ('No session required — uses Basic Auth directly'), implying it is suitable when no SAP session exists. However, it does not explicitly mention when to avoid it or name alternatives among siblings (e.g., sap_se16_browse), leaving usage guidance partially implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_run_reportC
Run an ABAP report or program via the SA38 / SE38 transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| program | Yes | ABAP program / report name, e.g. 'RSUSR200' | |
| parameters | No | Key-value pairs of selection-screen parameter names and values |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the action and does not disclose potential side effects of running an ABAP report, whether output is returned, or if authentication is required. Running a report could have side effects, which is not addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that immediately conveys the core purpose. There is no redundancy or wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should provide more context about expected outcomes, prerequisites, or limitations. The tool's nested parameter object adds complexity, but the description does not explain what happens after execution or how to handle output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% because both parameters have detailed descriptions. The tool description itself adds no parameter details, but the schema fully documents them, meeting the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Run) and resource (ABAP report/program) along with the transaction codes (SA38/SE38). It is specific but does not explicitly differentiate from sibling tools like sap_execute_command or sap_se16_browse.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. The description implies usage through purpose but provides no exclusions, prerequisites, or context about choosing this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_se16_browseA
Browse a database table via SE16 (Data Browser). Returns the first page of table contents as text.
| Name | Required | Description | Default |
|---|---|---|---|
| max_rows | No | Maximum number of rows to return (1–200, default 20) | |
| table_name | Yes | SAP database table name, e.g. 'USR02', 'T001', 'MARA' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose two key behaviors: only the first page is returned, and the output is plain text. It does not mention authorization requirements or pagination follow-up, but for a simple read-only browsing tool this is meaningful transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one short sentence with no filler, front-loading the core purpose and immediately stating the return behavior. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with a fully documented schema, the description is sufficient for basic selection and invocation: it names the action, resource, output type, and first-page limitation. Minor gaps exist around pagination and comparison with sap_rfc_read_table, but they do not undermine basic usability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds little parameter-specific meaning beyond the phrase 'first page,' which loosely relates to max_rows; the schema already documents both table_name and max_rows with constraints and examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('browse'), resource ('database table'), and method ('via SE16 / Data Browser'), and it specifies the output ('first page... as text'). However, it does not explicitly differentiate this from the sibling sap_rfc_read_table, which likely also reads table data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use SE16 browse versus the sibling sap_rfc_read_table, nor are preconditions or exclusions mentioned. The description implies usage only through the tool name and purpose, leaving the agent to infer selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.0.0- First observed
sap_execute_command - First observed
sap_get_page - First observed
sap_login - First observed
sap_navigate - First observed
sap_rfc_read_table - First observed
sap_run_report - First observed
sap_se16_browse
TDQS
Scored across 7 tools
Several tools have fuzzy boundaries: sap_se16_browse and sap_rfc_read_table both read table data, while sap_navigate, sap_execute_command, and sap_get_page all retrieve rendered SAP pages and can be used to reach transactions. An agent would need to read descriptions very carefully to reliably pick the right tool.
All tools share a sap_ prefix and snake_case style, which helps, but the internal pattern is inconsistent: sap_navigate is a bare verb, sap_se16_browse leads with a transaction code, and sap_rfc_read_table mixes technical context with the action. It is readable but not a uniform verb_noun convention.
Seven tools is a reasonable size for an SAP interaction server and not bloated overall. However, the set could be tightened because some tools are near-duplicates in functionality, such as the two table-reading paths and the multiple page-fetching mechanisms.
Core workflows like login, navigation, table reads, and running reports are covered, but there is no logout or explicit session-management tool, and report output is only exposed as raw page text. Agents can work around some gaps via execute_command or get_page, but the surface is not fully lifecycle-complete.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- ZapierOAuthcom.zapier
Hosted MCP server connecting AI assistants to 9,000+ apps and 40,000+ actions via Zapier.
Cloud-hosted MCP server for secure AI access to enterprise data sources via CData Connect AI.
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
Self-hosted MCP gateway: turn any API, database or MCP server into AI connectors — no code.
Related MCP Servers
- FlicenseBqualityNot gradedmaintenanceAn MCP server that enables AI assistants to interact with SAP systems via the ABAP Development Tools (ADT) REST API. It allows users to read ABAP source code, inspect DDIC objects, and execute SQL queries directly.66-
- AlicenseAqualityAmaintenanceAn MCP server that enables AI assistants to interact with SAP GUI for Windows through the SAP GUI Scripting API.45730MIT

dassian-adtofficial
AlicenseNot gradedqualityDmaintenanceMCP server for SAP ABAP development via the ADT API. Connect AI assistants to your SAP system — read, write, test, and deploy ABAP code without SAP GUI.9MIT- AlicenseNot gradedqualityCmaintenanceAn MCP server that connects AI assistants to SAP systems via the ADT REST API, enabling read, write, syntax-check, and activation of ABAP code directly from the chat.3MIT