rfc-mcp
rfc-mcp
SAP の RFC 対応ファンクションモジュール(BAPI/RFC)を、ディスカバリファーストのインターフェースを通じて AI エージェントに公開する MCP サーバーです。SAP の pyrfc コネクタ上に構築されており、さらに ABAP ソースの自動読み取り(ADT が到達可能な場合は ADT、それ以外は透過的な RFC フォールバック)も行います。詳細は docs/adt_rfc_integration_plan.md を参照してください。
セットアップ
実際の SAP 呼び出しが機能するために必要な前提条件(SAP NW RFC SDK + Python 3.11)については docs/setup.md を、レイヤー概要(読み取り/書き込みポリシーモデル、汎用テーブルリーダーガード、監査ログを含む)については docs/architecture.md を参照してください。
前提条件がインストールされた後のクイックスタート:
uv sync --extra dev
copy .env.example .env # fill in connection + policy settings
uv run pytest # unit tests, fake pyrfc, no SAP needed
uv run mcp dev src/rfc_mcp/mcp/server.py実際の SAP 接続には、さらにプロプライエタリな SAP NW RFC SDK と、アーカイブ/削除された pyrfc==3.3.1 コネクタが必要です。uv sync --extra sap またはスモークテストを実行する前に、docs/setup.md のサポート警告とインストール手順をお読みください。
Related MCP server: SAP MCP Server
ツール
search_rfc_functions(pattern, group=None, limit=50)get_rfc_function_interface(function_name)call_rfc_function(function_name, parameters, mode="read"|"write", transaction_id=None)commit_rfc_transaction(transaction_id, wait=False)rollback_rfc_transaction(transaction_id)read_abap_source(object_type, object_name, function_group=None)— 単一のツールであり、呼び出し側にトランスポートの選択肢は公開されません。docs/architecture.md を参照してください。
ABAP ナレッジスキル
.claude/skills/sap-abap/ は、サードパーティの sap-abap Claude スキルを同梱しており、このサーバーを使用するエージェントは正確な ABAP 言語知識を手元に持つことができます。これはこのプロジェクトの他の部分とは別にライセンスされています(GPL-3.0、独自の LICENSE/NOTICE.md)— 以下を参照してください。
スコープ
基盤、接続レイヤー、ディスカバリ、実行、MCP 統合は構築・テスト済みです。これには、デフォルト拒否の読み取り/書き込みポリシー、汎用テーブルリーダーのインジェクション面(RFC_READ_TABLE など)に対するテーブルレベルのガード、およびすべてのポリシー決定と呼び出し結果の監査ログが含まれます。構築されていないもの: 単一のサーバー全体ポリシーを超えるマルチテナント認証/RBAC、レート制限、メトリクス/トレーシング、デプロイメントパッケージング — 意図的に延期されている内容とその理由については、docs/architecture.md の「Out of scope」セクションを参照してください。
書き込み呼び出しは不透明な transaction_id を返します。関連する書き込みにはそれを再利用し、コミットまたはロールバックに渡します。これにより、SAP LUW 全体が 1 つの RFC 接続に固定されます。放棄されたトランザクションは期限切れになり、自動的にロールバックされます。
セキュリティ体制
読み取りと書き込みは、そのファンクション名が明示的な許可リストに一致しない限り拒否されます。サンプル構成では、ディスカバリ、ソース読み取り、および無害な
STFC_CONNECTIONスモークテストのみが許可されています。MCP ツールの注釈は、対応するクライアントに対して読み取り/書き込みのリスクを説明しますが、これらは参考メタデータであり、認可境界ではありません。サーバーポリシーと SAP サービスアカウントの
S_RFC/テーブル認可は引き続き必須です。Stdio の資格情報は環境から取得され、MCP ツールの引数に配置されることはありません。MCP 認可仕様とデプロイメントレベルのレート制限を実装せずに、サーバーを HTTP 経由で公開しないでください。
報告とデプロイメントのガイダンスについては SECURITY.md を参照してください。
ライセンス
MIT(LICENSE を参照)ですが、1 つの例外があります。.claude/skills/sap-abap/ は GPL-3.0 の下でベンダー提供されるサードパーティコンテンツです — 独自の LICENSE と NOTICE.md を参照してください。そのディレクトリを含めても、プロジェクトの他の部分が GPL-3.0 になるわけではありません。
Available Tools
6 toolscall_rfc_functionADestructive
Invoke a SAP RFC-enabled function module with JSON parameters. Call get_rfc_function_interface first to know what parameters are required. mode='write' is required for functions classified as mutating and is rejected unless the server's policy explicitly allows writes for that function. A write returns a transaction_id tied to its SAP connection; reuse it for related writes, then pass it to commit_rfc_transaction or rollback_rfc_transaction. Writes are never auto-committed.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Your actual intent for this call: 'read' for non-mutating calls, 'write' if it changes SAP data. Checked against server policy. | read |
| parameters | Yes | IMPORT/TABLES/CHANGING parameter values, keyed by name as returned by get_rfc_function_interface. | |
| function_name | Yes | Exact name of the RFC-enabled function module to invoke. | |
| transaction_id | No | For write mode, reuse the opaque transaction_id returned by an earlier write to keep all calls in the same SAP LUW. Omit on the first write and for reads. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes | |
| function_name | Yes | |
| transaction_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, but the description adds substantial behavior beyond them: the policy gate that can reject write mode, the fact that a write returns a transaction_id tied to a SAP LUW, and that writes are never auto-committed. Missing only error/failure semantics or what happens on an invalid function name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, front-loaded with the core action and prerequisite, then the write-policy constraint, then the transaction lifecycle. No filler and no repetition of schema text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return-value explanation is not needed; the description otherwise covers invocation, prerequisite, permission gating, transaction grouping, and finalization path. An agent has everything required to call this correctly on a first attempt.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description compensates for the weakest documented field by explaining mode's policy-check behavior and transaction_id's reuse semantics across related writes. It goes beyond restating the schema by framing the LUW grouping model.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Starts with a specific verb+resource ('Invoke a SAP RFC-enabled function module with JSON parameters') and immediately distinguishes itself from siblings by naming get_rfc_function_interface, commit_rfc_transaction, and rollback_rfc_transaction. An agent can tell exactly what this tool does and how it fits in the lifecycle without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the prerequisite ('Call get_rfc_function_interface first'), the condition for write mode ('required for functions classified as mutating... rejected unless the server's policy explicitly allows writes'), and the follow-up routing ('pass it to commit_rfc_transaction or rollback_rfc_transaction'). When-to-use and when-not is fully covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
commit_rfc_transactionADestructive
Persist changes staged by prior write call_rfc_function calls in the identified SAP transaction (BAPI_TRANSACTION_COMMIT). Only available when the server policy mode is read_write.
| Name | Required | Description | Default |
|---|---|---|---|
| wait | No | If true, wait for the commit to be confirmed by the update task before returning. | |
| transaction_id | Yes | Opaque transaction ID returned by the write call(s) to commit. |
Output Schema
| Name | Required | Description |
|---|---|---|
| action | Yes | |
| result | Yes | |
| transaction_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive, non-idempotent, and open-world behavior, so the bar is lower, and the description still adds real value: the underlying BAPI, that it persists (rather than reads) staged state, and the read_write policy precondition. It stops short of describing post-commit transaction state or error semantics, which the output schema may partly cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core action front-loaded and the operational precondition appended. No redundant restatement of the tool name or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a 2-parameter schema at full coverage, rich annotations, and an output schema, the description covers the essential workflow and availability constraint. The main minor gap is that it doesn't discuss rollback behavior or failure handling, but the structured fields carry most of that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so transaction_id and wait are already fully documented in the schema. The description adds no format detail or usage nuance for either parameter, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (persist/commit) and resource (staged changes in the identified SAP transaction), and grounds it in the wrapping BAPI_TRANSACTION_COMMIT. It also references call_rfc_function as the operation whose changes it commits, distinguishing it clearly from rollback_rfc_transaction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the workflow context ('changes staged by prior write call_rfc_function calls') and adds an explicit availability constraint ('only available when server policy mode is read_write'). It does not explicitly route the agent to rollback_rfc_transaction for the failure case, so an alternative-selection sentence is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_rfc_function_interfaceARead-only
Return the full IMPORT/EXPORT/TABLES/CHANGING parameter interface (including resolved structure fields) and documented exceptions for a function module. Always call this before call_rfc_function to know exactly what parameters are required and how they're shaped.
| Name | Required | Description | Default |
|---|---|---|---|
| function_name | Yes | Exact name of the function module to introspect. |
Output Schema
| Name | Required | Description |
|---|---|---|
| name | Yes | |
| exceptions | No | |
| parameters | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint and openWorldHint already declared, the description adds useful behavioral context: it returns resolved structure fields and documented exceptions, and it is framed as a prerequisite step. It does not elaborate on remote-system behavior, authentication, or rate limits, but the annotations already cover the safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the return content, followed by an imperative usage rule. Every sentence carries value and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter introspection tool with a 100%-covered schema, annotations, and an output schema, the description is sufficiently complete. It tells the agent what is returned, why the tool matters relative to call_rfc_function, and does not need to spell out return values because the output schema does that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single function_name parameter is already clearly documented. The description does not add syntax, naming rules, or formatting details beyond saying the tool operates on a function module, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: return the full parameter interface and documented exceptions for a function module. It distinguishes itself from the adjacent invocation tool by explaining that it must be called before call_rfc_function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear usage rule: always call this before call_rfc_function to know required parameters and their shapes. It does not state when not to use it or name any alternative introspection path, so it falls short of the full when/when-not/alternatives standard.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_abap_sourceARead-only
Read the full ABAP source of a program, class, or function module.
Automatically uses ADT (one call, most reliable — especially for
classes, which need several RFC calls otherwise) when it's enabled and
reachable, and transparently falls back to RFC (RPY_PROGRAM_READ /
RPY_FUNCTIONMODULE_READ) otherwise — including on a live ADT failure,
not just when it's disabled. You never need to choose the transport
yourself; check the returned via field if you want to know which one
actually served the read. function_group is required when
object_type='function_module'.
| Name | Required | Description | Default |
|---|---|---|---|
| object_name | Yes | Name of the program, class, or function module to read source for. | |
| object_type | Yes | Kind of ABAP object to read source for. | |
| function_group | No | Function group the function module belongs to. Required when object_type='function_module', ignored otherwise. |
Output Schema
| Name | Required | Description |
|---|---|---|
| via | Yes | |
| source | Yes | |
| object_name | Yes | |
| object_type | Yes | |
| function_group | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnly/openWorld annotations by disclosing the ADT-first / RFC-fallback strategy, that the fallback triggers on live ADT failures (not just disablement), that classes need several RFC calls otherwise, and that the returned `via` field reports the actual transport used. This is exactly the behavioral detail an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose before the transport mechanics, and the multi-clause explanation is informative rather than padded. Slightly long for the payload, but each sentence carries real information about fallback behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values don't need spelling out; the description instead covers the tricky behavioral aspect (transport selection and the `via` field). Nothing an agent needs in order to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all three parameters. The one clause about function_group being required for function_module merely restates the schema's own description, adding no new meaning. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (full ABAP source of a program, class, or function module), with the object scope enumerated. This is clearly distinguishable from the RFC-function siblings (search_rfc_functions, call_rfc_function, etc.), none of which read source.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives strong context for invoking it: the transport choice is automatic and the agent 'never need[s] to choose the transport yourself.' However, it offers no explicit when-not-to-use guidance or comparison against sibling tools for cases where an agent might reach for an RFC reader instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rollback_rfc_transactionADestructive
Discard changes staged by prior write call_rfc_function calls in the identified SAP transaction (BAPI_TRANSACTION_ROLLBACK). Only available when the server policy mode is read_write.
| Name | Required | Description | Default |
|---|---|---|---|
| transaction_id | Yes | Opaque transaction ID returned by the write call(s) to roll back. |
Output Schema
| Name | Required | Description |
|---|---|---|
| action | Yes | |
| result | Yes | |
| transaction_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=false, readOnlyHint=false, so safety is covered. The description adds real value beyond them: the policy-mode gate and the fact that it acts on state created by earlier call_rfc_function writes, which an agent could not infer from the annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with the effect front-loaded and the availability constraint second; no filler and nothing repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-required-param destructive tool with an output schema, the description covers the effect, the precondition, and the linkage to prior writes. Return values are covered by the output schema, so nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single transaction_id parameter is already documented as an opaque ID returned by the write call. The description adds only that the ID identifies a SAP transaction, so the schema does the heavy lifting and the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: it discards changes staged by prior write call_rfc_function calls and names the underlying BAPI_TRANSACTION_ROLLBACK. An agent can immediately distinguish it from commit_rfc_transaction without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States the precondition 'Only available when the server policy mode is read_write' and scopes the tool to changes staged by prior write calls, which implicitly routes the agent away from commit_rfc_transaction. It never names the alternative sibling or the inverse-condition explicitly, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_rfc_functionsARead-only
Search SAP for remote-enabled function modules (BAPIs/RFCs) by name pattern (supports '' wildcards, e.g. 'BAPI_CUSTOMER_'). Call this first to discover available functions before get_rfc_function_interface or call_rfc_function.
| Name | Required | Description | Default |
|---|---|---|---|
| group | No | Optional function group to restrict the search to. | |
| limit | No | Maximum number of matching functions to return. | |
| pattern | Yes | Function module name pattern, supports '*' wildcards, e.g. 'BAPI_CUSTOMER_*'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=true and openWorldHint=true, so the safety profile is well covered by structured data. The description adds workflow context ("call this first") but says nothing about result truncation, the effect of the limit, or search cost against a live SAP system. Useful but not rich beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the capability and its syntax come first, followed by the workflow-positioning instruction. Every clause carries information and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return format need not be described. Combined with 100% parameter coverage and explicit routing to sibling tools, an agent has everything required to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (pattern, group, limit) are already documented in the schema. The description restates the wildcard syntax for pattern but adds no meaning for group or limit. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (search) and resource (remote-enabled function modules / BAPIs / RFCs) plus the search key (name pattern). The distinction from get_rfc_function_interface and call_rfc_function is clear because the description frames this as the discovery step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says "Call this first to discover available functions before get_rfc_function_interface or call_rfc_function," naming both alternatives and the order in which to invoke them. An agent has no ambiguity about when to reach for this tool versus its siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.2.0- First observed
call_rfc_function - First observed
commit_rfc_transaction - First observed
get_rfc_function_interface - First observed
read_abap_source - First observed
rollback_rfc_transaction - First observed
search_rfc_functions
TDQS
Scored across 6 tools
Each tool targets a distinct phase: search_rfc_functions discovers, get_rfc_function_interface inspects the signature, call_rfc_function executes, commit/rollback manage the transaction, and read_abap_source reads source. The descriptions reinforce the ordering (call search first, then get interface, then call), leaving no realistic basis for misselection.
All six names follow a consistent snake_case verb_noun pattern (search_, get_, call_, commit_, rollback_, read_). No camelCase or stylistic mixing; the shared 'rfc' token further groups the related operations.
Six tools is well-scoped for a single-domain RFC client, and each one earns its place by covering a distinct step of the discover-inspect-execute-commit lifecycle. Nothing redundant or trivial is present.
The surface covers the core lifecycle from discovery through read/write execution and transaction commit/rollback, plus ABAP source inspection. Minor gaps exist, such as no bulk/atomic multi-function call or dedicated structure/schema explorer, but agents can work around these via the interface tool.
Maintenance
Related MCP Connectors
Any REST/SOAP/GraphQL/OData/SQL API as MCP tools for Claude & ChatGPT. 373 connectors: SAP, ERP.
- StackOneOAuthcom.stackone
Give AI agents 30,000+ safe, token-optimized actions across Workday, SAP, Oracle + hundreds more.
Connect AI agents to financial institution origination, analytics, and compliance workflows.
Discover, compare, route, and execute machine-accessible capabilities for AI agents.
Related MCP Servers
- FlicenseAqualityDmaintenanceEnables AI assistants to integrate with SAP systems via OData REST APIs for querying entity sets, performing CRUD operations, and executing function imports. It features automatic service discovery, CSRF token management, and smart connection handling without requiring the SAP RFC SDK.1112-
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to securely connect with SAP ABAP and BTP services, allowing execution of function modules, BAPIs, table reads, and various BTP operations through MCP.1Apache 2.0
- AlicenseAqualityDmaintenanceEnables AI agents to read, write, activate, and transport ABAP code in SAP systems via ABAP ADT REST API, without needing SAP GUI.24386 npmMIT
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants and n8n workflows to interact with SAP S/4HANA and ECC systems via OData, IDoc, and RFC/BAPI, with governed read-only-by-default access and multiple authentication types.3ISC