get_csrf_token
Obtain a CSRF token and session cookie from the SAP system to enable authenticated POST, PUT, or DELETE requests to ADT or other SAP ICF services.
Instructions
Fetch a CSRF token and session cookie from the SAP system. Useful for making authenticated POST/PUT/DELETE requests to ADT or other SAP ICF services.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| system_id | No | SAP system ID (e.g. DEV). Omit to use default system. |
Implementation Reference
- src/mcp-server.ts:933-941 (registration)Tool registration in the ListToolsRequestSchema handler. Defines the 'get_csrf_token' tool with an input schema that only takes the optional system_id property.
{ name: "get_csrf_token", description: "Fetch a CSRF token and session cookie from the SAP system. Useful for making authenticated POST/PUT/DELETE requests to ADT or other SAP ICF services.", inputSchema: { type: "object" as const, properties: { ...SYSTEM_ID_PROP }, required: [], }, }, - src/mcp-server.ts:1514-1518 (handler)Handler in the CallToolRequestSchema switch statement. Calls client.getCsrfToken() and returns the token and session cookie as text.
case "get_csrf_token": { const { token, cookies } = await client.getCsrfToken(); const text = `CSRF Token: ${token}\nSession Cookie: ${cookies}`; return { content: [{ type: "text", text }] }; } - src/adt-client.ts:628-631 (handler)Actual implementation in AdtClient. Calls the private fetchCsrfToken() method to perform an HTTP GET to /sap/bc/adt/discovery with X-CSRF-Token: Fetch header, then returns the stored token and cookie string.
async getCsrfToken(): Promise<{ token: string; cookies: string }> { await this.fetchCsrfToken(); return { token: this.csrfToken!, cookies: this.getCookieString() }; } - src/adt-client.ts:1575-1582 (helper)Private helper method that fetches a CSRF token from the SAP ADT discovery endpoint. Stores it in this.csrfToken for later use. Also collects cookies via the axios response interceptor (lines 22-34).
private async fetchCsrfToken(): Promise<void> { const response = await this.http.get("/sap/bc/adt/discovery", { headers: { "X-CSRF-Token": "Fetch", Accept: "*/*" }, }); const token = response.headers["x-csrf-token"]; if (!token) throw new Error("Failed to fetch CSRF token"); this.csrfToken = token; } - src/adt-client.ts:37-39 (helper)Helper that builds a cookie string from the internal cookieJar, used to return session cookies alongside the CSRF token.
private getCookieString(): string { return Object.entries(this.cookieJar).map(([k, v]) => `${k}=${v}`).join("; "); }