Everything in ABAP

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

Server side only, and deliberately: the author states there is no realistic way to support the SSE streaming a client needs, so there are no notifications, no `listChanged`, no `subscribe` and no logging. It is also frozen — protocol versions up to 2025-11-25 and no further, with everything after that in a separate V2 SDK, so starting here today is starting on a closed branch.

Stateless by design: with no `Mcp-Session-Id` and no SSE, notifications of any kind, `resources/subscribe` and stream-close cancellation are excluded, which the author states are protocol-level impossibilities on stateless ICF rather than gaps to be filled later within this design. ABAP Cloud is not supported and not planned, the stated reason being SAP pushing its own MCP strategy and features in BTP; the first iteration targets 7.5x classic, with 7.02 to 7.4x served from a separate generated downport repository. No authorization object and no default auth check are delivered, so a user who may call the ICF node may call every `AREA`/`SERVER` registered under it until `check_authorization` is redefined.

Not reachable Not reachable since 2026-10-20.

Functional boundary What it exposes is whatever somebody put in the configuration table, which moves the governance question inside the SAP system and out of the server — an advantage if that table is controlled and a hazard if it is not. The web management interface is a second surface to secure alongside the MCP one.

Its maker offers it commercially.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

A descendant rather than a distinct idea: if what you need is the ADT surface itself, its ancestors are entered here too and one of them may already be in your stack.

Written for Amazon Q Developer and Kiro, and the central deployment path is ECS Fargate — the further you are from AWS, the more of it is scaffolding you do not need. Python rather than the Node most of this group uses. Its README says the repository is no longer maintained and that the latest version of ABAP Accelerator is shared after registering with AWS for [Modernization Agents for SAP on AWS](https://github.com/aws-for-sap/Modernization-Agents-for-SAP-on-AWS).

Neither the package manifest nor the repository tree declares a licence.

Commercial Its maker offers it commercially.

Functional boundary The MIT licence covers the connector only: connecting to SAP needs a licensed ABAPilot backend installed in your system, so this is a commercial decision wearing an open-source badge on one half. Its own published checks did not cover writes, activation, transports or authorisation boundaries.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.

There is nothing to install and nothing to deploy, and equally nothing to run headless: in VS Code it exists only while ADT for VS Code is running with a logged-on ABAP project, so it is a developer's local surface rather than anything a pipeline or a hosted agent can reach. No public repository, so what it exposes is what the documentation says it exposes.

Not reachable Not reachable since 2026-10-20.

Functional boundary `run_class` executes code in your system — that is the point and it is also the risk.

Classic BOPF only: business objects of the ABAP Programming Model for SAP Fiori are not handled, and on [the BTP ABAP environment](artifact:btp-abap-environment) or S/4HANA Public Cloud classic BOPF enhancements do not exist. It is version 0.1.0, verified on S/4HANA 2025 (SAP_BASIS 816) on-premise only, and [arc-1](artifact:arc-mcp-arc-1) still marks the plugin API it is built on as experimental. ARC-1 loads no extensions on its multi-target routes and offers none of these tools in its `hyperfocused` tool mode.

Single-tenant today, one technical user, with per-user principal propagation on the roadmap — so a shared deployment cannot yet act as the developer who asked. The sibling edition [ARC-1](artifact:arc-mcp-arc-1) speaks ADT directly if you would rather not depend on the language server.

It lives inside Eclipse and inherits everything that implies — the session is a developer's, not a pipeline's. And it is version-bound: ADT 3.60 or newer for 0.5.1, with 0.3.x the path for ADT 3.58 and 3.59.

Built and last touched in the same week of March 2026, so the maintenance reading is what it is — the authentication work is the reason to look, and a stalled repository is the reason to read it before depending on it.

Not for S/4HANA Public Cloud or [the BTP ABAP environment](artifact:btp-abap-environment), where the README states there is no `SUBMIT`, NAST or SOAP-RFC; the floor elsewhere is SAP_BASIS 7.50, the `/sap/bc/soap/rfc` service active, and an SAP user with `S_RFC` on the kit's function group as well as the authorizations for the reports and the spool. Print output is NAST messages only, so S/4 Output Management through BRF+ or APOC is outside it, and editing covers SmartForms alone, with Adobe Forms and SAPscript previewable but not editable. A report that opens a popup, calls a screen or is a dialog transaction cannot be run at all.

Freestyle SQL and `abap_run` mean an agent can read data and execute code, which is well past reading source. Neither is something to grant on a system where the distinction between development tooling and business data matters.

In the Eclipse mode the server lives in a developer's IDE, binds to 127.0.0.1 and answers any request carrying an `Origin` header with HTTP 403, so a pipeline or a remote agent has nothing to reach; the standalone mode on the runtime of the ADT for VS Code extension is the documented route with no IDE open. A new connection starts in write mode, so the 11 write tools are live against a connected system until someone presses Toggle Read-Only. The dropins route for the two bundles is documented as untested.

A compiled binary rather than an npm package, shipped prebuilt per platform and through pip and uvx. It collects anonymous usage telemetry by default, switched off with `--no-telemetry` or `DATAZOO_DISABLE_TELEMETRY=1`. And the BW reach is what distinguishes it — if the work is plain ABAP, that half is weight you are not using.

Neither the package manifest nor the repository tree declares a licence.

Two licences, by which package you install: the standalone server, `@mcp-abap-adt/core`, is AGPL-3.0-only, a licence to read before shipping anything built around it; the library, `@mcp-abap-adt/lib`, is Apache-2.0. The destination model also expects service keys sitting in a local directory, which is a secrets decision to make deliberately.

Its maker offers it commercially.

Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.

Its own README opens by calling the server experimental. It also writes: locking, editing and activating in a system an agent can reach is a permissions decision before it is a tooling one.

Every tool its README lists reads — Get and Search, nothing that writes. Locking, editing, activation and transports are the other server, [mcp-abap-abap-adt-api](artifact:mario-andreschak-mcp-abap-adt-api), and mixing the two is how you end up with two MCP servers pointed at one system.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

Its maker offers it commercially.

Reach is the reason to use it and the reason to be careful: reading cluster tables and spool output goes well past what a development tool is normally pointed at. Decide what an agent may reach before granting it, not after.

Read-only in practice, and the documentation is Korean; the tool names are English but the guidance around them is not.

Smart Form content cannot be read or written, and HR Forms (`PE51`) are not implemented. Installing it needs SAP GUI or WebGUI once, to register the OData services in `/IWFND/MAINT_SERVICE` and to redefine the write service in `SEGW`, and the extension is built against a locally linked ARC-1.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.

Its maker offers it commercially.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

On ECC the S/4HANA `API_*` services that the three convenience readers default to do not exist, so each one has to be pointed at a Z service of your own or replaced by the RFC tools. `read_table` inherits `RFC_READ_TABLE`'s 512-byte row, so a wide table needs an explicit field list and some fields cannot be selected at all, and the bridge starts a Node process and a fresh logon per call, with no pooling. The audit log is one line per call that includes the call arguments, so every filter and WHERE clause sent to SAP is written to a file that then has to be handled as sensitive.

Read-only does not mean low-stakes: a complete picture of who can do what in an SAP system is exactly what an attacker would want, and the ready-made endpoint is the vendor's rather than yours — the README also documents running the server yourself. The authentication is careful; the question of what leaves your landscape is still yours.

Its maker offers it commercially.

Not a substitute for testing in a system: the README states that any class calling the database, classic BAPIs or HTTP is shimmed out and stays an on-stack ATC and ABAP Unit concern, and that an off-stack green is CI-grade provenance rather than an in-system pass. It also assumes a particular shape of project. The ABAP has to be abapGit-serialised into a Git repository, Node.js 22 or later has to be available locally and in CI, and the CI has to be GitHub Actions.

Every skill that touches ABAP needs [arc-1](artifact:arc-mcp-arc-1) itself connected to a real system; nothing else is universal. `modernize-ui5-app` and `convert-ui5-to-fiori-elements` specifically need [the UI5 MCP server](artifact:ui5-mcp-server) for TypeScript conversion guidance and the linter, `convert-ui5-to-fiori-elements` also needs [the Fiori MCP server](artifact:sap-ux-fiori-mcp-server) for its LROP scaffold, and `modernize-ui5-app` needs a browser MCP (Claude in Chrome or Claude's own Preview) for its final render-verification step, since an HTTP 200 alone does not catch a blank page. A skill file alone, without the servers a given skill needs, has nothing to act on.

Knowledge with no reach: without an MCP server connected it can tell an agent what to write and cannot let it read or run anything. The rules target the ABAP Cloud development model, so a classic on-premise codebase is not what they are written against.

Not for S/4HANA Public Cloud or [the BTP ABAP environment](artifact:btp-abap-environment), where the README states there is no `SUBMIT`, NAST or SOAP-RFC; the floor elsewhere is SAP_BASIS 7.50, the `/sap/bc/soap/rfc` service active, and an SAP user with `S_RFC` on the kit's function group as well as the authorizations for the reports and the spool. Print output is NAST messages only, so S/4 Output Management through BRF+ or APOC is outside it, and editing covers SmartForms alone, with Adobe Forms and SAPscript previewable but not editable. A report that opens a popup, calls a screen or is a dialog transaction cannot be run at all.

Its maker offers it commercially.

Neither the package manifest nor the repository tree declares a licence.

The commands it writes stop production systems, delete data and import transports, which is why execution is deliberately somebody else's decision. BTP and cloud operations are explicitly out of scope and planned as a separate plugin.

Neither the package manifest nor the repository tree declares a licence.

It is a plugin for one server — its own — so it is a stack rather than a component. And the guard is only as good as the profile labels: a production system registered as `DEV` is a production system with the safety off.

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

It is a plugin for one server — its own — so it is a stack rather than a component. And the guard is only as good as the profile labels: a production system registered as `DEV` is a production system with the safety off.

It answers about the object catalogue, not about your code: nothing here reads your system, so it will tell you a table is not released and not that you used it. That check is ATC's, and this is what makes ATC's answer actionable.

In the Eclipse mode the server lives in a developer's IDE, binds to 127.0.0.1 and answers any request carrying an `Origin` header with HTTP 403, so a pipeline or a remote agent has nothing to reach; the standalone mode on the runtime of the ADT for VS Code extension is the documented route with no IDE open. A new connection starts in write mode, so the 11 write tools are live against a connected system until someone presses Toggle Read-Only. The dropins route for the two bundles is documented as untested.

Its maker offers it commercially.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.

Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. Windows only. The HTTP transport is meant for team use but binds to localhost, and unattended multi-user operation is listed as not yet available — a limitation and also the safer default.

Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. It has also not been touched since February 2025, which the maintenance reading states — the three later entries here are where the CI, the Web GUI and the testing framing went.

Not reachable Not reachable since 2026-10-20.

Functional boundary Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. And a UI test is slower and more brittle than the layer below it: this is for what only the screen can answer.

Neither the package manifest nor the repository tree declares a licence.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.