SAP Business One Order-to-Cash MCP Server
# SAP Business One Order-to-Cash MCP Server
This project exposes SAP Business One Service Layer operations as Model Context Protocol (MCP) tools, so an agent such as Claude can execute the full Order-to-Cash flow over stdio.
## What is included
- Node.js + TypeScript MCP server
- SAP Business One session-cookie authentication with automatic re-login on expiry
- 9 O2C tools covering quotation through collections
- `.env`-driven configuration
## Project structure
```text
sap-b1-mcp-server/
|- src/
| \- server.ts
|- dist/
|- .env
|- .env.example
|- package.json
|- tsconfig.json
\- README.md
```
## Tools
1. `create_sales_quotation`
2. `create_sales_order`
3. `check_atp`
4. `create_delivery`
5. `get_pick_list`
6. `confirm_delivery_pod`
7. `create_ar_invoice`
8. `apply_incoming_payment`
9. `get_collections_worklist`
## Environment
```env
SAP_B1_BASE_URL=https://your-sap-server:50000/b1s/v1
SAP_B1_COMPANY=SBODemoUS
SAP_B1_USER=manager
SAP_B1_PASSWORD=yourpassword
NODE_TLS_REJECT_UNAUTHORIZED=0
```
Set `NODE_TLS_REJECT_UNAUTHORIZED=0` only when your SAP Business One Service Layer is using a self-signed certificate.
## Install
```bash
npm install
```
## Build
```bash
npm run build
```
## Run
```bash
node dist/server.js
```
Expected startup log:
```text
SAP B1 MCP server running (stdio)
```
## Claude Desktop MCP config
```json
{
"mcpServers": {
"sap-b1-o2c": {
"command": "node",
"args": ["/absolute/path/to/dist/server.js"],
"env": {
"SAP_B1_BASE_URL": "https://your-server:50000/b1s/v1",
"SAP_B1_COMPANY": "SBODemoUS",
"SAP_B1_USER": "manager",
"SAP_B1_PASSWORD": "yourpassword"
}
}
}
}
```
## Notes
- The server connects to SAP Business One over the Service Layer REST API.
- Session cookies are renewed automatically when login expires.
- The invoice and payment tools are implemented as live posting operations, so it is a good idea to keep a human approval step in your agent workflow.
- Some organizations store carrier, POD, and approval metadata in user-defined fields. This scaffold stores those references in document comments by default to stay portable across SAP B1 tenants.
## Common issues
- `UNABLE_TO_VERIFY_LEAF_SIGNATURE`: set `NODE_TLS_REJECT_UNAUTHORIZED=0` for self-signed SAP certificates
- `SAP B1 login failed`: verify base URL, company DB, user, and password
- `ECONNREFUSED`: confirm the Service Layer is running and reachable
- `Cannot find module`: run `npm install` and `npm run build`
- MCP tools not showing up: verify the absolute path in your Claude MCP configTDQS
Scored across 65 tools
Multiple tool clusters have unclear boundaries: get_sales_analysis duplicates the fixed-dimension SMLSVC aggregators (get_top_customers, get_sales_by_period, get_warehouse_sales, etc.), four raw-query mechanisms (call_service_layer, query_sml_view, query_sql_direct, query_hana_direct) compete for the same 'fetch data' role, and five inventory tools (get_total_stock, check_atp, monitor_reorder_items, calc_reorder_point, predict_stockout) all answer 'do I need to reorder?'. Individual descriptions are clear, but an agent will frequently face several plausible tools for one question.
The set overwhelmingly follows a predictable snake_case verb_noun pattern (create_*, get_*, calc_*, detect_*, analyze_*, forecast_*), making the surface readable and routable. Minor deviations: create_po_from_quotation uses the 'po' abbreviation while its siblings use full 'purchase_order', and read operations mix get_, query_, list_, and call_ verbs.
At 65 tools this far exceeds the 16-25 'heavy' range, and the Order-to-Cash name describes only a fraction of the surface — the rest spans purchase-to-pay, inventory analytics, forecasting, financial reporting, and raw database access. While SAP B1 is a large system, an agent must navigate an enormous list where much of the analytics work could be consolidated behind fewer, more parameterized tools.
The forward document lifecycle is thoroughly covered for both sales (quotation→order→delivery→AR invoice→payment) and purchasing (request→RFQ→PO→GRPO→AP invoice→payment), with extensive read/query coverage. However, there are no update/cancel/close tools for documents, no credit-memo or returns creation, and reverse flow only exists as read-only query views — call_service_layer is the sole workaround for these gaps.