Back to Browse
About
MCP server for SAP ABAP systems
Security Report
10.0
Low Risk10.0Low RiskValid MCP server (1 strong, 1 medium validity signals). 1 code issue detected. No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.
5 files analyzed · 2 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
SAP system URL (e.g., http://host:50000)
Environment variable: SAP_URL
SAP username
Environment variable: SAP_USER
SAP passwordRequired
Environment variable: SAP_PASSWORD
SAP client number
Environment variable: SAP_CLIENT
SAP logon language
Environment variable: SAP_LANGUAGE
Skip TLS certificate verification
Environment variable: SAP_INSECURE
Block all write operations (safe default)
Environment variable: SAP_READ_ONLY
MCP transport (Docker defaults to http-streamable, set to stdio for local MCP clients)
Environment variable: SAP_TRANSPORT
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-marianfoo-arc-1": {
"env": {
"SAP_URL": "your-sap-url-here",
"SAP_USER": "your-sap-user-here",
"SAP_CLIENT": "your-sap-client-here",
"SAP_INSECURE": "your-sap-insecure-here",
"SAP_LANGUAGE": "your-sap-language-here",
"SAP_PASSWORD": "your-sap-password-here",
"SAP_READ_ONLY": "your-sap-read-only-here",
"SAP_TRANSPORT": "your-sap-transport-here"
},
"args": [
"-y",
"arc-1"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
ARC-1 — SAP ADT MCP Server
ARC-1 (pronounced arc one [ɑːrk wʌn]) — Enterprise-ready MCP server for SAP ABAP systems. Secure by default, deployable to BTP or on-premise, and hardened with large unit/integration/E2E test coverage.
ARC-1 connects AI assistants (Claude, GitHub Copilot, Copilot Studio, and any MCP client) to SAP systems via the ADT REST API. It ships as an npm package and Docker image.
Full Documentation | Quickstart | Tool Reference
Why ARC-1?
Built for organizations that need AI-assisted SAP development with guardrails. Inspired by the pioneering work of abap-adt-api, mcp-abap-adt, and vibing-steampunk — ARC-1 adds what's needed to run in production:
Security & Admin Controls
- Safe by default — read-only, no free SQL, no table preview, no transports out of the box. Use
--profile developeror explicit flags to enable capabilities - Operation allowlists/denylists — control exactly which operation types (read, write, search, query, activate, transport) are permitted
- Package restrictions — limit AI write operations (create, update, delete) to specific packages with wildcards (
--allowed-packages "Z*,$TMP"). Read operations are not restricted by package — use SAP's native authorization for read-level access control - Data access control — enable table data preview (
--block-data=false) or free-form SQL (--block-free-sql=false) - Transport safety — require transport assignments, restrict to specific transports, or make transports read-only. Update/delete operations auto-use the lock correction number when no explicit transport is provided
- Safety profiles — preconfigured roles:
viewer,viewer-data,viewer-sql,developer,developer-data,developer-sql - Writes restricted to
$TMPwhen enabled — only local/throwaway objects; writing to transportable packages requires explicit--allowed-packages
Authentication
- API key — simple Bearer token for internal deployments
- OIDC / JWT — Entra ID, Keycloak, or any OpenID Connect provider
- OAuth 2.0 — browser-based login for BTP ABAP Environment
- XSUAA — SAP BTP native auth with automatic token proxy for MCP clients
- Principal Propagation — per-user identity forwarded through Cloud Connector (every SAP action runs as the actual user, not a technical account)
BTP Cloud Foundry Deployment
Deploy ARC-1 as a Cloud Foundry app on SAP BTP with full platform integration:
- Destination Service — connect to SAP systems via managed destinations
- Cloud Connector — reach on-premise systems through the connectivity proxy
- Principal Propagation — user identity forwarded end-to-end via X.509 certificates
- XSUAA OAuth proxy — MCP clients authenticate via standard OAuth, ARC-1 handles the BTP token exchange
- Audit logging — structured events to stderr, file, or BTP Audit Log Service
Token Efficiency
- 11 intent-based tools (~5K schema tokens) instead of 200+ individual tools — keeps the LLM's context window small
- Method-level read/edit — read or update a single class method, not the whole source (up to 20x fewer tokens)
- Context compression —
SAPContextreturns public API contracts of all dependencies in one call (7-30x compression)
Built-in Object Caching
- Automatic source caching — every SAP object read is cached in memory (stdio) or SQLite (http-streamable). Repeated reads return instantly without calling SAP.
- Dependency graph caching —
SAPContextdep resolution keyed by source hash; unchanged objects skip all ADT calls on subsequent runs. - Pre-warmer — start with
ARC1_CACHE_WARMUP=trueto pre-index all custom objects at startup, enabling reverse dependency lookup (SAPContext(action="usages")) and fast CDS impact workflows (SAPContext(action="impact", type="DDLS")). - Write invalidation — when
SAPWritemodifies an object, its cache entry is automatically dropped; next read fetches fresh source.
See docs/caching.md for full documentation.
Testing
- 1,367+ unit tests (
53unit test files, mocked HTTP) - ~160 integration tests against live SAP systems, with explicit skip reasons when credentials or fixtures are missing
- ~70 E2E tests that execute real MCP tool calls against a running ARC-1 server and live SAP system
- CRUD lifecycle and BTP smoke lanes included (
test:integration:crud,test:integration:btp:smoke) - CI matrix on Node
22and24; integration + E2E run onpushtomainand internal PRs - Reliability telemetry + coverage published as informational CI signals (non-blocking)
Tools Refined for Real-World Usage
The 11 tools are designed from real LLM interaction feedback:
| Tool | What it does |
|---|---|
| SAPRead | Read ABAP source, table data, CDS views, metadata extensions (DDLX), service bindings (SRVB), message classes, BOR objects, deployed UI5/Fiori apps (BSP, BSP_DEPLOY), plus on-prem metadata reads for authorization fields (AUTH), feature toggles (FTG2), and enhancement implementations (ENHO). Structured format for classes returns metadata + decomposed includes as JSON |
| SAPSearch | Object search + full-text source code search across the system |
| SAPWrite | Create/update/delete ABAP source and DDIC metadata with automatic lock/unlock (PROG, CLAS, INTF, FUNC, INCL, DDLS, DDLX, BDEF, SRVD, DOMA, DTEL). Batch creation for multi-object workflows (e.g., RAP stack or domain+data element in one call) |
| SAPActivate | Activate ABAP objects — single or batch (essential for RAP stacks). Publish/unpublish OData service bindings (SRVB) |
| SAPNavigate | Go-to-definition, find references, code completion |
| SAPQuery | Execute ABAP SQL with table-not-found suggestions |
| SAPTransport | CTS transport management (list/create/release/delete/reassign), transport requirement checks, and reverse lookup history (action="history") |
| SAPContext | Compressed dependency context (action="deps"), reverse dependency lookup (action="usages"), and CDS upstream/downstream impact analysis (action="impact" for DDLS) |
| SAPLint | Local ABAP lint (system-aware presets, auto-fix, pre-write validation) + ADT PrettyPrint (server-side formatting) |
| SAPDiagnose | Syntax check, ABAP Unit tests, ATC code quality, short dumps, profiler traces |
| SAPManage | Feature probing — detect what the system supports before acting |
Tool definitions automatically adapt to the target system (BTP vs on-premise), removing unavailable types and adjusting descriptions so the LLM never attempts unsupported operations.
Feature Detection
ARC-1 probes the SAP system at startup and adapts its behavior:
- Detects HANA, abapGit, RAP/CDS, AMDP, UI5, and transport availability
- Auto-detects BTP vs on-premise systems
- Maps SAP_BASIS release to the correct ABAP language version
- Each feature can be forced on/off or left on auto-detect
Quick Start
npx arc-1@latest --url https://your-sap-host:44300 --user YOUR_USER
- Trying it out on your laptop? → Quickstart
- Full local dev setup (Docker, cookie extractor, client configs)? → Local Development
- Deploying for a team / BTP? → Deployment
Documentation
Full documentation is available at marianfoo.github.io/arc-1.
| Guide | Description |
|---|---|
| Quickstart | 5-minute npx + Claude Desktop setup |
| Local Development | Full local dev — all install methods, MCP client configs, SSO cookie extractor |
| Deployment | Multi-user deployment — Docker, BTP Cloud Foundry, BTP ABAP |
| Configuration | Every flag and env var, one table |
| Updating | Update procedures per install method |
| Enterprise Auth | Layer A / Layer B auth internals, coexistence matrix |
| Tool Reference | Complete reference for all 11 tools |
| Architecture | System architecture with diagrams |
| AI Usage Patterns | Agent workflow patterns and best practices |
Development
npm ci && npm run build && npm test
See CLAUDE.md for codebase structure, testing commands, and contribution guidelines.
Credits
| Project | Author | Contribution |
|---|---|---|
| vibing-steampunk | oisee | Original Go MCP server — ARC-1's starting point |
| abap-adt-api | Marcello Urbani | TypeScript ADT library, definitive API reference |
| mcp-abap-adt | Mario Andreschak | First MCP server for ABAP ADT |
| abaplint | Lars Hvam | ABAP parser/linter (used via @abaplint/core) |
License
MIT
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
80.0K
Stars
3
Installs
7.1
Security
No ratings yet
Local
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
80.0K
Stars
3
Installs
6.8
Security
No ratings yet
Local
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
114
Stars
396
Installs
10.0
Security
4.8
Local
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
-
Stars
53
Installs
10.0
Security
5.0
Local
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
89.9K
Stars
13
Installs
8.5
Security
5.0
Local
mcp-creator-typescript
Freeby mcp-marketplace · Developer Tools
Scaffold, build, and publish TypeScript MCP servers to npm — conversationally
-
Stars
13
Installs
10.0
Security
5.0
Local