sap-mcp-server
Provides tools for reading and writing SAP ABAP development objects through the ADT REST API, with policy-based access control, human approval workflows, and audit logging.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@sap-mcp-serverList the ABAP classes in package ZMCP_SANDBOX"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
sap-mcp-server
An MCP server that lets AI agents read and write SAP ABAP development objects through the ADT REST API, with guardrails that live in the server.
Every tool call is checked against a policy before anything reaches SAP: which packages, namespaces and object types the agent may touch, whether writes are enabled at all, and which actions need a human. Every decision is written to an audit log. The agent can't talk its way around the policy, because the rules are read from a file it has no access to, and object details are looked up in SAP instead of trusted from the agent.
Package, namespace and object type allow-lists.
$TMPand SAP standard objects are off-limits by default.Read-only switch. One setting turns off all writes.
Human approval for activation and transport release. The agent gets an approval request, nothing is executed.
Separation of duties. The developer can't approve their own transport.
Audit log of every decision and result as JSON Lines.
Dry-run mode to try a new policy before enforcing it.
Zero dependencies. Plain Node.js, runs via Docker or
npx.
Use this only against development or sandbox systems, never against production. SeeSecurity.
Contents
Related MCP server: abap-adt-mcp
Quick start
You need an SAP system with the ADT services active (/sap/bc/adt in transaction SICF)
and a development user. Create a .env file with your connection details:
curl -fsSL https://raw.githubusercontent.com/Maherd18/sap-mcp-server/main/.env.example -o .env
# edit .env: SAP_HOST, SAP_PORT, SAP_CLIENT, SAP_USER, SAP_PASSWORDDocker (recommended)
# check the connection
docker run --rm --env-file .env ghcr.io/maherd18/sap-mcp-server scripts/check-connection.mjs
# run the server (MCP over stdio, so -i is required)
docker run -i --rm --env-file .env -v sap-mcp-audit:/data ghcr.io/maherd18/sap-mcp-servernpx (Node.js 22 or later, credentials as environment variables)
npx -y github:Maherd18/sap-mcp-serverFrom source
git clone https://github.com/Maherd18/sap-mcp-server.git
cd sap-mcp-server
cp .env.example .env # fill in your values
npm run check # step-by-step connection check
npm startNo npm install needed.
Create a sandbox package
The default policy only allows writes in the package ZMCP_SANDBOX. If it doesn't
exist yet, create it once:
npm run setup:sandbox # dry run
npm run setup:sandbox -- --create # create itOptions: --name, --swcomp (software component, default HOME), --layer (transport layer).
Client setup
Claude Desktop (claude_desktop_config.json)
{
"mcpServers": {
"sap-adt": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"--env-file", "/absolute/path/to/.env",
"-v", "sap-mcp-audit:/data",
"ghcr.io/maherd18/sap-mcp-server:latest"
]
}
}
}Claude Code
claude mcp add sap-adt -- docker run -i --rm --env-file /absolute/path/to/.env -v sap-mcp-audit:/data ghcr.io/maherd18/sap-mcp-server:latestVS Code (.vscode/mcp.json)
{
"servers": {
"sap-adt": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "--env-file", "${workspaceFolder}/.env", "ghcr.io/maherd18/sap-mcp-server:latest"]
}
}
}More variants (npx, local checkout) are in examples/.
Configuration
Variable | Default | Description |
| – | Application server host (required) |
|
| ICM port |
|
|
|
| – | Client, e.g. |
| – | Development user (required) |
|
| Logon language |
|
| HTTP timeout |
|
| Path to your own policy |
|
| Audit log target ( |
Settings are read from the environment first, then from .env in the project directory.
Policy
The policy is a JSON file, config/policy.json by default.
In Docker, mount your own: -v "$PWD/policy.json:/app/config/policy.json:ro".
{
"mode": "enforce",
"identity": { "developer": "", "approvers": ["LEAD_DEV"] },
"allowedNamespaces": ["Z", "Y"],
"allowedPackages": ["ZMCP_SANDBOX"],
"allowedObjectTypes": ["PROG/P", "CLAS/OC", "INTF/OI", "TABL/DT", "FUGR/F"],
"writeEnabled": true,
"tools": {
"sap_write_source": { "access": "write", "objectScoped": true },
"sap_activate": { "access": "write", "objectScoped": true, "requiresApproval": true }
}
}Key | Description |
|
|
| SAP user the agent works as. Empty means |
| Users allowed to approve a transport release. Must not include the developer. |
| Allowed name prefixes, e.g. |
| Packages the agent may read and write. Keep |
| ADT object types, e.g. |
|
|
| The tool allow-list. A tool that isn't listed doesn't exist. Per tool: |
|
|
Anything not explicitly allowed is denied, including objects that can't be found. When a call is denied, the agent gets the rule name and a reason:
Rule | When |
| The tool isn't in the policy |
| Write call while |
| Request outside |
| Object not found in the system |
| Object name outside |
| Object type outside |
| Package outside |
| Tool needs human approval |
| Separation of duties violated |
Tools
Tool | Access | Description |
| read | Checks the connection, reports user, client and ADT resources |
| read | Searches repository objects by pattern |
| read | Type, package, owner and version of an object |
| read | Source code of an object |
| read | Open transport requests of the user |
| write | Replaces the source of an existing object (lock, write, unlock) |
| write | Activates an object, requires approval |
| write | Releases a transport, requires approval and separation of duties |
There is intentionally no tool to delete or create objects. People create objects, the agent changes existing ones.
Audit log
Every call produces a decision entry before execution and a result entry afterwards:
{"time":"2026-09-26T10:15:02.114Z","run":"2026-09-26T10-14-58-001Z-4127","type":"decision","user":"DEV_USER","tool":"sap_write_source","params":{"requested":{"object_name":"ZCL_OTHER","lines":42},"resolved":{"found":true,"objectName":"ZCL_OTHER","objectType":"CLAS/OC","package":"ZOTHER_PACKAGE"}},"decision":"deny","effective":"deny","enforced":true,"rule":"package_not_allowed","reason":"Package \"ZOTHER_PACKAGE\" is not on the allow-list (ZMCP_SANDBOX).","mode":"enforce"}decision is what the policy concluded, effective is what actually happened. They only
differ in dry-run mode. Passwords, tokens and cookies are never logged.
# all denied calls
jq 'select(.type=="decision" and .effective!="allow")' logs/audit.jsonlSecurity
Development and sandbox systems only.
Use a dedicated SAP user with minimal authorizations (
S_DEVELOPrestricted to the sandbox package), not a personal developer account.Use HTTPS. With plain HTTP, basic auth sends credentials only base64-encoded.
Review
config/policy.jsonbefore the first start. Allow only the sandbox package.
The server has no dependencies on purpose: less supply-chain risk for something with write access to your development system. To report a vulnerability, see SECURITY.md.
Troubleshooting
Run npm run check (or the Docker variant from the quick start) first. It checks
configuration, network, login, search and source access step by step.
Symptom | Cause and fix |
| Wrong user or password, or the user is locked. |
| Logon works but authorizations are missing ( |
| ADT service not active. Activate |
TLS error with HTTPS | Self-signed or internal CA. Set |
Host not reachable from Docker | For a system on your own machine use |
| ADT's |
| Object is locked in another transport. The server always uses the transport from the lock response. |
Activation fails on a locked object | Activation takes its own lock. The server releases its edit lock before activation. |
HTTP 500 on create, but the object exists | ADT sometimes reports an error after creating the object. Check for the object before retrying. |
Limitations
Write path tested with ABAP classes; other object types may need adjustments.
Transport release is never executed; the tool exists to show that the policy stops it.
Separation of duties checks against
identity.approversin the policy, not against SAP authorizations.One SAP system per server instance.
Development
npm test # unit and integration tests, no SAP system neededThe tests cover the policy rules, the MCP handshake over stdio and the full tool path against a simulated ADT endpoint.
src/
server.mjs MCP entry point (JSON-RPC over stdio)
tools.mjs tool definitions, single execution path
policy.mjs policy engine
adt-client.mjs ADT REST client with path guard
audit.mjs audit log
config.mjs configuration from environment / .env
config/policy.json default policy
scripts/ connection check, sandbox setup
test/ tests (node:test)Contributions are welcome, see CONTRIBUTING.md.
Related projects
sap-ai-mcp-servers keeps an up-to-date list of MCP servers for SAP, including several for ABAP and ADT.
License
Available Tools
8 toolssap_activateA
Activates an object. Requires human approval: the call returns an approval request and does not execute.
| Name | Required | Description | Default |
|---|---|---|---|
| object_name | Yes | Object name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states that the call returns an approval request and does not execute, which is a critical non-obvious behavior for an agent to know before invoking a tool that appears to perform an immediate action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler. The first sentence states the purpose, and the second delivers the essential approval caveat immediately after. Every word earns its place, and the critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with no output schema, the description covers the essential operational context: the action and the approval-request return behavior. There are no other required inputs or complex outputs that would demand additional explanation. The description is complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% — object_name is already documented as 'Object name.' The description adds no parameter-level detail, but the single string parameter is simple and fully covered by the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'Activates an object', giving a clear verb and resource. It distinguishes the action from the sibling tools' actions like searching or writing, though it doesn't explicitly state what type of object is being activated or name a sibling to differentiate from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternative siblings. The description does not mention prerequisites, typical activation workflows, or conditions where another tool would be more appropriate. The human-approval note is a behavioral caveat, not a usage-routing instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_list_transportsA
Lists open transport requests of the logged-on user.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. The verb 'Lists' communicates the read-only nature, and the description adds useful scoping context ('open', 'of the logged-on user'). However, it does not disclose the response format, empty-result behavior, or whether an active SAP connection is required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single nine-word sentence with the verb and resource front-loaded. There is no filler, redundancy, or repeated schema information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool, the description covers the essentials: the action, the resource type, and the scope. Nothing needed to invoke the tool correctly is missing. The only gap is the lack of connection to the broader transport workflow (e.g., feeding sap_release_transport), which would help selection but not invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters (schema properties: {}), so the baseline of 4 applies. There is no parameter information the description needs to add since nothing is required to invoke the tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Lists'), a specific resource ('open transport requests'), and a clear scope ('of the logged-on user'). The 'open' qualifier and user scoping differentiate it from siblings like sap_release_transport and sap_search_objects without needing to inspect schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is provided, and no alternative tools are named. The closest sibling, sap_release_transport, operates on the same domain (transports), but the description does not suggest using this tool to discover transports before releasing them. Usage is implied by the name and description but never stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_read_metadataA
Reads type, package, owner and version of an object.
| Name | Required | Description | Default |
|---|---|---|---|
| object_name | Yes | Object name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must disclose behavioral traits. It states the operation is a 'read,' implying non-destructive, but offers no information on permissions, error handling, or response format. This is acceptable for a simple read but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no redundancy. It front-loads the action and key fields, making it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (one parameter, no output schema), the description adequately lists the returned fields, allowing an agent to anticipate the output. It omits details like error conditions or prerequisites, but these are minor for a metadata read.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage for the single parameter (object_name) with a basic description. The tool description adds no extra meaning beyond the schema, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('reads') and resource ('metadata') and enumerates the exact fields returned (type, package, owner, version). This clearly differentiates it from siblings like sap_read_source (which reads source code) and sap_search_objects (which searches).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus the alternative read tools (sap_read_source, sap_search_objects). An agent must infer that this is for metadata only, with no explicit exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_read_sourceB
Reads the source code of a development object.
| Name | Required | Description | Default |
|---|---|---|---|
| object_name | Yes | Object name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden. It discloses that the operation is a read ('Reads'), which implies no modification, but it does not cover authorization needs, possible errors, output form, or whether object_name must be qualified with a development object type. The main behavior is clear, but context beyond the action is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or repetition. It clearly states the action and target in minimal words. It loses one point only because the brevity borders on under-specification rather than intentional, well-rounded conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description covers the essential purpose. However, it does not mention what the source code read returns, whether certain object types are unsupported, or how object_name should be specified. Given the sibling context (read_metadata, write_source), a bit more differentiation would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already defines object_name as 'Object name.' The description adds no further nuance about object_name, such as naming conventions, accepted formats, or how to identify a development object. The baseline of 3 applies because the schema does the heavy lifting and the description does not contradict it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Reads the source code of a development object.' This makes the tool's purpose immediately identifiable and distinguishes it from sap_read_metadata (metadata vs. source code) and sap_write_source (read vs. write). It stops short of a 5 because it does not explicitly clarify scope or contrast itself with sibling tools in the text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied by the purpose: if an agent needs source code, this is the tool that reads it. However, there is no explicit when/when-not guidance, no mention of when sap_read_metadata would be more appropriate, and no prerequisites or naming requirements. It is adequate but relies on inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_release_transportA
Releases a transport request. Requires human approval and is subject to separation of duties.
| Name | Required | Description | Default |
|---|---|---|---|
| approver | No | SAP user who approves the release. Must not be the developer. | |
| transport | Yes | Transport request number. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It explicitly discloses that the action requires human approval and is subject to separation of duties, which are critical authorization and workflow traits. It does not cover reversibility, failure modes, or result shape, but the most important behavioral characteristics are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the action verb, and every sentence earns its place: the first states the core operation, the second states the critical human-approval constraint. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description leaves meaningful gaps: it does not mention the impact of omitting the optional approver, whether the call is asynchronous, or what response/status to expect. The approval workflow is disclosed, but an agent lacks enough detail to handle the tool's unusual interaction pattern confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, so the baseline is 3. The description adds no parameter-specific detail beyond the schema; the separation-of-duties statement echoes the approver schema description rather than expanding on it. This is acceptable because both parameters are already fully documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Releases') and resource ('transport request'), clearly distinguishing it from siblings like sap_list_transports (listing), sap_write_source (writing), and sap_activate (activation). An agent can tell exactly what this tool does without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives, and it does not name sibling tools or exclusion scenarios. The human-approval requirement is a workflow prerequisite, not usage direction, so an agent gets no help choosing between release and related SAP operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_search_objectsB
Searches repository objects. Returns name, type and package.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search pattern, e.g. "ZCL_MCP*". | |
| max_results | No | Maximum number of hits, default 20. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the search operation and the return fields. However, it does not describe behavior such as no-results handling, result ordering, or whether the search is limited to certain object types, so transparency is only partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The primary action is front-loaded, and the return information earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter search tool with no output schema, the description gives the essential invocation context: the search pattern, max_results default via schema, and return fields. It lacks richer context about result shape or when to prefer this over metadata reads, but the basics are covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline applies. The description adds no parameter-level detail beyond the schema, but the schema already documents the search pattern and the max_results default, so no compensation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the operation ('Searches repository objects') and the returned fields ('name, type and package'), which distinguishes it from sibling tools like sap_read_source or sap_list_transports. It does not explicitly contrast itself with sap_read_metadata, but the search verb makes the discovery-oriented purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool instead of a sibling such as sap_read_metadata or sap_list_transports. The description only states what the tool does, leaving the agent to infer the appropriate use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_test_connectionA
Checks the connection to the SAP system and reports user, client and number of available ADT resources.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states that the tool checks the connection and reports user, client, and available ADT resources, which conveys a read-only diagnostic operation. It does not explicitly mention failure behavior or side effects, but 'checks' strongly implies no mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the main action ('Checks the connection') and then lists the key outputs. Every word earns its place; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description adequately explains the return values (user, client, ADT resource count). It does not describe error or timeout behavior, but for a simple connectivity check this is a minor gap rather than a blocking omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description does not need to explain parameter semantics, and it instead clarifies what the tool will report, which is the only relevant semantic information for invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Checks') and a clear resource ('connection to the SAP system'), and it distinguishes itself from the sibling tools by focusing on connectivity rather than object search, metadata reading, source editing, or transport management. The reported outputs (user, client, ADT resource count) further clarify its diagnostic role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when an agent needs to verify SAP connectivity and see connection context. It does not explicitly name alternatives or exclusion conditions, but the zero-parameter design and diagnostic wording make the appropriate context obvious relative to the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sap_write_sourceA
Replaces the source code of an existing object. Only inside the allowed packages. Activation is a separate step that requires approval.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | The new source code. | |
| object_name | Yes | Object name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses that the operation replaces existing source code, is restricted to allowed packages, and does not activate the object. This is meaningful behavioral context beyond the schema, though it does not mention permissions, reversibility, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The primary action is stated first, followed by critical constraints. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter mutation tool with no output schema, the description covers the core action, the scope restriction, and the critical follow-up step (activation). It is complete enough for an agent to invoke it correctly, though it could optionally mention what happens after a successful write.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description adds no additional parameter-level detail beyond what the schema provides, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Replaces') and a specific resource ('the source code of an existing object'), making the tool's function immediately clear. It also distinguishes itself from sibling tools like sap_read_source and sap_activate by focusing on the write operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: it is for replacing source code, restricted to allowed packages, and activation is a separate step requiring approval. It does not explicitly name alternative tools or say 'use X instead', but the context is sufficient to guide an agent away from reading or activating.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.3.0- First observed
sap_activate - First observed
sap_list_transports - First observed
sap_read_metadata - First observed
sap_read_source - First observed
sap_release_transport - First observed
sap_search_objects - First observed
sap_test_connection - First observed
sap_write_source
TDQS
Scored across 8 tools
Each tool targets a distinct resource/action: connection test, search, metadata read, source read, transport list, source write, activation, and transport release. No overlaps or ambiguous boundaries.
All tools follow a consistent snake_case verb_noun pattern with the 'sap_' prefix, making the API predictable and easy to navigate.
8 tools is well-scoped for a SAP development server, covering the essential operations without redundancy or unnecessary bloat.
The set covers the core lifecycle: search, read, edit, activate, and release transports. Missing create/delete operations, but these are often not permitted via API in SAP, so the gap is minor.
Maintenance
Related MCP Connectors
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Supervised API-write gateway for AI agents with policy, human approval and execution receipts.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to access SAP ADT APIs for reading, writing, debugging, deploying, and testing ABAP code through natural language or DSL automation.486MIT
- AlicenseAqualityDmaintenanceEnables AI assistants like Claude Code to directly connect to SAP ABAP systems via the ADT REST API with read/write capabilities, featuring AI-friendly high-level tools and built-in safety measures such as read-only mode, prefix whitelisting, and automatic locking.9325 npmMIT
- AlicenseAqualityCmaintenanceEnables AI agents to read, write, activate, and transport ABAP code in SAP systems via ABAP ADT REST API, without needing SAP GUI.24325 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to perform ABAP Development Tools operations on SAP ERP (ECC and S/4HANA) systems, including source code editing, object activation, syntax checks, and ABAP unit tests.3 npmMIT