# SAP MCP Gateway

A sanitized reference implementation for connecting SAP Business One to MCP-compatible AI clients.

This repository demonstrates a gateway architecture for Service Layer access, read-only SQL analysis, OAuth/PKCE client flows, local action drafts and explicit write gates. It is a public competence showcase and **not** a production deployment package.

## Included

- MCP over stdio and HTTP
- SAP Business One Service Layer reads with bounded pagination
- Optional read-only SQL analysis with query and result limits
- Draft, preflight, review and explicit execution workflow for SAP actions
- OAuth discovery, dynamic client registration and PKCE authorization flow
- Audit logging, stream-size protections and defensive error handling
- Unit and integration-style tests with synthetic data

## Quick start

```bash
npm ci
npm run typecheck
npm run build
npm test
npm run lint
```

Copy `.env.example` to `.env` for local experimentation. The values in that file are placeholders; never commit credentials or live endpoints.

For a container build:

```bash
docker compose -f docker-compose.example.yml up --build
```

## Architecture

- `src/server.ts` — process entry point
- `src/http/` — HTTP and MCP transport
- `src/mcp/` — MCP server construction
- `src/sap/` — Service Layer and SQL client adapters
- `src/tools/` — tool schemas, read operations and guarded action workflows
- `src/security/` — authentication, OAuth and write safety gates
- `src/store/` — local draft and audit persistence
- `tests/` — automated tests using synthetic fixtures

See [`docs/architecture.md`](docs/architecture.md) and [`docs/security.md`](docs/security.md) for the public design notes.

## Public boundary

This split intentionally excludes customer data, generated deployment output, live validation scripts, SSH/Tailscale instructions, server names, production URLs, private operational runbooks and company-specific domain templates. The examples use reserved `.invalid` hostnames and synthetic values.

The gateway defaults to read-only behavior. Enabling SAP writes requires deliberate configuration and should only be done in an isolated development environment after an independent review.

## License

Licensed under the [PolyForm Noncommercial License 1.0.0](LICENSE). Private and noncommercial use is permitted; commercial or business use is not permitted under this license. Dependencies and any third-party code remain subject to their own licenses.