sap-mcp-server

English | 日本語

Securely operate SAP ABAP and BTP services from MCP-compatible AI clients.

Connect to SAP ABAP and BTP services from general MCP-compatible AI clients such as Claude Code, Codex, and Gemini CLI. Distributed as a single self-contained binary (Node.js SEA) for Linux and Windows.

This tool is not standalone: it requires a backend service deployed on SAP BTP, Cloud Foundry. Through strong, multi-layered security it accesses on-premise / RISE SAP environments.

---

🔒 Security

Security is enforced in multiple layers (defense in depth), so AI-driven access to SAP stays controlled and auditable.

Layer	Control
Access scope	Restrict access to Full, Reference-only (read-only) or Development-only.
Landscape	Per-landscape access control for DEV / QAS / PRD.
Authentication	Connects only over a secure, authenticated channel; SAP credentials are never held by the client.
Secret handling	Connection secrets are kept local only and are never committed or embedded in the binary.

Security pattern: role-based authorization

Three scopes — mcp (Full), mcp_readonly (Reference-only) and mcp_developer (Development-only) — are enforced in layers (the reference backend implements this; bring-your-own backends are encouraged to follow it):

1. Scope gate (app level) — every MCP route is mounted behind "require mcp or mcp_readonly or mcp_developer"; a token with none of these scopes is rejected (403) before any handler runs.
2. Environment gate (per destination) — each destination is tagged DEV / QAS / PRD. mcp_developer may reach only DEV/QAS; mcp_readonly may also reach PRD but for reads only. Untagged destinations are denied for restricted scopes (fail-closed). mcp reaches all.
3. Method gate (REST relays) — mcp_readonly may use any method on DEV/QAS and only GET on PRD. mcp_developer is limited to GET (external app relays allow any method on DEV/QAS).
4. No function modules in production — mcp_readonly is denied sap_call_fm against PRD regardless of the commit flag. Many function modules write without an explicit commit, so "read-only" cannot be delegated to a caller-supplied flag.
5. Hard-deny — PII tools (IAS / IPS) and CLI execution are mcp-only, regardless of environment.
6. ABAP writes stay in development — write / delete / transport / activate target DEV-tagged destinations only, for every scope. QAS and PRD are not modifiable under standard SAP practice; changes arrive by transport.

Tool	Full (mcp)	Reference-only (mcp_readonly)	Development-only (mcp_developer)
sap_list_destinations	all	all	DEV/QAS only
sap_use_destination / sap_current_destination	all envs	all envs	all envs
sap_select_table	all envs	all envs (read)	DEV/QAS only
sap_adt_freestyle / osql / ddic	all envs	all envs (read)	DEV/QAS only
sap_abap_read_source	all envs	all envs (read)	DEV/QAS only
sap_call_fm (incl. commit)	all envs	DEV/QAS only (PRD denied)	DEV/QAS only
sap_abap_write_source / write_fm / delete_source / activate (writes)	DEV-role destinations only	DEV-role destinations only	DEV-role destinations only
sap_create_transport / sap_release_transport	DEV-role destinations only	DEV-role destinations only	DEV-role destinations only
sap_call_ias_admin (IAS · PII)	all envs	denied	denied
sap_call_ips_job (IPS · PII)	all envs	denied	denied
sap_call_cf_api / bwz_content / ctms_api / forms_api / cis_api / cpi_api / ans_api / sbpa_api / datasphere_api / calm_api	all envs, any method	any method on DEV/QAS, GET on PRD	GET + DEV/QAS only
app_call_jira_api / `app_call_smart