An MCP server that gives AI agents secure, policy-controlled access to SAP ABAP systems (ECC 6.0/NW 7.50+ and S/4HANA): 45 tools, 9 groups and 3 guided flows, read-only on QAS/PRD and human-confirmed writes only in development.
Code review and transports — diff what a transport really changed, its contents/tasks/objects, your transports, objects that usually travel together, inactive objects, and a pre-edit check of which transport the change will land in.
Quality and remediation — run ATC on an object or transport, get SAP's proposed quick fixes, API release state, SAP note (SNOTE) status, SAP's real syntax check (even on unsaved code) and ABAP Unit results.
Repository exploration — search objects, read source of any object type, where-used, version history, package contents, DDIC type info, DDIC/OData preparation for NW 7.50, transaction info, function modules, text elements, BAdIs/enhancements, plus local abaplint analysis (structure, dependencies, unused methods).
Data queries — read-only ABAP SQL SELECT, table contents, row counts, table search and foreign keys, with security/HR tables blocked, personal data masked and row caps on production-data systems; temporary, human-confirmed elevate_access is audited.
Incident diagnosis — dumps (ST22), background jobs (SM37), application log (SLG1), Gateway errors, SAT/ST05 traces, system messages and message diagnosis in one conversation.
Read-only debugging — external breakpoints, attach/wait, inspect variables, step and stop, only on development systems.
SAP documentation — local search of official ABAP docs, Clean ABAP, cheat sheets and DSAG guide; per-release ABAP feature matrix; Clean Core released-objects catalog; local abaplint; SAP Community search.
Controlled writes (authorized DEV only) — create objects, write/edit/push sources, change DDIC properties, revert versions, change package, activate, text elements, and create/add tasks/release transports, always with preview, syntax check, diff and human confirmation.
DoZimple Transport Risk (proprietary module) — release risk analysis, import health, failure ranking, change audit evidence, remote source and transport-vs-target drift.
Guided flows — revisar_pase, remediar_atc, diagnosticar_ticket chain tools with senior-consultant rules.
Operations — the exposed sap_systems tool reports configured systems, roles, modules and connectivity; plus gap recording, gap closure and usage statistics.
Provides secure, verifiable access to SAP ABAP systems (ECC 6.0 / NW 7.50 and S/4HANA) via ADT over HTTPS. Exposes 45 tools across 9 groups for reviewing code and transport orders (diffs, contents, co-change analysis, inactive objects, edit preflight), running ATC checks and applying SAP-proposed quick fixes, checking API release state and syntax, running ABAP Unit tests, exploring the repository (search, source reading, where-used, versions, package contents, DDIC types, transactions, text elements), read-only ABAP SQL queries, incident diagnosis (dumps, job and application logs), looking up SAP documentation, and authorized writes into the correct transport order on development systems only. Also integrates with a DoZimple Transport Risk ICF service to assess whether a transport set is ready for QA or production.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@abap-adt-doZimple Run ATC on ZDEMO_REPORTE and explain the P1 findings"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
English · Español
AI that works on your SAP system with the rules of a senior consultant.
An MCP server by DoZimple that gives AI agents — Claude Code, Kiro or any MCP client — secure, verifiable access to SAP ABAP systems: review code and transport requests, run ATC and ABAP Unit, diagnose incidents, query the official documentation and, where authorized, save changes in the right transport after a human confirms them.
45 tools · 9 functional groups · 3 guided flows · ECC 6.0 (NW 7.50) and S/4HANA
Features · Full tool reference · Security · Threat model · Parity with other SAP MCPs · DoZimple Transport Risk · Credits · Contact
“What does transport DEVK900123 really change, and which objects usually travel with it but are missing?”
“Run ATC on ZDEMO_REPORT, explain the P1 findings with their SAP note and propose the fix SAP offers.”
“Can I use
CONDon this 7.50 system? If not, rewrite the method with compatible syntax and validate it against SAP.”“Last night's billing job failed: dumps, job log and application log, and tell me the probable cause.”
“Is this release of four transports ready for production? Explain it in business terms for the PMO.”
The agent picks the tools, chains them and answers with evidence. Every answer states which system it comes from, and a failure is never presented as an empty result or as success.
Related MCP server: abap-adt-mcp
Usual approach | abap-adt-doZimple | |
Systems | One per instance, no roles | Every system in the landscape, with a policy per role: DEV / QAS / PRD |
Writes | Saves wherever SAP decides, or cannot write at all | Development only, explicit transport, preview and human confirmation; stops on another transport's CTS lock |
Verification | abaplint or nothing | SAP's real syntax check, also on code not saved yet |
Parameters | A misspelled parameter is silently ignored and the call runs anyway | Unknown parameters are rejected with the list of accepted ones: a misspelled |
Results on failure | Empty lists or misleading “OK” | Typed error saying what could not be checked and why |
Releases | Hard-coded endpoints | Capabilities read from each system's ADT discovery |
IDE | Often requires the IDE open | Standalone server, no IDE |
Third parties | Dependencies mixed with credentials | Components isolated in their own process and filtered |
Data | Whatever the SAP user can read goes to the model | Security and HR tables blocked (also through views and CDS); personal data masked on production-data systems |
Group | What for | Tools |
Know what a transport really changes and what it may break, before releasing it. | 6 | |
Find, understand and fix findings with SAP's real syntax check and quick fixes. | 6 | |
Read and understand any ABAP object and its relations, on ECC and S/4HANA. | 17 | |
Query tables with ABAP SQL, read-only, with sensitive and personal data protected. | 8 | |
One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG. | 8 | |
See where a program stops and what its values are, without changing anything and only in development. | 5 | |
Answer from official documentation and check which syntax exists in each release. | 7 | |
Save changes only in development, in the right transport, previewed and confirmed by a human. | 12 | |
Decide whether a whole release can go to QA or production, with the why in business terms. | 7 | |
See what works on each system and decide the next tool with data. | 4 |
flowchart LR
subgraph Client["MCP client (Claude Code, Kiro…)"]
A[AI agent]
end
subgraph Srv["abap-adt-doZimple (stdio, no ports)"]
R["Registry and policy<br/>system · role · capability · module<br/>confirmation · audit"]
T["45 tools + 3 flows"]
K[("OS keychain")]
D["Docs component<br/>(isolated process)"]
end
subgraph SAP["SAP systems"]
DEV["DEV — read and, if authorized, write"]
QAS["QAS / PRD — read only"]
TR["DoZimple Transport Risk<br/>(SAP component)"]
end
A <-->|MCP| R --> T
T -->|ADT over HTTPS| DEV
T -->|ADT over HTTPS| QAS
T -->|ICF service| TR
T --> D
R -.credentials.-> K
D -.filtered queries.-> W[(SAP documentation)]Summary per group; each tool's details — parameters, types, defaults, requirements and credits — are in the full reference (in Spanish).
Know what a transport really changes and what it may break, before releasing it.
Tool | What it does | Access |
What a transport changed (code diff). Code review of a transport: for each source object (programs, includes, classes, interfaces, function modules, CDS) compares the version recorded with that transport against the previous one and shows a unified diff. | read | |
Transport contents. Header, tasks (owner and status) and objects of a transport request, read from E070/E07T/E071. | read | |
My transports. Transports of a user (by default the connection user): their own and those where they have a task, with tasks, status, target and objects; flags transports without a target and own tasks in someone else's transport. | read | |
What usually travels with this object? Looks at the transports that touched an object and counts which other objects travelled with it, most frequent first. | read | |
Inactive objects. Objects saved but not activated by the connection user, with their transport. | read | |
Before editing: which transport will it land in? Tells, BEFORE changing an object, which transport the change will end up in and why: CTS lock by another transport, local object ($TMP), repair (different original system), or free with your open transports. With the dz-transport-risk module it also compares the DEV source with QA and production (version drift). | read |
Find, understand and fix findings with SAP's real syntax check and quick fixes.
Tool | What it does | Access |
Run ATC. Runs the ABAP Test Cockpit on an object or a transport and lists numbered findings (priority, line, check, message) with SAP's P1/P2/P3 totals. | read | |
SAP-proposed fixes. The fixes SAP offers (the same as Ctrl+1 in Eclipse) for an ATC finding or a line: create text symbol, extract constant, etc. | read | |
Is this API released? What is its successor? Release state of an SAP object (class, function module/BAPI, table, CDS…) by contract C0–C4 and its released successor, read from the system itself. | read | |
SAP notes in the system (SNOTE). Whether a note is downloaded in this system, its implementation and processing status, version, component and title, per note or filtered by status/component; no SAP portal or S-user needed. | read | |
SAP syntax check. SAP's real syntax check (not abaplint), also on code not saved yet. | read | |
Run ABAP Unit. Runs the ABAP Unit tests of a class or program (harmless and short only) and returns the result per method, with each failure in detail. | executes (DEV) |
Read and understand any ABAP object and its relations, on ECC and S/4HANA.
Tool | What it does | Access |
Search ABAP objects. Searches repository objects by name (supports * wildcards). | read | |
Read ABAP source. Reads the source of any object: program, include, class (and its includes), interface, function module (without knowing its group), CDS, table/structure, etc. | read | |
An object's whole context in one call. Type, package, responsible, CTS lock and transport, source size, recent versions, usages, drift against QA/production (transport-risk module) and the last remembered ATC run; depth 0–2. Replaces the search_objects → get_source → edit_preflight → where_used → object_versions chain. | read | |
Where used. Where-used list of an object: who references it, with package and owner. | read | |
Search text in source code. Searches a text or regex in the source of a package (with subpackages), a transport or a list of objects, and returns object, include, line and the matching line; reaches what where-used misses (dynamic calls, literals, Z code outside the reference index). | read | |
Object versions. Version history of an object (date, author, transport). | read | |
Package contents. Objects of a development package grouped by type, with subpackages (TADIR/TDEVC, any release). | read | |
Data element, domain or table type. Definition of a DDIC type: data element (domain, type, length, texts), domain (type, length, fixed values, value table) or table type (line type, key). | read | |
Prepare dictionary objects (NW 7.50). Where ADT cannot create or change tables, structures, domains, data elements or table types: validates a specification of new objects and changes against the system and returns the instruction file a person runs in SE38 with the generator program. Read-only: it never modifies SAP. | read | |
OData model (EDMX) from the dictionary. Generates an OData V2 model file (entity types, sets, associations, navigation) from DDIC tables, structures or views, with real types, lengths, keys and labels, to import into an SEGW project on ECC / NW 7.50. Read-only; creating the project, generating classes and registering the service stay manual. | read | |
What a transaction runs. Program, screen and parameters of a transaction (TSTC/TSTCP), with its text. | read | |
Function modules of a group. Lists the function modules of a function group with their text and whether they are RFC or update modules; given a module, finds its group and siblings. Works with /XXX/ namespaces. | read | |
Text symbols and selection texts. Reads the text symbols (TEXT-001…), selection texts or headings of a program, class or function group. | read | |
Enhancements and BAdIs. Implementations of a BAdI (new and classic, active or not), source code enhancements implemented inside a program, class or function group (flagging those that overwrite standard code), or all enhancement implementations of a namespace by type. | read | |
Structure and references of an object (local analysis). Parses the source locally with abaplint: classes with methods and visibility, interfaces, forms, tables read, functions, classes and includes used, metrics and unused private methods. Nothing runs on SAP. | read | |
Package dependencies (local analysis). Dependency graph of a package or object list from their sources: tables, functions, classes and includes per object, internal vs external, most-used targets. | read | |
Unused methods (local analysis). Private or protected methods no statement of their own class calls, across the classes of a package or list; protected ones flagged separately. | read |
Query tables with ABAP SQL, read-only, with sensitive and personal data protected.
Tool | What it does | Access |
ABAP SQL query. Runs an ABAP SQL SELECT (WHERE, JOIN, ORDER BY, subqueries) through ADT data preview, with personal columns masked and row caps on production-data systems. | read | |
Table contents. Rows of a table, view or CDS, with optional columns and filter. | read | |
Count rows. Counts the rows of a table or view, with optional condition and grouping, without fetching data; same policy as sql_query. | read | |
Search tables by description. Finds tables, structures and views by a word in their description or name; metadata only. | read | |
Foreign keys of a table. Check tables a table uses and tables that use it as check table, field by field, with the JOIN condition ready for sql_query. | read | |
Elevate access to a data category. Temporary, human-confirmed access on one system to a protected category (security and roles, HCM master data, payroll, personal data in clear); expires by itself; every use is audited. SECRETOS is never elevated. | read | |
Active elevations. Which data categories are elevated now, with reason and minutes left. | read | |
Revoke an elevation. Closes an elevation early; audited. | read |
One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG.
Tool | What it does | Access |
Dumps (ST22). Lists runtime dumps: date, error, program, user and short text. | read | |
Diagnose a message. From a screen message (class and number, or the text as copied) to its texts, placeholders and the objects that raise it (ADT where-used). | read | |
Background jobs (SM37). Background jobs by name (supports *), user, status and date, with their steps (program and variant). | read | |
Application log (SLG1) headers. Application log headers (BALHDR) by object/subobject, external number, user and date, with error and warning counts. | read | |
SAP Gateway errors (/IWFND/ERROR_LOG). Lists SAP Gateway (OData) errors: service, error, user, date. | read | |
ABAP traces (SAT). Recorded ABAP performance traces of a user: ABAP, system and database times; per trace, the hit list, the database accesses or the statements. Read-only: never activates or deletes traces. | read | |
SQL traces (ST05). Directory and state of the ST05 traces exposed by ADT (S/4HANA, NW ≥ 7.51). Read-only. | read | |
System messages (SM02). Current or all system messages (text, client, server, validity, creator) from TEMSI/TEMSG. | read |
See where a program stops and what its values are, without changing anything and only in development.
Tool | What it does | Access |
External breakpoints (debugger). Sets or clears external breakpoints for the connection user (object and line); only on development systems with test data, with confirmation. | executes (DEV) | |
Wait and attach to the debugger. Listens up to a timeout for a program of the connection user to stop at an external breakpoint, attaches and returns the stack and the variables of the current frame. Read-only; personal variables masked on masked-data systems; disabled with production data. | executes (DEV) | |
Debugger variables. With an attached session: values by name, components of a structure or table by id, and the stack. | executes (DEV) | |
Debugger step. Into, over, return or continue; returns the stack and variables afterwards; closes the session when the program ends. | executes (DEV) | |
Close the debug session. Releases or terminates the debuggee, removes the listener and closes the session. | executes (DEV) |
Answer from official documentation and check which syntax exists in each release.
Tool | What it does | Access |
Since which release does this syntax exist? Availability of each ABAP language feature per release (7.40 … 7.58, 2025). | local | |
Search ABAP documentation. Searches the official ABAP keyword documentation (standard and cloud), Clean ABAP, the DSAG guide, ABAP cheat sheets and RAP samples, locally. | local | |
Read a documentation page. Returns the full content of a document by the id docs_search gives. | local | |
Released objects catalog (Clean Core). Searches SAP's public catalog (abap-atc-cr-cv-s4hc, local) for released/deprecated objects by name or topic, with Clean Core level (A released … D all) and successors. | local | |
Clean Core state of an SAP object. Release state, Clean Core level and successor of an SAP object according to the public catalog (local). | local | |
abaplint on a snippet. Runs abaplint locally (code never leaves the machine) on an ABAP snippet or source. | local | |
Search SAP Community. Searches SAP Community (blogs and questions) by error message, class or concept. | local |
Save changes only in development, in the right transport, previewed and confirmed by a human.
Tool | What it does | Access |
Create ABAP object. Creates a new program, include, class, interface, function group, function module, CDS view or access control and, on S/4 or NW ≥ 7.51, dictionary objects (table, structure, table type, data element, domain) and RAP objects (metadata extension, service definition, OData V2 binding, behavior definition) in a development system: explicit package and transport (never chosen by the server), master language of the system, optional initial source or properties checked before saving, preview and human confirmation. | writes (authorized DEV) | |
Save source to SAP. Replaces the FULL source of an existing object (or class include) in the given transport, after a preview with syntax check and diff and a human confirmation. | writes (authorized DEV) | |
Edit a fragment of the source. Replaces specific fragments of an existing object's source without resending it whole (exact current text → new text), through the same preview, syntax check, diff, fingerprint, lock and transport as write_source. | writes (authorized DEV) | |
Save several sources in one operation. Full sources of up to 20 existing objects (class includes included) in the same transport, with one consolidated preview (syntax and diff per object), one confirmation and a joint activation; failures reported per object. | writes (authorized DEV) | |
Write domain or data element properties. Changes the properties of an existing domain (type, length, output, fixed values) or data element (domain or predefined type, labels, search help) through ADT on S/4 or NW ≥ 7.51, with a property diff preview, confirmation, explicit transport and activation. | writes (authorized DEV) | |
Revert to an earlier version. Writes back an earlier version of an object (the last active one, the one before it, or a numbered one from object_versions) through the same preview, fingerprint, lock and transport as write_source; never reverts on its own. | writes (authorized DEV) | |
Change an object's package. Moves an existing object to another package and records it in the given transport (typically out of $TMP), like Eclipse's “Change Package Assignment”; the preview includes SAP's own validation and nothing is changed until confirmed. | writes (authorized DEV) | |
Activate objects. Activates one object, a list, or all inactive objects of the connection user (optionally of one transport) together in a single SAP activation, which resolves mutual dependencies; never activates pending deletions. | writes (authorized DEV) | |
Create or change text symbols. Adds or changes text symbols (or selection texts) of a program/class/group, merging with the existing ones: nothing not mentioned is deleted. | writes (authorized DEV) | |
Create transport request. Creates a workbench request for an object's package BEFORE the first edit, so the change lands in the ticket's transport and not in a reused task. | writes (authorized DEV) | |
Add task to a transport. Adds a task for a user (by default the connection user) to an open transport request, like “Add user” in SE09; warns if that user already has an open task there. Releases nothing. | writes (authorized DEV) | |
Release task or transport. Releases a task or request (workbench, customizing or transport of copies) of the connection user, only on request: the preview shows what is released, its tasks and target queue, and what blocks it (unreleased tasks, someone else's request, CTS locks held by another request). Never ignores locks or the release ATC, and imports nothing. | writes (authorized DEV) |
Decide whether a whole release can go to QA or production, with the why in business terms.
Tool | What it does | Access |
Transport risk. Tells whether a transport (or a release of several, comma-separated) is safe to move to QA or production: unreleased tasks, import status, dependencies that don't travel, positional access, CTS locks, import queue. | read | |
Import health. Health of the imports into a target (QA or production): answers “how are the releases to production going?”. | read | |
Objects that fail most on import. Ranking of objects by import failure history in a target. | read | |
Change audit evidence. Evidence for a change management audit on a target: what went in, with which ticket, initiative and origin. | read | |
Transport history of an object. Which transports touched an object, when, and which already reached the target. | read | |
Source on the target. The source of an object AS IT IS in QA or production, read through TMS (like “Retrieve remote versions”). | read | |
Transport code against the target. Compares the code of a transport's objects with the target: objects missing there (R3.4) and version drift — signatures, fields or parameters that differ and don't travel in the transport (R3.5). | read |
See what works on each system and decide the next tool with data.
Tool | What it does | Access |
SAP systems and available tools. Lists the configured systems (role, writes, data class, modules) and, optionally, checks connectivity and which tools work on each. | local | |
Record a missing tool. Records a need no tool covers (e.g. something you had to do manually in a transaction), to decide what to build next. | local | |
Close a recorded gap. Marks a gap recorded with report_gap as resolved, with a note (a tool now covers it, or the note turned out to be wrong); nothing is deleted. | local | |
Tool usage and gaps. Summary of the local log: calls per tool, failure rate and type, systems, and the gaps recorded with report_gap. | local |
They show up as commands in the MCP client (in Claude Code: /mcp__abap-adt-doZimple__<name>) and chain the tools
with the working rules of a senior consultant.
Flow | What it does | Chain |
| Full review of a transport: code, missing companions, locks and, with the risk module, its analysis. | transport_contents → transport_diff → inactive_objects → co_change + edit_preflight → analyze_transport_risk (if module) → three-layer report: business, consultant, Basis |
| ATC → documentation and SAP note → released successor → fix → syntax → save in the transport. | edit_preflight → run_atc (BEFORE) → explain + api_release_state + where_used/object_versions → CHANGE/INVESTIGATE/KEEP classification → atc_quickfix → syntax_check → write_source in the transport (with human OK) → run_atc (AFTER) and P1 reduction |
| Dumps, jobs, application log and Gateway errors around an incident. | dumps → jobs → application_log → gateway_errors → transaction_info / get_source / object_versions / transport_contents → probable cause with evidence and what could not be checked |
The most valuable module for operations: before releasing, it tells whether a transport or a whole release can go to QA or production, and why not, in three layers — a business verdict for the PMO, what to review for the consultant, and release actions for Basis.
Whole releases, not single transports: what travels in one transport covers the others; it computes the import sequence and detects mutual dependencies and collisions between transports.
What breaks silently: positional access to structures that change, code and dictionary dependencies that don't travel and don't exist on the target, version drift.
The real state of the landscape: target import queue, CTS locks, transports of copies that drag other people's changes, import health and the objects that fail most.
Evidence for change management audits.
It works on any ABAP stack with CTS (ECC and S/4HANA) and is read-only on every system. It requires a proprietary DoZimple SAP component (ICF service in development and read-only RFCs on the targets), which is not distributed in this repository.
Want it in your landscape? → dozimple.cl
Designed to pass a Security and Basis review without exceptions. Details: SECURITY.md and the threat model (STRIDE and OWASP Top 10 for LLM applications).
No network surface: stdio only; no ports are opened.
Credentials in the OS keychain (macOS Keychain or Linux Secret Service), never in files, logs or responses.
Policy per role: QA and production are never written; development only with explicit authorization.
core tool profile (default): at startup only the everyday tools are published (find, read, query, check,
save and load_tools); the rest stay registered but disabled and are loaded per catalog group with
load_tools(groups), which notifies the client with tools/list_changed. Fewer tokens per conversation and less
tool confusion. "tools": { "profile": "expert" } or ABAP_DZ_PROFILE=expert publishes everything at startup. The
only/except filter overrides the profile: what it excludes cannot be loaded.
Selective tool exposure: "tools": { "only": [...], "except": [...] } in systems.json, or ABAP_DZ_TOOLS
(comma-separated) in a project's MCP client configuration. Entries are tool names, catalog groups (exploracion,
escritura…) or access kinds (read, write, exec). The environment never widens what the configuration allows;
an unpublished tool does not exist for the client. A typo is reported at startup.
Strict parameters: an unknown or misspelled parameter is an error listing the accepted ones, never silently ignored.
No write without human confirmation: a preview with SAP's syntax check and the real diff, confirmed through MCP elicitation or a single-use token bound to those exact arguments.
Hash-chained audit log of every write and execution, and of every business-data read (data_read: tables,
masked columns, row count; never the values), fail-closed (no log, no write and no result), verifiable with
npm run audit:verify.
Data categories with elevated access: security and roles, HCM master data, payroll and personal data in clear
are read only under a temporary elevation the person confirms (elevate_access: system, category, minutes,
reason), allowed per system in the configuration; every grant, use and revocation is an elevation_* audit event.
SAP credential material blocked in SQL queries, also through views and CDS, even if the SAP user is authorized. Validated against a real S/4HANA 2023 system, where standard views and CDS read USR02 without naming it.
Personal data masked and row caps on systems with production data.
Free SQL parsed, not pattern-matched: FROM, JOIN, subqueries and CTEs are resolved to base tables; a query
whose sources cannot be determined (host variables, dynamic sources) is rejected. On production-data systems
sql_query and table_contents read in two steps: preview of tables and cap, then human confirmation, like a write.
No customer data to the internet: online documentation search is off by default and, when enabled, every query with objects, transports, systems, users or customer names is blocked.
Third parties isolated in their own process with a minimal environment.
Controlled supply chain: 4 production dependencies pinned to exact versions, no install scripts, verified registry signatures, CycloneDX SBOM, audit and secret scanning on every commit and in CI.
SAP | ECC 6.0 / NetWeaver 7.50 and later, and S/4HANA on-premise or private cloud, through ADT ( |
MCP clients | Claude Code, Kiro and any MCP client over stdio |
Platform | Node.js 22+. Credentials in the macOS Keychain, the Linux Secret Service or environment variables |
npm install -g --ignore-scripts @dozimple/abap-adt@2.2.0
abap-adt-dozimple init --client claude-code # or claude-desktop · kiro · cursor · vscodeinit asks for the system (id, URL, client, user, role), writes ~/.config/abap-adt-dozimple/systems.json with
600 permissions, stores the password in the OS secret store (the store itself prompts; nothing is written to a
file) and registers the server in the chosen client without touching its other entries. --dry-run shows what it
would do; --force replaces an existing system or entry; init --help lists every flag. Step by step, the same
thing is:
Pinned to an exact version, without install scripts, like the project's own dependencies:
npm install -g --ignore-scripts @dozimple/abap-adt@2.2.0
PKG="$(npm root -g)/@dozimple/abap-adt"
mkdir -p ~/.config/abap-adt-dozimple && chmod 700 ~/.config/abap-adt-dozimple
cp "$PKG/config/systems.example.json" ~/.config/abap-adt-dozimple/systems.json # systems, roles and permissions
chmod 600 ~/.config/abap-adt-dozimple/systems.json
sh "$PKG/scripts/set-password.sh" MY_DEV # prompts; stored in the keychain
node "$PKG/dist/scripts/smoke.js" MY_DEV # read-only validationMCP client registration:
{ "mcpServers": { "abap-adt-doZimple": { "command": "abap-adt-dozimple" } } }Every release is published from CI with npm provenance:
npm view @dozimple/abap-adt@2.2.0 dist.attestations shows the attestation, and the GitHub release carries the
tarball, its Sigstore bundle (.sigstore.json), the same bundle as in-toto provenance (.intoto.jsonl) and the
SBOM. To check it: gh attestation verify dozimple-abap-adt-2.2.0.tgz --repo <owner>/abap-adt-dozimple.
abap-adt-dozimple serve --host 127.0.0.1 --port 2235 # behind a TLS reverse proxy
abap-adt-dozimple serve --host 0.0.0.0 --cert srv.pem --key srv.key # or with its own TLSStreamable HTTP endpoint (/mcp). Every request carries the SAP identity of the person using it
(Authorization: Basic user:password), and the server talks to SAP as that person: their user in connections,
locks, transports and the audit log. Passwords live only in memory while the session lasts and are never written
to disk; the server refuses to listen outside loopback without TLS. Sessions are capped and expire after
inactivity (--max-sessions, --idle-minutes, or ABAP_DZ_HTTP_* variables). Client registration:
{ "mcpServers": { "abap-adt-doZimple": { "type": "http", "url": "https://sap-mcp.example/mcp", "headers": { "Authorization": "Basic <base64 user:password>" } } } }npm ci && npm run build
mkdir -p ~/.config/abap-adt-dozimple
cp config/systems.example.json ~/.config/abap-adt-dozimple/systems.json # systems, roles and permissions (chmod 600)
scripts/set-password.sh MY_DEV # prompts for the password; stored in the keychain
npm run smoke -- MY_DEV # read-only validationMCP client registration:
{ "mcpServers": { "abap-adt-doZimple": { "command": "node", "args": ["/path/to/abap-adt-doZimple/dist/index.js"] } } }SAP documentation group (optional): install mcp-sap-docs
(Apache-2.0, abap variant) in a separate folder and declare how to start it in sidecars.docs of systems.json
(see config/systems.example.json). It runs as an isolated process; online search stays off unless allowOnline.
See CONTRIBUTING.md. To contribute or extend: git config core.hooksPath .githooks (secret and customer-data scanner before every commit)
and the nueva-tool guide — adding a tool means adding one file. Code comments
and tool descriptions are in Spanish; contributions in English are welcome.
abap-adt-doZimple is built on other people's work, and says so: each tool lists its credits in the reference. Dependency: its code is used. Data: third-party content that is queried. Idea: a design studied and reimplemented without copying code. Algorithm: a published method.
Project | Author / holder | License | Type | Used in |
Marcello Urbani | MIT | dependency | all (core), | |
Model Context Protocol | MIT | dependency | all (core) | |
Marian Zeis (marianfoo) | Apache-2.0 | dependency |
| |
Lars Hvam and contributors | MIT | dependency |
| |
Colin McDonnell and contributors | MIT | dependency | all (core) | |
SAP SE | © SAP SE | data |
| |
SAP (SAP-samples) | Apache-2.0 | data |
| |
SAP | per repository | data |
| |
DSAG e.V. | per repository | data |
| |
Software-Heroes | © Software-Heroes | data |
| |
Released objects / Cloudification Repository (abap-atc-cr-cv-s4hc) | SAP | Apache-2.0 | data |
|
SAP SE and community authors | SAP terms | data |
| |
Marcello Urbani | MIT | idea |
| |
mario-andreschak | MIT | idea |
| |
arc-mcp (Marian Zeis and contributors) | MIT | idea |
| |
oisee and contributors | MIT | idea |
| |
Crimson Consulting SL (NicoHern) | MIT | idea |
| |
AWS Solutions Library Samples | MIT-0 | idea | all (core), | |
Eugene W. Myers | published algorithm | algorithm |
|
Full dependency licenses: THIRD_PARTY_NOTICES.md. If you are the author of one of these projects and want to adjust how you are credited, reach us at dozimple.cl.
Tell us where and what for: open a short "I'm using it" issue (country, SAP release, MCP client, kind of use; no company or system names needed). npm and GitHub only give us anonymous counters, and what you tell us is what decides the next tools.
DoZimple — technology that connects operations, data and innovation. SAP consulting and development (ABAP, CDS, OData, RAP, Fiori), integration and SAP BTP, software and portals connected to the ERP, and applied artificial intelligence over controlled sources, with reproducible answers and human review.
This MCP server is an example of how we work: useful AI, with control, traceability and security by design. Let's talk → dozimple.cl
Apache-2.0 — © 2026 DoZimple. See also NOTICE. The DoZimple Transport Risk SAP component is proprietary and not part of this repository. SAP, ABAP and S/4HANA are trademarks of SAP SE; this project is not affiliated with SAP SE.
About the ADT protocol. The server uses the REST protocol of ABAP Development Tools, the same one Eclipse ADT uses. It is not a released SAP API (no stability contract, no SAP support for third-party clients), so the server checks each system's ADT discovery and reports what is missing instead of assuming it. It is meant to be used like an IDE: each person with their own named SAP user and developer license, never a shared technical user. Review how your SAP agreement treats developer tools and indirect access before rolling it out. Details in NOTICE.
Estado de la configuración de sistemas SAP.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 1 tool
With only a single tool there is no possibility of overlap or misselection, so ambiguity between tools is zero. However, the tool's own purpose ('Estado de la configuración de sistemas SAP') is vague and does not clearly state what action it performs or returns.
The single name 'sap_systems' uses a clean snake_case convention, but it is a bare noun phrase with no verb, so no predictable verb_noun pattern exists to evaluate. With one tool, consistency is neither violated nor demonstrated.
A single tool is far too thin for a server named 'abap-adt-doZimple', which implies ABAP ADT development operations such as reading, editing, activating, and transporting objects. One config-status tool cannot cover that scope.
The surface is severely incomplete: an ABAP/ADT server would need tools for object retrieval, source editing, activation, transports, and system listing, yet only one status-report tool is exposed. Agents would hit immediate dead ends for any real development workflow.
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
Give AI agents 30,000+ safe, token-optimized actions across Workday, SAP, Oracle + hundreds more.
Security reviews for coding agents: diffs checked against your org policy and live infrastructure.
Governed access to sensitive data, secrets and APIs for AI agents. A signed proof for each decision.
