# ARC-1 — SAP ADT MCP Server

**ARC-1** (pronounced _arc one_ [ɑːrk wʌn]) — Enterprise-ready MCP server for SAP ABAP systems. Secure by default, deployable to BTP or on-premise, and hardened with large unit/integration/E2E test coverage.

ARC-1 connects AI assistants (Claude, GitHub Copilot, Copilot Studio, and any MCP client) to SAP systems via the [ADT REST API](https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide/about-abap-development-tools). It ships as an [npm package](https://www.npmjs.com/package/arc-1) and [Docker image](https://github.com/arc-mcp/arc-1/pkgs/container/arc-1).

[![Test](https://github.com/arc-mcp/arc-1/actions/workflows/test.yml/badge.svg)](https://github.com/arc-mcp/arc-1/actions/workflows/test.yml)
[![CodeQL](https://github.com/arc-mcp/arc-1/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/arc-mcp/arc-1/security/code-scanning)
[![Dependency Review](https://github.com/arc-mcp/arc-1/actions/workflows/dependency-review.yml/badge.svg)](https://github.com/arc-mcp/arc-1/actions/workflows/dependency-review.yml)

**[Full Documentation](https://docs.arc-1-mcp.com/)** | **[Quickstart](https://docs.arc-1-mcp.com/quickstart/)** | **[Security Review](https://docs.arc-1-mcp.com/security/)** | **[Tool Reference](https://docs.arc-1-mcp.com/tools/)** | **[ARC-1 Updates](https://docs.arc-1-mcp.com/newsletter/)** | **[Blog Series](https://blog.zeis.de/tags/ai-abap-development-series/)**

> 📬 **Stay current with ARC-1** — get major releases, upgrade and security notes, practical guides, and occasional questions where your feedback can shape what comes next. **[Join ARC-1 Updates →](https://docs.arc-1-mcp.com/newsletter/)**

> 📖 **New: AI ABAP Development blog series** — long-form posts on AI for ABAP, ARC-1 design, and real-world BTP / Copilot Studio / Joule walkthroughs. **[Read the series →](https://blog.zeis.de/tags/ai-abap-development-series/)**

## Why ARC-1?

Built for organizations that need AI-assisted SAP development with guardrails. Inspired by the pioneering work of [abap-adt-api](https://github.com/marcellourbani/abap-adt-api), [mcp-abap-adt](https://github.com/mario-andreschak/mcp-abap-adt), and [vibing-steampunk](https://github.com/oisee/vibing-steampunk) — ARC-1 adds what's needed to run in production:

### Security & Admin Controls

- **Safe by default** — read-only, no free SQL, no table preview, no transport writes, no Git writes. Enable each capability with explicit `SAP_ALLOW_*` flags
- **Action deny list** — block specific tool actions with `SAP_DENY_ACTIONS` (for example `SAPWrite.delete`), without exposing low-level operation codes to admins
- **Package restrictions** — limit AI write operations (create, update, delete) to specific packages with wildcards (`--allowed-packages "Z*,$TMP"`). Read operations are not restricted by package — use SAP's native authorization for read-level access control
- **Data access control (off by default)** — table previews, saved SAPscript texts and SLG1 messages require `SAP_ALLOW_DATA_PREVIEW=true`; freestyle SQL separately requires `SAP_ALLOW_FREE_SQL=true`. Review enabled uses against the [SAP API Policy](docs_page/sap-api-policy-and-architecture.md), your SAP agreement, and internal data-governance rules.
- **Experimental data-source emergency brake** — approved data/SQL deployments can set `SAP_BLOCKED_DATA_SOURCES=USR02,PA0002`. ARC-1 then parses each SQL request and resolves active CDS plus replacement-object lineage before execution, denying direct or transitive exact-name matches and failing closed when lineage is unsupported or cannot be proven. The empty default adds no metadata calls. This denylist is defense in depth, not a production allowlist or replacement for SAP authorization/CDS DCL; see [Authorization & Roles](docs_page/authorization.md#experimental-data-source-blocklist).
- **Transport safety** — transport reads are available for review, while transport mutations require both `--allow-writes` and `--allow-transport-writes`. Update/delete operations auto-use the lock correction number when no explicit transport is provided
- **Git workflow safety** — Git operations are disabled by default. Enable explicitly with `--allow-git-writes` / `SAP_ALLOW_GIT_WRITES=true`
- **API-key profiles** — multi-key HTTP deployments can assign `viewer`, `viewer-data`, `viewer-sql`, `developer`, `developer-data`, `developer-sql`, or `admin` per key
- **Writes restricted to `$TMP` when enabled** — only local/throwaway objects; writing to transportable packages requires explicit `--allowed-packages`
- **HTTP security headers (helmet) on by default** — HSTS, CSP, X-Frame-Options, CORP, X-Content-Type-Options. COOP is deliberately not set so popup-based OAuth flows (Copilot Studio) keep working. No flag to disable.
- **Opt-in CORS for browser MCP clients** — `ARC1_ALLOWED_ORIGINS` (comma-separated, exact match). Off by default; native MCP clients don't need it
- **Layered rate limiting** — three layers out of the box: per-IP OAuth and shared MCP HTTP edge limits (Layer 1; MCP inherits the historical derived cap unless `ARC1_MCP_HTTP_RATE_LIMIT` overrides it), per-user MCP quota (Layer 2, **off by default** — multi-user deployments opt in via `ARC1_RATE_LIMIT=60`), and a server-wide SAP-bound semaphore (Layer 3, default 10, **on**). Honors `Retry-After` on 429/503 from SAP / BTP gateways. See the [Rate Limiting Guide](https://docs.arc-1-mcp.com/rate-limiting/)
- **Dependency and release evidence** — Dependabot, npm audit and Dependency Review checks, CodeQL, Trivy container scanning, npm provenance, and a best-effort CycloneDX SBOM for the release's production npm lockfile graph. [Section 13 of the security guide](https://docs.arc-1-mcp.com/security-guide/#13-dependency-supply-chain-security) lists what each artifact covers, how to verify it, and the gaps. Vulnerability response targets are [best-effort and non-contractual](SECURITY.md).

### Authentication

- **API key** — simple Bearer token for internal deployments
- **OIDC / JWT** — Entra ID, Keycloak, or any OpenID Connect provider
- **OAuth 2.0** — local browser-based login for BTP ABAP Environment service-key development
- **XSUAA** — SAP BTP native auth with automatic token proxy for MCP clients
- **Per-user SAP identity** — BTP Destination Service forwards the MCP user to SAP: Cloud Connector principal propagation for on-premise SAP, or `OAuth2UserTokenExchange` for BTP ABAP Environment

### BTP Cloud Foundry Deployment

Deploy ARC-1 as a Cloud Foundry app on SAP BTP with full platform integration:

- **Destination Service** — connect to SAP systems via managed destinations
- **Experimental multi-target mode** — the default-off BTP mode discovers
  destinations marked `arc1.enabled=true` and exposes pinned SID/client plus read-only aggregate endpoints;
  [scoped pinned PP writes](docs_page/multi-target-writes.md) require separate destination/IAM opt-ins
  ([setup](docs_page/multi-target-setup.md),
  [administration](docs_page/multi-target-administration.md))
- **Optional target filtering** — for shared multi-system gateways where teams need different target
  lists. [Assign systems/clients through XSUAA roles](docs_page/multi-target-authorization.md);
  IAS changes are optional. This filters IAM-assigned targets, not automatically discovered SAP accounts.
- **Cloud Connector** — reach on-premise systems through the connectivity proxy
- **Per-user destinations** — user identity forwarded end-to-end via X.509 certificates for on-premise SAP, or exchanged for an ABAP bearer token for BTP ABAP Environment
- **XSUAA OAuth proxy** — MCP clients authenticate via standard OAuth, ARC-1 handles the BTP token exchange
- **Audit logging** — structured events to stderr, file, or BTP Audit Log Service

### Token Efficiency

- **12 intent-based tools** instead of 200+ individual tools — keeps tool selection simple, with the schema payload guarded by CI budgets and a hyperfocused 1-tool mode for tight context windows
- **Method-level read/edit** — read or update a single class method, not the whole source (up to 20x fewer tokens)
- **Focused source and dependency context** — use targeted `SAPRead` for exact implementation behavior. For business purpose, reviews or test design, start with `SAPContext(action="deps", type=..., name=...)` for available Knowledge Transfer Documents (`SKTD`/`KTD`) and dependency contracts, then compare requirements with source. Without documented requirements, intent is unverified.

### Built-in Object Caching

- **Server-validated source caching** — every SAP object read is cached in memory (stdio) or SQLite (http-streamable). Repeated reads use `If-None-Match`/ETag conditional GET, so unchanged objects return from cache after SAP confirms `304 Not Modified`.
- **Dependency parsing reuse** — unchanged, authorized source can reuse parsed dependencies and contracts in memory. Aggregate dependency graphs are not cached; SAP authorization and source validation still apply.
- **KTD-aware context** — Knowledge Transfer Documents use the source cache and are revalidated when composed into `SAPContext(action="deps")`.
- **Live where-used** — `SAPContext(action="usages")` and CDS impact analysis query SAP's current repository index with the caller's identity; no startup repository scan is required.
- **Active/inactive source views** — `SAPRead` accepts `version="active" | "inactive" | "auto"` and warns when the active source has an unactivated draft.
- **Write invalidation** — when `SAPWrite` or `SAPActivate` mutates an object, both active and inactive source cache entries are dropped; next read revalidates or fetches fresh source.

See **[docs/caching.md](docs/caching.md)** for full documentation.

### Testing

- **3,474 unit tests** (`104` unit test files, mocked HTTP)
- **262-test default integration profile** against live SAP systems, with explicit skip reasons when credentials or fixtures are missing
- **141-test default E2E profile** that executes real MCP tool calls against a running ARC-1 server and live SAP system
- **Manual slow SAP profiles** keep broad where-used, RAP full-stack, and recursive CTS release coverage out of the PR path (`test:integration:slow`, `test:e2e:slow`, GitHub **SAP Slow Tests** workflow)
- **CRUD lifecycle and BTP smoke lanes** included (`test:integration:crud`, `test:integration:btp:smoke`)
- **CI matrix** on Node `22` and `24`; live SAP integration + E2E run on internal PRs and manual dispatch, with SAP jobs gated off for docs/chore PRs and external forks
- **Reliability telemetry + coverage** published as informational CI signals (non-blocking)

### Tools Refined for Real-World Usage

The 12 tools are designed from real LLM interaction feedback:

| Tool | What it does |
|------|-------------|
| **SAPRead** | Read exact ABAP source, method bodies, grep matches, table data, CDS views, access controls (`DCLS`), metadata extensions (`DDLX`), service bindings (`SRVB`), knowledge-transfer docs (`SKTD` or friendly alias `KTD`), message classes (`MSAG`), revision history (`VERSIONS`/`VERSION_SOURCE`), inactive object state, BOR objects, deployed UI5/Fiori apps (BSP, BSP_DEPLOY), and ABAP Platform 2025 server-driven objects (`DESD`, `EVTB`, `EVTO`, `DTSC`, `CSNM`, `COTA`). For "what does this object do?" use `SAPContext` first, then `SAPRead` for precise source. Enhancement implementations (`ENHO`) are readable on-prem and on BTP; authorization fields (`AUTH`) and feature toggles (`FEATURE_TOGGLE`) are on-prem only. Structured format for classes returns metadata + decomposed includes as JSON. Optional `grep` regex returns only matching source lines (+context, method-annotated for classes) for token-efficient search. (Deprecated aliases `MESSAGES`/`FTG2` accepted for one minor.) |
| **SAPSearch** | Object search + full-text source code search across the system |
| **SAPWrite** | Create/update/delete ABAP source and DDIC metadata with automatic lock/unlock (PROG, CLAS, INTF, FUNC, FUGR, INCL, DDLS, DCLS, DDLX, BDEF, SRVD, SRVB, SKTD/KTD, TABL, DOMA, DTEL, MSAG; availability adapts for BTP). Class updates can target local includes (`definitions`, `implementations`, `macros`, `testclasses`); class-section surgery (`edit_class_definition`, `add_method`, `edit_method_signature`, `delete_method`, `change_method_visibility`) lets an LLM edit a global class signature without re-sending `/source/main`; RAP behavior-pool scaffolding can auto-create `lhc_*` skeletons before injecting signatures/stubs. Batch creation supports terminal activation for interdependent multi-object workflows (e.g., RAP stack or domain+data element in one call) |
| **SAPActivate** | Activate ABAP objects — single or batch (essential for RAP stacks), with guarded retry for the S/4HANA ED064 batch quirk. Publish/unpublish OData service bindings (SRVB) |
| **SAPNavigate** | Go-to-definition, find references, code completion |
| **SAPQuery** | Read saved SAPscript long texts or execute ABAP SQL; each path requires its own opt-in |
| **SAPTransport** | CTS transport management (list/get/create/release/delete/reassign/release-recursive), transport layer/target lookup, package transport requirement checks, and reverse lookup history (`action="history"`) |
| **SAPGit** | Git-based ABAP workflows across gCTS and abapGit (list/clone/pull/push/commit/branch/unlink) with backend auto-selection and safety gating (`--allow-git-writes`) |
| **SAPContext** | Dependency APIs (`action="deps"`): optional KTD plus bounded source-derived contracts, not a complete relationship inventory. Also supports live where-used (`action="usages"`), CDS impact (`action="impact"`), and TABL includes/appends (`action="structure"`) |
| **SAPLint** | Local ABAP lint (system/release-aware presets, auto-fix, pre-write validation) + ADT PrettyPrint (server-side formatting) |
| **SAPDiagnose** | Syntax check, ABAP Unit tests, ATC code quality, CDS test-case suggestions, active/inactive object-state comparison, generic ADT quickfix proposals/application deltas, gateway/system message diagnostics, short dumps, profiler traces, and the on-prem authorization trace (`SUAUTHVALTRC`, data-preview gated) |
| **SAPManage** | Feature probing, cache statistics, package lifecycle/change-package operations, and FLP catalog/group/tile helpers |

Tool definitions automatically adapt to the target system (BTP vs on-premise), removing unavailable types and adjusting descriptions so the LLM never attempts unsupported operations.

### Feature Detection

ARC-1 probes the SAP system at startup and adapts its behavior:

- Detects HANA, gCTS, abapGit, RAP/CDS, AMDP, UI5, and transport availability
- Auto-detects BTP vs on-premise systems
- Maps SAP_BASIS release to the correct ABAP language version
- Each feature can be forced on/off or left on auto-detect
- In shared-credential mode (technical user), runs a startup auth preflight once and blocks SAP tool calls with a clear error on 401/403 to avoid repeated failed logins and potential user lockout

## ADT API Status and Strategy

For a custom MCP server such as ARC-1, SAP's
[Third-Party MCP Access reference architecture](https://architecture.learning.sap.com/docs/ref-arch/137800)
is the primary design and control baseline we recommend. For a shared service, start with BTP Cloud
Foundry, XSUAA and strict principal propagation. SAP's API Policy FAQ Q56 allows custom MCP servers
under conditions; Q32 confirms that Integration Suite is not mandatory.

**[SAP API Policy & Architecture Alignment](docs_page/sap-api-policy-and-architecture.md)** explains
that path, the controls ARC-1 already supports, and the remaining gaps. FAQ Q33 classifies ADT APIs
as internal and limits them to endorsed development channels; ARC-1's direct TypeScript ADT client
is not specifically identified as one. Clarify that channel and the intended AI-assisted development
use with SAP before adoption, including dev/test. BTP hosting and security controls alone do not
establish full policy adherence. Per-user SAP identity applies to PP; shared Basic modes retain a
shared SAP identity.

Two ARC-1 capabilities can expose business data or execute ad-hoc SQL. Both are **off by default** and require explicit opt-in env vars, so the operator makes a deliberate decision before they are reachable:

| Capability | Env var | Default | Policy note |
| ---------- | ------- | ------- | ----------- |
| Table previews (`SAPRead(type=TABLE_CONTENTS/TABLE_QUERY)`), [saved SAPscript texts](docs_page/tools.md#stored-sapscript-long-texts) and [SLG1 messages](docs_page/tools.md#saved-application-logs-actionapplication_log) (`SAPQuery` actions `long_text` / `application_log`) | `SAP_ALLOW_DATA_PREVIEW=true` | `false` (off) | Reads application data; authenticated callers also need `data` scope. |
| Freestyle ABAP SQL (`SAPQuery(action=sql)`) | `SAP_ALLOW_FREE_SQL=true` | `false` (off) | Executes ad-hoc ABAP SQL; authenticated callers also need `sql` scope. |
| Exact source blocklist (experimental) | `SAP_BLOCKED_DATA_SOURCES=USR02,PA0002` | empty (off) | Denies exact direct/transitive table or CDS dependencies; active mode is deliberately fail-closed and slower. |

When either capability is enabled, successful data-preview bodies are limited cumulatively per tool
call (2 MiB by default), and only two data-result calls per process remain admitted through parsing
and serialization. `SAPQuery.maxRows` is separately clamped to 10,000, but wide rows can reach the
byte limit much earlier. See [Configuration](docs_page/configuration-reference.md) before tuning
`ARC1_MAX_DATAPREVIEW_RESPONSE_BYTES` or `ARC1_MAX_CONCURRENT_DATA_RESULTS`.

With both flags at their defaults, ARC-1's data/sql rows are unreachable. FAQ Q33 excludes application-table
reads, business-data export and backend SQL from ADT's intended development-tooling scope. Keep these
flags off unless the specific use has a documented allowance or SAP authorization under the applicable
agreements; internal approval or a technical opt-in alone is insufficient. Use Published business APIs
for business-data integration.

ARC-1 combines capability discovery with conservative defaults and centralized authorization. Discovery establishes technical availability, not API-policy permission. Follow the reference architecture and verify both the API-specific allowance and the deployed controls.

## Versioning & Stability

From `1.0` onward ARC-1 follows [semantic versioning](https://semver.org/): patch releases fix bugs, minor releases add backward-compatible capability, and breaking changes to the MCP tool surface, configuration, or auth contract bump the major version.

**Experimental, default-off features are excluded from this guarantee until they are promoted** — they are clearly labeled and their surface may still change in a minor release. Today this covers the [multi-target BTP mode](docs_page/multi-target-setup.md) (ADR-0006 / ADR-0007) and the [data-source blocklist](docs_page/authorization.md#experimental-data-source-blocklist).

What changed per release: the annotated [Release Notes](https://docs.arc-1-mcp.com/release-notes/) give each release its impact and upgrade action; [CHANGELOG.md](CHANGELOG.md) lists every merged PR.

## Quick Start

**Install as an Agent Plugin** — one portable install for the MCP server and all bundled SAP skills in
GitHub Copilot, VS Code, Cursor, Codex, and other compatible clients:

```bash
copilot plugin marketplace add arc-mcp/arc-1
copilot plugin install arc-1@arc-1
```

Agent Plugins 1.0 does not define secret prompts, so create the ARC-1 `.env` in the installed
plugin's persistent data directory before connecting to SAP. See the
**[Agent Plugin guide](https://docs.arc-1-mcp.com/agent-plugin/)** for client-specific installation,
safe configuration, and verification.

**Install in Claude** — pick your surface (full guide: [Install in Claude](https://docs.arc-1-mcp.com/install-in-claude/)):

- **Claude Desktop** — download the latest `arc-1-*.mcpb` from [Releases](https://github.com/arc-mcp/arc-1/releases) and double-click it (or Settings → Extensions). Claude prompts for your SAP connection. (The `.mcpb` is attached to releases automatically; if the newest one doesn't have it yet, see [Install in Claude](https://docs.arc-1-mcp.com/install-in-claude/).)
- **Claude Code** — one install for the MCP server **and** all [SAP skills](https://github.com/arc-mcp/arc-1/tree/main/skills):

  ```text
  /plugin marketplace add arc-mcp/arc-1
  /plugin install arc-1@arc-1
  ```

- **Any MCP client / manual** — run it directly:

  ```bash
  npx arc-1@latest --url https://your-sap-host:44300 --user YOUR_USER
  ```

- **Trying it out on your laptop?** → [Quickstart](https://docs.arc-1-mcp.com/quickstart/)
- **Full local dev setup (Docker, cookie extractor, client configs)?** → [Local Development](https://docs.arc-1-mcp.com/local-development/)
- **Deploying for a team / BTP?** → [Deployment](https://docs.arc-1-mcp.com/deployment/)

## Blog Series — AI ABAP Development

A long-form series on [blog.zeis.de](https://blog.zeis.de/tags/ai-abap-development-series/) covering AI for ABAP development, ARC-1's design, and real-world walkthroughs:

1. [How I Use AI for Development and Why Context Matters](https://blog.zeis.de/posts/2026-04-20-how-i-use-ai/)
2. [ABAP and Agentic AI: The Hidden Problem in Real Projects](https://blog.zeis.de/posts/2026-04-22-ai-abap-development/)
3. [Introducing ARC-1: A Secure ADT MCP Server for Enterprise SAP Development](https://blog.zeis.de/posts/2026-04-27-arc-1/)
4. [ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the Laptop](https://blog.zeis.de/posts/2026-04-29-arc-1-btp/)
5. [ARC-1 with Copilot Studio: SAP System Context Beyond Developers](https://blog.zeis.de/posts/2026-05-05-arc-1-copilot-studio/)
6. [ARC-1 with Joule Studio: Bringing Real ABAP System Context into Joule](https://blog.zeis.de/posts/2026-05-08-arc-1-joule-studio-clean-core/)
7. [From SEGW and Legacy UI5 to RAP with ARC-1](https://blog.zeis.de/posts/2026-05-11-segw-to-rap/)

Full list and new posts → **[blog.zeis.de/tags/ai-abap-development-series](https://blog.zeis.de/tags/ai-abap-development-series/)**.

## Documentation

Full documentation is available at **[docs.arc-1-mcp.com](https://docs.arc-1-mcp.com/)**.

| Guide | Description |
|-------|-------------|
| [Quickstart](https://docs.arc-1-mcp.com/quickstart/) | 5-minute npx + Claude Desktop setup |
| [Agent Plugin](https://docs.arc-1-mcp.com/agent-plugin/) | Portable server + all skills for Copilot, VS Code, Cursor, Codex, and compatible clients |
| [Install in Claude](https://docs.arc-1-mcp.com/install-in-claude/) | Desktop `.mcpb`, Claude Code plugin (server + skills), and remote BTP connector |
| [Local Development](https://docs.arc-1-mcp.com/local-development/) | Full local dev — all install methods, MCP client configs, SSO cookie extractor |
| [Deployment](https://docs.arc-1-mcp.com/deployment/) | Multi-user deployment — Docker, BTP Cloud Foundry, BTP ABAP |
| [SAP BTP: Start Here](https://docs.arc-1-mcp.com/btp-overview/) | Choose the BTP topology and follow the correct deployment, auth, destination, and operations guides |
| [BTP Cloud Foundry](https://docs.arc-1-mcp.com/btp-cloud-foundry-deployment/) | MTA deployment, topology decision, role handoffs, and safe acceptance |
| [BTP Administration](https://docs.arc-1-mcp.com/btp-administration/) | Changes, roles, secrets, scaling, upgrades, rollback, and customer handover |
| [Multi-System Setup](https://docs.arc-1-mcp.com/multi-target-setup/) | BTP multi-target deployment, destinations, roles, and scoped pinned PP writes |
| [Configuration](https://docs.arc-1-mcp.com/configuration-reference/) | Every flag and env var, one table |
| [Updating](https://docs.arc-1-mcp.com/updating/) | Update procedures per install method |
| [Enterprise Auth](https://docs.arc-1-mcp.com/enterprise-auth/) | Layer A / Layer B auth internals, coexistence matrix |
| [Tool Reference](https://docs.arc-1-mcp.com/tools/) | Complete reference for all 12 tools |
| [Extensions (Custom Tools)](https://docs.arc-1-mcp.com/extensions/) | Add your own `Custom_*` tools without forking (FEAT-61) — reads, gated non-ADT writes, class/report execute |
| [Architecture](https://docs.arc-1-mcp.com/architecture/) | System architecture with diagrams |
| [AI Usage Patterns](https://docs.arc-1-mcp.com/mcp-usage/) | Agent workflow patterns and best practices |
| [Skills](https://docs.arc-1-mcp.com/skills/) | Reusable ARC-1 agent skills, including GitHub Copilot in Eclipse and VS Code ADT setup |
| [Blog Series](https://docs.arc-1-mcp.com/blog-series/) | Long-form posts on AI for ABAP development, ARC-1 internals, and real-world walkthroughs |

## Development

```bash
npm ci && npm run build && npm test
```

See [CLAUDE.md](CLAUDE.md) for codebase structure, testing commands, and contribution guidelines.

## Credits

| Project | Author | Contribution |
|---------|--------|--------------|
| [vibing-steampunk](https://github.com/oisee/vibing-steampunk) | oisee | Original Go MCP server — ARC-1's starting point |
| [abap-adt-api](https://github.com/marcellourbani/abap-adt-api) | Marcello Urbani | TypeScript ADT library, definitive API reference |
| [mcp-abap-adt](https://github.com/mario-andreschak/mcp-abap-adt) | Mario Andreschak | First MCP server for ABAP ADT |
| [abaplint](https://github.com/abaplint/abaplint) | Lars Hvam | ABAP parser/linter (used via @abaplint/core) |

## License

MIT