sap-abap-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SAP_USER | Yes | SAP logon user. | |
| RFC_GROUP | No | Logon group for load-balanced RFC. | PUBLIC |
| RFC_SYSNR | No | Two-digit system number for direct RFC, e.g. 00. | |
| RFC_ASHOST | No | Application server host for direct RFC (sap_rfc_* tools only). | |
| RFC_MSHOST | No | Message server host for load-balanced RFC. | |
| RFC_R3NAME | No | System ID for load-balanced RFC, e.g. A4H. | |
| SAP_CLIENT | Yes | SAP client, e.g. 100. | |
| SAP_BASE_URL | Yes | The base URL of the SAP system, e.g. https://sap.example.com:44300 (no trailing slash). | |
| SAP_LANGUAGE | No | SAP logon language. | EN |
| SAP_PASSWORD | Yes | SAP logon password. | |
| SAP_TIMEOUT_MS | No | Per-request timeout in milliseconds. | 60000 |
| SAP_VERIFY_SSL | No | Set to 'false' to accept self-signed certificates. | true |
| SAP_DEBUG_STEP_TIMEOUT_MS | No | Per-request timeout for debugger steps. | 600000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| sap_connection_testA | Verify connectivity and authentication to the configured SAP S/4HANA system via ADT. Performs a CSRF/session handshake and reads the ADT discovery document. Use this first to confirm SAP_BASE_URL, SAP_CLIENT, SAP_USER, and SAP_PASSWORD are correct and that the /sap/bc/adt ICF service is active. Args:
Returns (json): { baseUrl, client, user, language, authenticated: boolean, workspaces: string[] }. Examples:
|
| sap_search_objectsA | Quick-search the ABAP repository for objects (programs, classes, interfaces, function modules, tables, CDS, packages, etc.) by name pattern. Args:
Returns (json): { query, count, objects: [{ uri, type, name, packageName?, description? }] }. 'type' is the ADT type code, e.g. PROG/P (program), CLAS/OC (class), INTF/OI (interface), FUGR/FF (function module), TABL/DT (table), DDLS/DF (CDS). Examples:
|
| sap_get_sourceA | Read the ABAP source code of a program, include, class, interface, or function module. Args:
Returns (json): { objectType, objectName, sourceUri, etag?, source, lineCount }. 'etag' identifies the version and enables concurrency-safe writes. Examples:
|
| sap_get_ddicA | Inspect a Data Dictionary object's definition. Behavior by type (read-only, release-independent via the DDIC repository tables):
Args:
Returns (json): { objectType, objectName, detail, rawSource? }. Examples:
|
| sap_read_tableA | Read the CONTENTS of any table or view the user is authorized for, via the ADT SQL Data Preview. This is the primary tool for reading customizing (T*) tables and business data. Args:
Returns (json): { query, columns: [{name,type,length,description,key}], rows: [{col: value}], rowCount, totalRows, truncated }. Examples:
|
| sap_sql_queryA | Run a freestyle, read-only ABAP-SQL SELECT (including joins) via the ADT Data Preview. Use this when sap_read_table is not expressive enough. Args:
Returns (json): same shape as sap_read_table. Examples:
|
| sap_syntax_checkA | Run an ABAP syntax check (check run) against an object and return errors, warnings, and info messages. Args:
Returns (json): { objectType, objectName, version, errorCount, warningCount, messages: [{type, text, uri?}] }. Examples:
|
| sap_list_transportsA | List workbench/customizing transport requests (and their tasks) owned by a user, via the CTS ADT service. Args:
Returns (json): { user, count, transports: [{ number, description, status, owner, tasks: [...] }], raw? }. Status codes: 'D'/'L' = modifiable, 'O'/'R' = released. Examples:
|
| sap_write_sourceA | Replace the source code of an EXISTING program, include, class, interface, or function module. This MODIFIES the SAP system. The tool runs the full stateful flow: lock -> write source -> (optionally activate) -> unlock. It captures the current ETag to avoid overwriting concurrent changes. Args:
Returns (json): { objectType, objectName, sourceUri, bytesWritten, transport?, activated, activationMessages: [{type,text}], message }. Examples:
|
| sap_activateA | Activate one or more inactive ABAP objects. This MODIFIES the SAP system (makes the working version live). Args:
Returns (json): { activated: boolean, objects: [{type,name}], messages: [{type,text,line?}] }. 'activated' is true only when there are no error (E) messages. Examples:
|
| sap_list_breakpointsA | List the external (ADT) breakpoints set through this MCP server. IMPORTANT — this is a client-side list. SAP offers no enumeration for external breakpoints: GET /sap/bc/adt/debugger/breakpoints answers HTTP 200 with an empty body even while breakpoints exist, and Eclipse works the same way (client-side truth, full-set sync on write). So this returns what this server has set since it started; breakpoints set from Eclipse, or by this server before a restart, are not listed. To cross-check the server side, run sap_sql_query on ABDBG_EXTDBPS (key RQ_USER). Returns (json): { user, client, count, breakpoints: [{id, clientId, uri, line, objectName, condition, enabled}], note }. 'id' is the structured id SAP assigned (KIND=…LINE_NR=…), used by sap_delete_breakpoints. Examples:
|
| sap_set_breakpointA | Set an external (ADT) breakpoint at a line in an ABAP object, for the user the debug session listens for (default SAP_USER). Args:
Returns (json): { success, breakpoints: [{id, clientId, uri, line, objectName, condition}], failed, message }. SAP resolves the source line to the line of the generated include, so the id may name a different LINE_NR than you asked for. That is normal. Examples:
|
| sap_delete_breakpointsA | Delete specific external breakpoints, or clear the whole external breakpoint set. Args:
Returns (json): { deleted, message }. Examples:
|
| sap_create_objectA | Create a new ABAP repository object (program, include, class, interface, or function group). The object must not already exist. After creation, use sap_write_source to add source code and sap_activate to make it live. Args:
Returns (json): { objectType, objectName, uri, transport?, message }. Examples:
|
| sap_run_consoleA | Execute an ABAP snippet server-side via the ADT class-run endpoint — no RFC SDK required. The snippet becomes the body of IF_OO_ADT_CLASSRUN~MAIN in a reusable local ($TMP) runner class, so it can CALL FUNCTION any function module / BAPI and print results with out->write( ). This is the SDK-free substitute for the sap_rfc_* tools. Args:
Returns (json): { className, activated, output, message }. Examples:
|
| sap_where_usedA | Find all repository objects that reference a given object (where-used list). Essential before changing or deleting anything. Supply either:
Args:
Returns (json): { objectUri, count, refs: [{uri, type, name, packageName?, description?}], truncated }. Examples:
|
| sap_run_unit_testsA | Execute ABAP Unit tests for an object and return pass/fail results per test method. Runs all test classes (FOR TESTING) contained in or associated with the object. Useful for verifying changes before activating or releasing. Args:
Returns (json): { objectName, total, passed, failed, errors, skipped, testClasses: [{name, methods: [{name, outcome, alerts: [{kind, title, details?}]}]}] }. Examples:
|
| sap_create_transportA | Create a new workbench or customizing transport request. Returns the transport number to use in sap_write_source, sap_create_object, or sap_delete_object. Args:
Returns (json): { number, description, category, message }. Examples:
|
| sap_release_transportA | Release (export) a transport request. This starts the transport release job. WARNING: Releasing a transport is IRREVERSIBLE. The request becomes read-only. Ensure all objects in it are correct and activated before releasing. Args:
Returns (json): { number, released, jobId?, message }. Examples:
|
| sap_delete_objectA | Delete an ABAP repository object. This PERMANENTLY REMOVES the object from SAP. The tool locks the object, deletes it, and records the change in the transport if provided. This cannot be undone (except by restoring from a transport or backup). Args:
Returns (json): { objectType, objectName, message }. Examples:
|
| sap_browse_packageA | List the repository objects and sub-packages inside an ABAP package. Useful for exploring what's in a package before making changes or doing an audit. Args:
Returns (json): { packageName, count, nodes: [{uri, type, name, description?, expandable?}] }. type: DEVC/K (sub-package), PROG/P (program), CLAS/OC (class), INTF/OI (interface), FUGR (function group), etc. Examples:
|
| sap_get_screen_sourceA | Read the flow logic (PBO/PAI) source code of a dynpro/screen. Screens are separate from program source — this is the screen ABAP (not the element list). Args:
Returns (json): { program, screenNumber, sourceUri, source, lineCount }. Examples:
|
| sap_get_message_classA | Read all messages in an ABAP message class (T100 content + metadata). Args:
Returns (json): { name, description?, language?, count, messages: [{id, text, selfExplanatory?}] }. Examples:
|
| sap_get_badiA | Read the definition of a BAdI (Business Add-In) from the Enhancement Framework, including its interface and active implementations. Args:
Returns (json): { name, description?, interfaceName?, implCount, implementations: [{name, active, description?}], raw? }. raw is set when structured parsing yields nothing (ADT response varies by release). Examples:
|
| sap_debug_attachA | Open a debug session handle and confirm this server may listen for a user's execution. BEHAVIOUR CHANGED (the old 'attach to a terminal/session id' had no counterpart in the ADT protocol — there is no debug-session resource). ADT debugging is listener-based: you arm a listener for a USER, and the first line that user executes under a breakpoint traps and freezes their work process. This call validates the scope and creates the handle; sap_debug_wait is what actually registers the listener and blocks. Workflow:
Args:
Returns (json): { sessionId, state: 'LISTENING', user, mode, message }. sessionId (e.g. 'dbg-1') is a handle in THIS server, not a SAP object. It does not survive a server restart. Error Handling:
|
| sap_debug_waitA | Register the debug listener and block until the watched user's code traps on a breakpoint — then attach to it and return the stop position and call stack. BEHAVIOUR CHANGED: this is now a real server-side long-poll (POST /sap/bc/adt/debugger/listeners), not a state-polling loop, and it performs the attach itself. Registration is a side effect of this call: once made, the listener stays armed on SAP across timeouts until sap_debug_detach deletes it. Args:
Returns (json): { sessionId, state, program?, include?, line?, stack, debuggee?, reachedBreakpoints?, message }.
Error Handling:
|
| sap_debug_stateA | Report the state of a debug session, plus a fresh call stack when a debuggee is stopped. Args:
Returns (json): { sessionId, state, program?, include?, line?, stack: [{index, program, include?, line?, name?}], debuggee?, reachedBreakpoints? }. States: LISTENING (armed, nothing trapped yet) · STOPPED (debuggee frozen) · RUNNING (a step has not come back yet) · TIMEOUT / CANCELLED / ENDED / DETACHED. Only STOPPED calls SAP; the other states are answered from this server. |
| sap_debug_variablesA | Read ABAP variable values at the current stop point. Requires state='STOPPED' (a debuggee attached by sap_debug_wait). Args:
Returns (json): { sessionId, count, variables: [{name, id?, type?, value?, kind?, tableLines?}] }. kind: 'elementary' | 'structure' | 'table' | 'reference'. Values SAP truncated are marked as truncated; tables report tableLines. Error Handling:
|
| sap_debug_stepA | Move the stopped debuggee: stepOver, stepInto, stepOut, stepReturn, continue, or stop. Requires state='STOPPED'. The call returns when the debuggee stops again — 'continue' therefore BLOCKS for as long as the program runs to its next breakpoint, which can be minutes. Steps run on their own timeout (SAP_DEBUG_STEP_TIMEOUT_MS, default 600000 ms), not the 60s global one. Args:
Returns (json): { sessionId, command, state, program?, include?, line?, reachedBreakpoints?, message }.
|
| sap_debug_evalA | Read one variable at the current stop point, without listing all locals. Note: the ABAP debugger resolves variable IDs, not computed expressions. 'LV_AMOUNT', 'SY-SUBRC' and 'GT_RESULT' work; 'strlen( lv_text )' does not — there is no evaluate-expression service in this API. Args:
Returns (json): { sessionId, expression, value, type? }. Error Handling:
|
| sap_debug_detachA | End a debug session and leave nothing behind on SAP. ALWAYS call this when done — a frozen debuggee is a real user session that cannot continue, and an armed listener keeps trapping that user's execution. Cleanup, in order, each step best-effort and reported individually:
Args:
Returns (json): { sessionId, breakpointsCleared, debuggeeReleased, listenerDeleted, verified, message }. verified=false means the check could not confirm the listener is gone: call again. Idempotent — safe to call twice, and safe to call on a session that already ended. |
| sap_rfc_pingA | Test the RFC connection to SAP using STFC_CONNECTION. Requires node-rfc and the SAP NW RFC SDK. Configure via RFC_ASHOST + RFC_SYSNR (direct) or RFC_MSHOST + RFC_R3NAME (load-balanced) in .env. Returns (json): { connected, systemId?, message }. Notes:
|
| sap_rfc_system_infoA | Call RFC_SYSTEM_INFO to retrieve SAP system metadata (SID, host, release). Returns (json): { sysId, client, host, programId?, releaseVersion?, language? }. |
| sap_rfc_describeA | Get the parameter list (import, export, changing, table) of any RFC-enabled function module. Args:
Returns (json): { name, parameters: [{ name, direction, type, length?, description?, optional? }] }. direction: I=import, E=export, C=changing, T=table. Examples:
|
| sap_rfc_callA | Call any RFC-enabled function module and return all exported parameters. Use sap_rfc_describe first to discover parameters. WARNING: This can execute arbitrary function modules including write operations. Confirm authorization before calling write FMs in production. Args:
Returns (json): { functionName, result: { ...exported parameters } }. Examples:
|
| sap_bapi_callA | Call a BAPI function module. Automatically calls BAPI_TRANSACTION_COMMIT on success or BAPI_TRANSACTION_ROLLBACK on ABAP error (type E/A in the RETURN table). WARNING: BAPI calls can create, change, or delete business objects. Use only in development/sandbox unless you are certain of the effect. Args:
Returns (json): { functionName, result, return?: [{type, id, number, message}], committed }. committed=true means BAPI_TRANSACTION_COMMIT was called. committed=false means an error occurred and it was rolled back. Examples:
|
| sap_user_getA | Read SAP user details (address, logon data, lock status, roles, profiles) via BAPI_USER_GET_DETAIL. Args:
Returns (json): { username, firstName?, lastName?, email?, validFrom?, validTo?, locked?, roles: string[], profiles: string[] }. Examples:
|
| sap_job_scheduleA | Create and schedule an ABAP background job via JOB_OPEN + JOB_SUBMIT + JOB_CLOSE. WARNING: This immediately starts an ABAP program in background if immediate=true. Only use in development/sandbox or when you are certain of the effect. Args:
Returns (json): { jobName, jobCount, message }. Use jobCount + jobName to monitor in SM37. Examples:
|
| sap_atc_runA | Run an ATC (ABAP Test Cockpit) check on an ABAP object and return the findings (priority, check, message, line). Use before releasing a transport. Supply either:
Args:
Returns (json): { objectUri, checkVariant, worklistId, timestamp?, stats: {prio1, prio2, prio3}, findingCount, objects: [{uri, type, name, packageName?, findings: [{uri, location?, line?, priority, checkId?, checkTitle?, messageId?, messageTitle}]}] }. Priority 1 = error, 2 = warning, 3 = information. Examples:
|
| sap_list_dumpsA | List recent ABAP runtime errors (ST22 short dumps): error ID, terminated program, user, time, and the dump URI for sap_get_dump. Args:
Returns (json): { count, dumps: [{ errorId, program?, user, published, shortText?, uri }], filteredBy? }. Pass 'uri' verbatim to sap_get_dump — it contains encoded characters. Examples:
|
| sap_get_dumpA | Read one ABAP runtime error (short dump) in full: metadata plus the formatted ST22 analysis text. Get the dump_uri from sap_list_dumps. Args:
Returns (json): { uri, errorId, title?, author?, exception?, terminatedProgram?, serverInstance?, datetime?, text, lineCount }. 'text' is the full ST22 report (error analysis, source extract, call stack). Examples:
|
| sap_list_inactiveA | List all inactive ABAP objects for the system (objects edited but not yet activated), with owner and transport. Use to find leftovers before activating or transporting. Args:
Returns (json): { count, objects: [{ uri, type, name, parentUri?, user?, deleted?, transport? }] }. Examples:
|
| sap_get_revisionsA | List the version history (revisions) of an ABAP object, or fetch the source of a specific old version. Args:
Returns (json): { objectType, objectName, versionsUri, count, revisions: [{ version, author?, updated?, contentUri }], version?, source?, lineCount? }. Examples:
|
| sap_get_transactionA | Read a transaction code's SE93 definition: started program/screen, transaction type (decoded from the CINFO bit field), short text, package, parameter/OO target, SM01 lock, and the SE93 authorization checks (TSTCA). Core tool for authorization audits. Args:
Returns (json): { tcode, exists, cinfo?, transactionType?, flags?, hasCheckObject?, lockedViaSM01?, reportWithVariant?, program?, screen?, description?, packageName?, author?, parameter?, targetClass?, targetMethod?, authChecks: [{TCODE, OBJCT, FIELD, VALUE}], authCheckCount }. transactionType is one of dialog | menu | parameter | report | object. Examples:
|
| sap_get_api_releaseA | Check whether an ABAP object is a released API and under which compatibility contract (C1 = cloud development / key-user apps). Reads the ADT apireleases resource. Objects of non-releasable types (e.g. programs) get a normal 'not releasable' answer. Supply either:
Args:
Returns (json): { objectUri, releasable, isAnyContractReleased?, contracts: [{contract, state, useInSAPCloudPlatform?, useInKeyUserApps?, changedBy?, changedAt?}], message? }. state is one of RELEASED, DEPRECATED, NOT_RELEASED, NOT_TO_BE_RELEASED, NOT_TO_BE_RELEASED_STABLE. Examples:
|
| sap_get_auth_objectA | Read an authorization object's definition (SU21) via ADT: description, object class, and fields. Use with sap_get_transaction (TSTCA rows) and sap_sql_query (USR12/AGR_1251) for authorization audits. Args:
Returns (json): { name, type, description?, objectClass?, objectClassDescription?, fields: [{name, description, ...}], activities?, activitiesError?, raw? }. Examples:
|
| sap_get_text_elementsA | Read a program's / class's / function group's text elements: text symbols (TEXT-nnn), selection texts (parameter/select-option labels), and list headings. Args:
Returns (json): { objectType, objectName, kinds: [{ kind, entries: [{id, text, maxLength?, ddicReference?}], raw, note? }] }. Symbol ids are the 3-character numbers behind TEXT-nnn; selection ids are parameter / select-option names; heading ids are listHeader and columnHeader_1..4. Examples:
|
| sap_read_feedA | List the ADT feeds available on this system (system messages, gateway error log, ATC verdicts, ...), or read one feed's entries. For short dumps prefer sap_list_dumps, which is purpose-built. Args:
Returns (json), listing: { count, feeds: [{ title, href, description? }] }. Returns (json), reading: { feedPath, count, entries: [{ title?, author?, published?, updated?, summary?, categories, uri? }] }. Examples:
|
| sap_abap_docsA | Look up the system's own ABAP keyword documentation (F1 help, release-correct for this system) by keyword, reduced to readable text. Follow Args:
Returns (json): { query?, uri?, title?, text, truncatedAtMaxChars, links: [{title, uri}] }. Examples:
|
| sap_set_text_elementsA | Write a program's / class's / function group's text elements: text symbols (TEXT-nnn), selection texts (parameter/select-option labels), or list headings. Entries are MERGED over the existing ones by id — ids you omit are preserved. Args:
Returns (json): { objectType, objectName, kind, written, merged, transport?, activated, verified, notPersisted, message }. Every write is read back and compared: verified=true means the values are actually stored. notPersisted lists ids the server accepted but did not store. Examples:
|
| sap_run_reportA | EXECUTES an ABAP report (program) on the SAP system and returns its list output as text. This runs real code with real side effects — the report may post documents, change configuration, lock objects or run for minutes. It is not a preview and there is no dry run. The report runs synchronously (SUBMIT ... EXPORTING LIST TO MEMORY AND RETURN) inside the HTTP work process, so the output comes back in the same call, typically in under a second for a small report. Args:
Returns (json): { programName, exists, authorized, ok, output, rawOutput, lineCount, bytes, durationMs, truncated, message }. ok=false means the run did not happen or produced no usable result — ALWAYS read ok, never assume success. Examples:
|
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/appmaster3000/sap-abap-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server