@mcp-abap-adt/core

Changed

• ADT source writes on BASIS < 7.40 now explain the invalid-lock-handle failure. Some 7.31 systems never send a sap-contextid cookie, so no stateful ADT session exists and the lock is gone before the write: the PUT fails with HTTP 423 ExceptionResourceInvalidLockHandle in every session mode. No client-side setting fixes it. The error now carries a hint that ADT source writes cannot work on that system and that the source has to be edited in SE38 / SE24 / SE37. Applies to every tool error that mentions an invalid lock handle when ABAP_RELEASE < 740.

Fixed

• ReloadProfile switched the profile but not the connection. The stdio server kept the connection context it built at boot, so after a switch every tool still talked to the previous system until Claude Code was restarted. A profile switch now rebinds the stdio connection context and drops the RFC sessions of the previous system (SOAP / OData CSRF session, native RFC pool, ZRFC proxy session). Every SAP_RFC_* key of the previous profile is cleared, so a profile that does not set one no longer inherits it. The default MCP_OUTPUT_DIR (.sc4sap/work/<alias>/mcp-output) follows the new alias; a user-chosen directory is left alone. When part of the switch fails, the result is ok: false with restartRequired: true and errors.
• ListTransports / GetTransport returned nothing on BASIS < 7.40. The ADT transport organizer does not exist there: the list URL answers an empty body, which parsed to 0 transports. On these releases the request header, tasks and objects are read from E070 / E07T / E071 with the standard RFC_READ_TABLE over SOAP RFC. No custom ABAP is needed.
• GetWhereUsed failed on BASIS < 7.40. There is no repository information system resource. The search now runs in SAP through ZMCP_ADT_DISPATCH action WHERE_USED (cross-reference tables, DDIC usage) and returns the same shape, with a note that says so.
• Read-only DDIC helpers on BASIS 7.31. There is no SAP Gateway there, so the OData service cannot exist. The table / data element / domain read helpers now also run over SOAP RFC.

Added

• GetTcodeUsage (read-only, ECC): was each transaction used in the last N months, from the ST03N workload monthly aggregates. One boolean per transaction plus coverage (months that actually hold data). No user names leave SAP. destination (or SAP_USAGE_RFCDEST in the profile) reads another system's aggregates over an SM59 destination. Needs the ZMCP_WL_TCODE_USAGE FM and the WlTcodeUsage function import.
• GetJobUsage (read-only, ECC): is each program a step of a background job that is scheduled now or ran inside the window (TBTCO / TBTCP). One boolean per program. Needs the ZMCP_WL_JOB_USAGE FM and the WlJobUsage function import.
• GetTransaction transaction_names: several transactions in one call. The result also shows the kind of transaction (program, parameter transaction with its target t-code and parameters, variant transaction).
• Legacy table reads (ZMCP_ADT_DISPATCH TABLE_READ) also allow TSTC, TSTCP, DD03L and DD04L.

Fixed

• GetWhereUsed on ECC (BASIS < 7.50) returned nothing or failed. Every call failed with 404 because the scope step does not exist on 7.40. DDIC objects returned 500. A successful answer was parsed as 0 references. The client library 3.15.0 fixes all three. It searches without a scope, addresses tables, structures, data elements, domains, DDIC views, table types, transactions and function modules through workbench VIT URIs, and parses both namespace prefixes. Needs @babamba2/mcp-abap-adt-clients 3.15.0.
  • On ECC a function module may be given by plain name (GROUP|FM still works). The ECC search uses SAP_TIMEOUT_LONG (default 120 s), because a widely used standard table such as VBAK takes about 60 s.
• ActivateObjects / ActivateObject reported success:false on ECC after a successful activation. On BASIS 7.40 /sap/bc/adt/activation/runs returns 404 and the sync POST /sap/bc/adt/activation answers a clean activation with HTTP 200 and an empty body (no <chkl:messages>), which was read as "not activated". An empty body now counts as activated without messages. The result is then checked against GET /sap/bc/adt/activation/inactiveobjects: an object still listed there is marked failed with an error that says so. The response carries notes when the result was inferred this way. The per-type activation tools (ActivateProgram, ActivateClass, ...) also treat an empty body as success.
• GetInactiveObjects returned 0 objects on ECC. BASIS 7.40 sends a plain <adtcore:objectReferences> list, which the parser did not know. Needs client library 3.15.0. Each object now also carries uri. available_in now includes legacy.
• GetPackage failed on ECC (BASIS < 7.50). The client library threw for every package read. With client library 3.15.0 the package is resolved through the Information System search and the tool returns name, type and description with legacy_limited: true; a missing package returns "Package not found.". Needs @babamba2/mcp-abap-adt-clients 3.15.0.
• CreateGuiStatus wrote MODAL = 'N', which is not a status type. RSMPE_STAT-MODAL stores D (normal screen or list status), P (dialog box) and C (context menu). status_type N / P / C now maps to D / P / C (high and low tool). The description now goes to STA.INT_NOTE, the status short text shown in SE41. The TIT row is still written. UpdateGuiStatus / PatchGuiStatus rewrite an incoming or existing MODAL = 'N' to D and log a warning for any other unknown code.
• GetGuiStatusList returned 0 statuses for a GUI status written by the dispatcher. ADT's object structure lists only the statuses known to the workbench navigation index, and a CUA written through CUA_WRITE is not in it. When ADT lists no status, the list now comes from the CUA_FETCH STA rows (source: "cua_fetch", each entry with description and status_type). Without the dispatcher the result stays empty and notes says why.

Added

• GetWhereUsed options (all optional, default off): max_results (cap), customer_only (Z / Y name, or package Z* / Y* / $*; /namespace/ objects such as SAP industry solutions or generated /1BCDWB/ modules are dropped, use package: "/ACME/*" for a customer namespace), package (exact or prefix *), timeout_ms. The filters run after the SAP search, so they shrink the answer but not the search time.
• GetWhereUsed response fields (additive): returned_references, truncated, filtered_out, notes, and object_identifier per reference. Calls without the new options return the same references as before.
• GetWhereUsed error hints for unresolvable object types, timeouts and unsupported types. available_in now includes legacy.
• GetUsageSnippets (read-only, new tool): line-level where-used hits. For each referencing object it returns the source lines with uri (…/source/main#start=<line>,<col>), line, column and the source line. Input is either object_identifiers from GetWhereUsed, or object_name + object_type (runs the where-used search first, with customer_only / package / max_objects). Works on ECC 7.40 and S/4HANA. Needs client library 3.15.0. With an older library the tool reports this.

Added

• RunUnitTest container_type (CLAS | PROG | FUGR, default CLAS). On BASIS < 7.50 (ECC), PROG / FUGR run the local test classes of a report or function group. Every test class of the container runs; test_class is not a filter there. On S/4HANA only CLAS is supported, and PROG / FUGR return a clear error instead of running the wrong object.
  • PROG / FUGR need @babamba2/mcp-abap-adt-clients 3.14.0. An older library ignores container_type and runs the name as a class.

Fixed

• RunUnitTest on ECC returned no result. The legacy run is synchronous and its result was lost between handlers, so GetUnitTestResult came back empty. RunUnitTest now returns the result inline as run_result (run_id: "legacy-sync"). GetUnitTestResult / GetUnitTestStatus called with legacy-sync return an error that points to run_result instead of an empty success.

Added

• GetSqlQuery / GetTableContents on BASIS < 7.50 (ECC). The ADT data preview does not exist there, so the client library refused both. They now fall back to the ZMCP_ADT_DISPATCH action TABLE_READ (abap/zmcp_adt_dispatch_ecc.abap, FORM table_read) and answer with path: "ecc-dispatch-table-read".
  • Only a single-table SELECT f1, f2 | * FROM tab [WHERE …] [ORDER BY …] is translated; JOIN, UNION, GROUP BY and aggregates are refused with a clear message. The ABAP side rejects sub-queries in the condition.
  • Read-only and allow-listed to customizing / repository tables: MODACT, MODATTR, MODSAP (CMOD), GB31, GB92, GB93, T001D, T001Q (GGB validations / substitutions), TBE24, TBE34, TPS34 (BTE), TFRM, TFRMT (VOFM routines), T100 (messages). Any other table gets an error naming the list. The protected-table checks run first, as before.
  • Rows are capped at 5000 (the ABAP limit). truncated is true only when more rows exist: one extra row is read to tell.
  • Systems without the TABLE_READ action keep the original "not supported on this SAP system" error.

Changed

• Shorter tool parameter descriptions, same meaning: the repeated version / transport sentences (88 places) and the [read-only] tag on parameter descriptions (26 places; tool-level descriptions keep it) are trimmed, and the output parameter text is shorter. The 171 high-level tool definitions went from 117,837 to 114,819 characters. No behaviour change.

Fixed

• GetTableContents / GetSqlQuery returned values in the wrong rows. ADT sends an empty cell as a self-closing <dataPreview:data/>; the parser merged it with the next cell, so every later value in that column moved up one row and the last rows came back empty. On T000, client 100 showed another client's logical system. Empty cells now stay in place. Anything extracted with these tools from tables with empty cells (customizing / SPRO extraction included) is worth re-extracting.
• The data preview returned one row more than max_rows / row_number; rows are now cut to the limit and the response says truncated: true. XML entities (& …) in values and descriptions are decoded.
• GetProgFullCode could not read function groups — it returned the group's metadata XML instead of source. The main program now comes from source/main; nested includes are resolved (they never were), INCLUDE x. " comment lines are recognised, and each include is fetched once.
• GetObjectInfo enrichment never worked: it called SearchObject with a parameter the handler does not read and parsed its JSON answer as XML. It now reads the JSON results.
• Hidden filePath writes were not confined. writeResultToFile promised "inside ./output" but wrote anywhere; every write now has to stay inside MCP_OUTPUT_DIR (default ./output).

Added

• output: "file" on GetProgram, GetClass, GetInterface, GetFunctionModule, GetInclude and GetProgFullCode: the source is written unchanged under MCP_OUTPUT_DIR/src/ and the response carries the path, line count and an outline of METHOD / FORM / MODULE / FUNCTION / event blocks with line ranges. A 66 KB class came back as ~3 KB. Default stays inline.
• GetTableContents: fields (keep only some columns) and include_metadata (column type, length, description).

Changed

• GetTableContents is compact by default: column names only, empty cells left out of each row (the response says so), no JSON indentation, 20 rows instead of 100. GetSqlQuery keeps its response shape (scripts read columns) but drops the indentation.
• SearchObject no longer returns rawXML unless include_raw_xml: true (it repeated every parsed field and was over half the response), omits empty description / package, decodes entities, defaults to 50 results instead of 100 and flags truncated: true when the limit is hit.

Added

• chapters parameter on RuntimeGetDumpById and RuntimeAnalyzeDump (implies view="formatted"): keeps the ST22 header plus the requested chapters without box borders or padding. "developer" = Short Text, What happened?, Error analysis, Chain of Exception Objects, Information on where terminated, Source Code Extract, Active Calls/Events, User and Transaction. A real S/4HANA dump went from 51.5 KB to 3.4 KB.
• RuntimeListDumps drops each entry’s HTML summary unless include_summary=true (also on the compact DumpList handler). A 20-entry list went from ~250 KB to ~30 KB.

Fixed

• Dump key facts pointed at the wrong chapter. RuntimeGetDumpById (response_mode summary/both) and RuntimeAnalyzeDump returned the first title / line in the payload — the chapter-index entry "System environment", line 81. They now read the dump root (runtime error, exception, terminated program, user, date, host), the termination link (object + line) and the chapter index; the formatted view falls back to its header block.
• SAP_RFC_BACKEND was frozen before the profile loaded. The RFC backend is resolved on every call, so the sc4sap profile value and ReloadProfile take effect.
• SAP_RFC_BACKEND=zrfc was rejected although zrfcProxy.ts implements it; the selector now routes it.
• pino / pino-pretty skipped by npm install --omit=dev. They were listed in both dependencies and devDependencies, so the lockfile marked them dev-only and fresh installs failed at MCP start. The devDependency entries are gone.

Note

• RuntimeListDumps can return an empty list on some S/4HANA systems while ST22 shows dumps; RuntimeListFeeds with feed_type: "dumps" and a time window returns them.

Fixed

• Tier readonly guard let four mutating tools through on QA and PRD. readonlyGuard.ts matched mutations by the prefixes Create / Update / Delete and held a three-entry runtime-execution set. ActivateObjects, PatchGuiStatus, WriteTextElementsBulk and RuntimeCreateProfilerTraceParameters matched neither and were callable against QA and PRD profiles. Patch, Write and Activate are now mutation prefixes (each matches exactly one registered tool today, so a future sibling is covered when it ships), and the profiler-trace setup call joins the runtime set alongside the RuntimeRun* executions it configures. Create still matches by startsWith, so RuntimeCreate* is not swept in by accident.
• This is the server-side half of a two-layer defence and the client-side sc4sap PreToolUse hook carried the same two lists verbatim, so for these four tools neither layer blocked — while the hook still told the user the server guard was backing it up. Both halves were fixed together; the sc4sap side ships in its own release.
• No behaviour change on DEV: checkToolAllowed returns null on its first line for that tier. On QA/PRD no usable capability is lost — activation and text-pool writes are already unreachable once Create* / Update* are denied, and profiler-trace setup pairs with runs that were blocked already.

Tests

• readonlyGuard.test.ts grows the mutation and runtime lists, and pins five near-miss reads (RuntimeAnalyzeProfilerTrace, RuntimeGetProfilerTraceData, RuntimeListProfilerTraceFiles, RuntimeGetGatewayErrorLog, RuntimeListSystemMessages) as explicitly allowed, so collapsing the runtime set into a bare Runtime prefix fails loudly instead of silently killing reads on QA and PRD.

Known gap

• RuntimeCallDispatch remains unblocked on every tier, with a test asserting so. It invokes an arbitrary ZMCP_ADT_DISPATCH action and the action name is a runtime argument, so this layer — which sees only the tool name — cannot separate a write action from a read one. Tracked separately; when it is addressed that test should flip rather than quietly disappear.

Added

• ECC 7.40 DDIC read fallback via OData RFC. 4 handlers (GetTable / GetStructure / GetDataElement / GetDomain) activate on SAP_VERSION=ECC, routing DDIC reads through server-side FMs (ZMCP_ADT_DDIC_TABL_READ / _DTEL_READ / _DOMA_READ) invoked via OData FunctionImports on ZMCP_ADT_SRV. TABL_READ covers both Table and Structure (TABL/STRU share TABL DDIC category). Validated 2026-04-29 on HKT-DEV (path=ecc-odata-rfc).
• GetBadiImplementations — new read-only handler to find Z/Y implementations of classic BAdI definitions. ECC-only: routes through ZMCP_ADT_DDIC_BADI bridge FM (SXS_ATTR-based lookup). Returns kind=classic with implementation list (impl_name, impl_class, package, methods_redefined) or kind=unknown for kernel BAdIs / non-existent definitions. Use during symptom analysis when a standard BAdI is implicated.
• lib/odataRfc.ts: 4 new adapters (callDdicTablRead / DdicDtelRead / DdicDomaRead / DdicBadi) + DdicReadResult / DdicBadiResult types.
• lib/rfcBackend.ts: 4 new wrappers + informative error for non-odata backends.

Fixed

• Keychain password resolution in broker-based auth path. EnvFileSessionStore (from @babamba2/mcp-abap-adt-auth-stores) reads SAP_PASSWORD raw from the .env file and does not know about keychain:<service>/<account> references, so authBroker.getConnectionConfig() returned the literal reference string as the Basic Auth password → 401 → account lockout after 3 tries. profile.ts activateProfile() only fixed process.env.SAP_PASSWORD, which the v2 broker architecture (lib/utils.ts:515 "No fallback to getConfig()") does not read. brokerFactory.ts now calls resolveSecret() on both createBrokerWithEnvFileStore (Variant 2, --env=path) and loadEnvFileIntoSessionStore (Variant 3, cwd .env) and seeds the session store's inMemoryUpdates so downstream reads return plaintext.

Added

• ECC 7.40 DDIC write fallback via OData RFC. 9 handlers (Domain/DataElement/Table × CRUD) activate on SAP_VERSION=ECC, routing DDIC writes through server-side FMs (ZMCP_ADT_DDIC_{TABL,DTEL,DOMA,ACTIVATE}) invoked via OData FunctionImports on ZMCP_ADT_SRV. Full implementations: Domain C/U/D + DataElement C/U/D (type_kind=domain only) + Table Delete. Inform-only: Table Create/Update (CDS-DDL translator deferred).
• lib/odataRfc.ts: callDdicTabl / DdicDtel / DdicDoma / DdicActivate + DdicResult type.
• lib/rfcBackend.ts: 4 new wrappers + informative error for non-odata backends.

Added

• Pre-commit hook via husky + lint-staged — auto-fixes formatting and lint issues before commit so CI stays green.

Changed

• Rewrite ListTransports handler to use AdtClient.getRequest().list() with proper Accept negotiation instead of direct connection.makeAdtRequest(). Update @mcp-abap-adt/adt-clients to 3.13.0.
• Add integration tests for ListTransports handler.

Fixed

• Give SAP_AUTH_TYPE priority over SAP_JWT_TOKEN in test helpers — fixes onprem basic-auth tests failing when OS has stale BTP JWT token (#24).

Changed

• Update @mcp-abap-adt/adt-clients to 3.12.0 — adds 415 Content-Type negotiation with auto-retry and caching. Accept correction enabled by default (#22, #23).

Fixed

• Guarantee unlock via try-finally in all update handlers — prevents locked objects when errors occur between lock and unlock (#22). Affected: UpdateProgram, UpdateClass, UpdateInterface, UpdateView, UpdateTable, UpdateStructure, UpdateDomain, UpdateServiceDefinition, UpdateDataElement.

Improved

• Rewrite SearchObject tool description with operation-first approach for better RAG discoverability (#21). Description now leads with action verbs (find, search, locate, check exists) instead of object type lists, so embedding vectors match user intent queries like "is there a program named X?".

Improved

• Enrich 15 tool descriptions with domain-specific keywords for better vector RAG discoverability (#20). Tools like SearchObject, GetTypeInfo, GetTransaction, GetTableContents, and others now include ABAP object type names (DEVC, CLAS, TABL, DDLS, BDEF, DDLX, etc.) so embedding-based tool discovery returns correct results.

Improved

• Suppress ping request logging in StreamableHttpServer and SseServer — ping is now silent unless debug logging is enabled, reducing log noise.

Improved

• StreamableHttpServer request logging now includes MCP method, tool name, destination, and completion status. Helps diagnose issues like #19 where health polls generate excessive tools/list noise.

Added

• GET /mcp/health endpoint for HTTP and SSE transports — lightweight health check without MCP protocol overhead. Returns status, uptime, version, transport, and activeSessions (SSE only). Resolves #18.
• Unit tests for health endpoint (both transports).

Fixed

• Shorten server.json description to fit MCP registry 100-character limit.

Added

• 16 new Read* tools — read source code and metadata for all object types with CRUD handlers: ReadClass, ReadInterface, ReadProgram, ReadTable, ReadStructure, ReadView, ReadDomain, ReadDataElement, ReadFunctionModule, ReadFunctionGroup, ReadPackage, ReadServiceDefinition, ReadServiceBinding, ReadMetadataExtension, ReadBehaviorDefinition, ReadBehaviorImplementation.
• transport_request parameter for UpdateBehaviorDefinition (low), UpdateMetadataExtension (high).
• record_changes parameter for CreatePackage (high + low).
• Transported Object CRUD integration test reproducing GitHub #11 (transport lock issue on legacy systems).

Fixed

• SAP_SYSTEM_TYPE now propagated from test config to process.env, so createAdtClient correctly selects AdtClientLegacy on legacy systems.
• transport_request passed in class update tests for transportable packages.
• UpdateDataElement now passes transportRequest to adt-clients.
• BDEF low test resilience: guaranteed BIMPL unlock via try/finally, delay after delete in cleanup, skip create if BDEF already exists (transport re-create limitation).
• Removed duplicate GetFunction handler (delegates to GetFunctionModule).
• Auto-detect JWT auth for --env-path, SAP_CLIENT auto-resolve.

Fixed

• Unit test systemContext.test.ts updated to match SAP_SYSTEM_TYPE env var approach (removed obsolete isModernAdtSystem mock).

Added

• SAP_SYSTEM_TYPE environment variable (cloud | onprem | legacy) to explicitly control SAP system type. Default: cloud.
• --system-type CLI argument as alternative to the env var.
• Eager HTTP session initialization — connect() is now called for all connection types (not just RFC), establishing CSRF token and cookies before the first request.

Changed

• Removed unreliable auto-detection via /sap/bc/adt/core/discovery. System type is now determined solely by SAP_SYSTEM_TYPE.
• Migration note: on-premise users must set SAP_SYSTEM_TYPE=onprem in .env to access on-premise-only tools (e.g., Programs).

Fixed

• 403 errors on first request to SAP systems (e.g., E96) that require pre-established session cookies.
• Inconsistent legacy detection across different shell environments, proxy configs, and ICM sessions.

Added

• Legacy system support (BASIS < 7.50): automatic detection of legacy systems, AdtClientLegacy factory, RFC connection transport via SADT_REST_RFC_ENDPOINT.
• RFC connection type: --connection-type=rfc CLI flag and SAP_CONNECTION_TYPE=rfc env var for legacy systems requiring SAP NW RFC SDK.
• available_in mechanism: each handler's TOOL_DEFINITION declares supported environments (onprem, cloud, legacy). Unsupported tools are hidden from clients at registration time.
• Legacy available_in on 102 handlers: Class, Interface, View, Program, Function Group/Module, Package (read/update/delete), Include, Unit Test, and common utilities.
• FunctionGroup/FunctionModule on cloud: previously restricted to on-premise only.
• Runtime profiling and dumps on cloud: class-based profiling now works on ABAP Cloud.
• Shared dependencies management: npm run shared:setup / shared:teardown / shared:check for test objects.
• Test infrastructure: test:init / test:reinit scripts, explicit connection config (env, system_type, connection_type) in test-config.yaml, available_in support in test cases for system-aware skipping.
• AVAILABLE_TOOLS_LEGACY.md: generated documentation listing 115 legacy-compatible tools.

Changed

• BREAKING: Node 18 dropped — minimum Node.js version is now 20.0.0.
• BREAKING: @mcp-abap-adt/adt-clients upgraded from 2.x to 3.11.2 (major API changes).
• BREAKING: @mcp-abap-adt/connection upgraded to 1.5.3.
• CI matrix: Node 20 + 25 on 3 OS for push/PR; Node 20/22/24/25 for release.
• Guaranteed unlock: force-release DDIC locks, unlock-on-error in CreateDataElement/CreateDomain.
• TADIR conflict retry: automatic retry on 409 TADIR conflict during create operations.

Fixed

• Circular reference in CDS unit test handlers.
• i18n check handling (adt-clients 3.8.7).
• MetadataExtension high/low test object conflicts (separate config keys).
• Function test lock conflicts (separate high/low test objects).
• Package tests use update() for lock/unlock.
• Jest 30 deprecated --testPathPattern migrated to --testPathPatterns.
• SAP_USER → SAP_USERNAME in configuration examples.

Fixed

• Integration test cleanup: close MCP connections, reuse auth session, random ports.

Added

• GetTableContents handler: fully implemented — was a stub returning "temporarily unavailable", now reads table data via ADT Data Preview API with field extraction and SQL query generation.

Changed

• parseSqlQueryXml: exported from handleGetSqlQuery for reuse in GetTableContents.

Added

• BehaviorImplementation low-level MCP tools: registered ValidateBehaviorImplementationLow, CreateBehaviorImplementationLow, LockBehaviorImplementationLow in LowLevelHandlersGroup.

Fixed

• System context not passed to AdtClient: createAdtClient() now forwards responsible and masterSystem from resolved system context to AdtClient options. Fixes package creation on BTP Cloud failing with "Enter a valid user, not , as the person responsible".
• ValidatePackageLow schema: added missing super_package property to inputSchema.properties (was in required but not declared — MCP SDK rejected the parameter in hard mode).
• CreatePackageLow handler: removed incorrect createResult check — AdtPackage.create() returns { errors: [] } without createResult (packages are containers with no response body).

Changed

• BREAKING: Separate Create and Update — Create handlers no longer accept source code. Use Update after Create to set source code.

Fixed

• MCP Registry publish: sync server.json version with npm package version (2.5.2 → 2.7.5).

Added

• System context HTTP headers for HTTP/SSE transport:
  • x-sap-master-system and x-sap-responsible headers allow per-request system context override.
  • Priority: HTTP headers → process.env → cloud getSystemInformation() API.
  • Enables on-prem transport request binding for HTTP/SSE connections without .env file.
• System context cache isolation: cache is reset before each non-stdio request to prevent stale values leaking between requests targeting different SAP systems.

Fixed

• Release workflow lint gate for v2.7.2:
  • Applied Biome formatting/import ordering fixes in updated hard-mode test infrastructure and integration suites.
  • Kept hard-mode behavior unchanged; this patch is focused on CI/release pipeline stability.

Added

• YAML-driven MCP hard mode test infrastructure:
  • Added environment.integration_hard_mode support for integration tests.
  • Added real MCP client execution path for stdio, sse, and http transports.
  • Added MCP CRUD smoke/matrix scripts in tools/.

Fixed

• Real MCP integration gaps in tests:
  • Lambda-based integration suites now support hard mode via real MCP tool calls.
  • LowTester hard mode now bootstraps MCP session (GetSession) so low-level lock/unlock flows receive required session_id.
  • Hard mode test object names now include per-run suffix to prevent object name collisions between runs.
• System context bootstrap on server startup:
  • Launcher now hydrates on-prem system context env values earlier so real MCP runs consistently resolve context.

Added

• SAP_MASTER_SYSTEM and SAP_RESPONSIBLE documented in CLI help (--help) and .env.example.

Added

• System context support for on-premise systems (issue #11):
  • masterSystem and responsible are now passed to all ADT create/update XML requests via IAdtSystemContext.
  • On-prem resolution: SAP_MASTER_SYSTEM env var → getSystemInformation() API fallback (cloud).
  • Responsible resolution: SAP_RESPONSIBLE env var → SAP_USERNAME fallback → API.
  • Ensures correct transport request binding on on-premise systems.
• New .env variables for on-premise configuration:
  • SAP_MASTER_SYSTEM — SAP system ID (e.g., E19, DEV). Required for on-prem create/update operations.
  • SAP_RESPONSIBLE — Responsible user (optional, falls back to SAP_USERNAME).
• Test infrastructure: resolveTestSystemContext() resolves system context from YAML config for integration tests.

Changed

• Upgraded @mcp-abap-adt/adt-clients from ^2.0.0 to ^2.2.0.
• Renamed default_system → default_master_system in test config template.

Fixed

• UpdateProgram missing transport_request: Added transport_request to schema, interface, and .update() call — same fix as other handlers in 2.6.0.

Changed

• Upgraded @mcp-abap-adt/adt-clients to 1.2.2.

Added

• ListTransports tool (read-only):
  • Lists transport requests for the current or specified user.
  • Filters by modifiable status (default: modifiable only).
  • Use before create/update to find the correct transport request.

Fixed

• transportRequest forwarding in all high-level handlers (issue #11):
  • Create handlers now forward transportRequest to the internal update (PUT) step: CreateFunctionModule, CreateTable, CreateInterface, CreateView, CreateProgram, CreateDomain, CreateDataElement.
  • Standalone update handlers now forward transportRequest: UpdateStructure, UpdateDomain, UpdateServiceDefinition.
  • Added transport_request to tool schemas where it was missing: UpdateClass, UpdateView, UpdateBehaviorDefinition.

Changed

• Upgraded @mcp-abap-adt/adt-clients from 0.3.22 to 1.2.1.

Documentation

• Regenerated tools documentation:
  • docs/user-guide/AVAILABLE_TOOLS.md
  • docs/user-guide/AVAILABLE_TOOLS_HIGH.md
  • docs/user-guide/AVAILABLE_TOOLS_LOW.md
  • docs/user-guide/AVAILABLE_TOOLS_COMPACT.md
  • docs/user-guide/AVAILABLE_TOOLS_READONLY.md

Fixed

• --mcp precedence over local .env:
  • Fixed CLI fallback logic so .env from current working directory is no longer auto-loaded when --mcp=<destination> is provided.
  • Startup auth source display now correctly prioritizes service-key: <destination> over .env.
• JWT auth error diagnostics:
  • Improved HTTP/SSE request-time error reporting for missing JWT tokens by surfacing token provider failure reason in BaseMcpServer.
• Auth broker runtime behavior:
  • Fixed v2 auth-broker config to respect --unsafe instead of always forcing safe in-memory stores.

Added

• Browser OAuth callback port override:
  • Added --browser-auth-port=<port> and MCP_BROWSER_AUTH_PORT to override auth callback server port (useful when default ports are occupied).
• Inspector runtime dependency safety:
  • Added explicit express-rate-limit dev dependency to avoid missing transitive package issues during dev:http inspector startup.

Documentation

• Updated auth and CLI docs for --mcp behavior and browser auth callback port override:
  • README.md
  • docs/user-guide/AUTHENTICATION.md
  • CLI help text via ServerConfigManager.

Changed

• Compact handler descriptions:
  • Reworked compact handler descriptions to be explicit and deterministic for tool routing.
  • Added per-object_type required parameter mapping directly in handler descriptions (TYPE(param*) format).
  • Clarified read vs validate intent to avoid HandlerGet / HandlerValidate confusion.
• Compact schemas metadata:
  • Added missing parameter descriptions in compact schemas to remove No description in generated tool docs.

Documentation

• Regenerated tools documentation:
  • docs/user-guide/AVAILABLE_TOOLS.md
  • docs/user-guide/AVAILABLE_TOOLS_HIGH.md
  • docs/user-guide/AVAILABLE_TOOLS_COMPACT.md

Added

• Compact facade CRUD routing:
  • Added compact facade CRUD operations routed by object_type.
  • Added compact router/matrix coverage for supported object/action combinations.
• Compact lifecycle and test handlers:
  • Added compact handlers for validation, unlock, and unit test workflows.

Changed

• Compact routing architecture:
  • Removed legacy HandlerAction path and standardized on dedicated compact handlers.

Added

• Service Binding high-level tools:
  • Added CreateServiceBinding, GetServiceBinding, UpdateServiceBinding, DeleteServiceBinding, ListServiceBindingTypes, ValidateServiceBinding.
  • Added serviceBindingPayloadUtils for response parsing/format normalization.
• Runtime profiling tools:
  • Added RuntimeAnalyzeProfilerTrace, RuntimeRunClassWithProfiling, RuntimeRunProgramWithProfiling.

Changed

• System read-only handlers:
  • Migrated GetAllTypes, GetObjectStructure, and GetSqlQuery to AdtClient flow.
• Lint/type hygiene:
  • Removed explicit any usage in new service binding/runtime handlers and high-level handler registrations.

Fixed

• Dev HTTP/SSE launch scripts:
  • Fixed dist entry path to dist/server/launcher.js in tools/dev-http-v2.js and tools/dev-sse-v2.js.
  • Fixed dev:http transport argument to --transport=http.
• HTTP/SSE server startup reliability:
  • Updated standalone server startup flow to listen on listening/error events, preventing false "started" logs followed by silent exits.
  • Kept strong server references in launcher to avoid premature process shutdown.

Changed

• Runtime profiling + dumps explorer:
  • Refocused tool workflow to class-based profiling run flow.
  • Improved ABAP user resolution/validation and diagnostics for dumps/traces filtering.
  • Improved object validation/update flow and trace feed handling in interactive tool.
• Tools documentation:
  • Updated tools/README.md to reflect class-focused profiling flow and ABAP user resolution behavior.

Added

• Runtime diagnostics tools:
  • Added runtime profiling tools: RuntimeCreateProfilerTraceParameters, RuntimeListProfilerTraceFiles, RuntimeGetProfilerTraceData.
  • Added runtime dump tools: RuntimeListDumps, RuntimeGetDumpById.
• Architecture documentation:
  • Added comprehensive architecture document: docs/architecture/ARCHITECTURE.md.

Changed

• Runtime payload format:
  • Runtime profiling and dump handlers now return parsed JSON payloads (instead of raw XML strings in payload).
  • Runtime dump read uses dump_id input (RuntimeGetDumpById) instead of URI-based input.
• Dependencies:
  • Updated @mcp-abap-adt/adt-clients to ^0.3.16.

Documentation

• Regenerated tools docs (docs/user-guide/AVAILABLE_TOOLS*.md) with runtime diagnostics tools.
• Updated README.md feature list with runtime diagnostics capabilities.

Fixed

• YAML config flag compatibility:
  • Added --conf support as an alias for --config in argument parsing.
  • Fixed YAML template flow: when config file is missing, template generation now exits cleanly instead of continuing into inspection-only mode.
• YAML env config clarity:
  • Added env-path YAML option to map directly to --env-path.
  • Clarified env as destination name and removed duplicate allowed-origins entry in template.
• HTTP/SSE connection context resolution:
  • Enforced priority: x-mcp-destination header -> server default destination (--mcp / --env-path) -> 400 error.
  • HTTP default-destination broker initialization now uses the resolved destination key.

Changed

• .env parsing policy:
  • Inline comments are no longer parsed from values.
  • # is treated as a comment only when it starts the line.
  • This avoids accidental truncation of secrets containing # (for example passwords/tokens).
• Update tool error handling:
  • Added unified ADT/SAP error extraction for update handlers to improve 409 conflict diagnostics.
  • XML exception payloads (exc:exception) are now surfaced as detailed user-facing errors in previously generic update flows.
• GetTypeInfo structure fallback:
  • Added optional structure lookup fallback (include_structure_fallback, default: true).
  • Fallback is executed only when type lookups return 404 or empty result.
  • Non-404 errors no longer silently fall through to unrelated lookups.

Documentation

• Updated .env comments guidance in:
  • README.md
  • docs/user-guide/AUTHENTICATION.md

Fixed

• CI (Biome): Applied formatting fixes required by npx biome check src --diagnostic-level=error.
  • src/handlers/function_module/high/handleGetFunctionModule.ts
  • src/lib/config/envResolver.ts

Changed

• Function Module handlers: Fixed parameter propagation for function module operations:
  • GetFunctionModule and DeleteFunctionModule now require and pass function_group_name.
  • GetFunction (read-only) now requires and passes function_group.
  • UpdateFunctionModule (high/low) now forwards transport_request to ADT update calls.
• CLI env resolution: Updated env argument behavior:
  • --env=<name> now resolves to platform sessions path: {sessions}/<name>.env.
  • Added --env-path=<path|file> for explicit .env file usage.
  • MCP_ENV_PATH now maps to explicit env file path behavior (same as --env-path).
• Errors: Improved function module update error messages for transport-related 400 responses and XML SAP errors.

Changed

• Tools docs generator: Reworked tools/generate-tools-docs.js to scan only handler code in src/handlers/**.
• Tools docs structure: Updated docs/user-guide/AVAILABLE_TOOLS.md hierarchy to Group (level) → Object (folder) → Tools.
• Coverage fix: Ensured BDEF and other handler folders are included consistently in generated tools documentation.

Changed

• Discoverability metadata: Updated npm keywords and package metadata to improve MCP search relevance for ABAP, ABAP Cloud, JWT/XSUAA, and service-key flows.
• Registry description: Shortened server.json description to meet the MCP publisher 100-character constraint.
• README positioning: Clarified first-screen value proposition around full CRUD, On-Premise + ABAP Cloud support, and auth options.

Added

• Docs: Added dedicated Terminology and Authentication guides, with links from README.

Changed

• README: Reworked first-screen content and links to emphasize configurator usage and destinations.
• Docs structure: Moved GitHub configuration README into deployment docs and fixed internal links.
• Client configuration docs: Linked to the configurator repo and usage guide.

Added

• Client support: Added OpenCode and Copilot configuration support.
• Claude config: Added .mcp.json project configuration and docs.
• Configurator options: Added URL, headers, and timeout options in mcp-abap-adt-configure.

Changed

• Configurator split: Removed mcp-abap-adt-configure from core. Use @mcp-abap-adt/configurator (repo: mcp-abap-adt-conf) with mcp-conf instead.
• Codex/Goose handling: Improved transport handling and timeout defaults for non-stdio transports.
• Default-disabled entries: Updated JSON config handling and docs to keep new entries disabled by default.
• Streamable HTTP: Refactored server handling for per-request connections.

Fixed

• Goose config: Corrected enabled state handling in writeGooseConfig.

Added

• MCP Registry metadata: Added server.json and mcpName for registry publishing.
• Client configurator: Added mcp-abap-adt-configure to add/enable/disable/remove MCP entries across clients.
• Auto-config docs: Added docs/installation/CLIENT_INSTALLERS.md with usage and common tasks.

Changed

• Default logger loading: Lazy-load logger to avoid bundler issues with optional transports.
• Claude config: Write MCP settings under projects.<full_path>.mcpServers for Claude CLI on Linux.
• Config defaults: New entries for Cline/Codex/Windsurf/Goose are disabled by default; enable explicitly.

Fixed

• UpdateLocalTestClass: Added detailed SAP error information for 409 conflict errors to improve troubleshooting (#6)

Fixed

• GetIncludesList, GetObjectsList, GetObjectsByType, GetEnhancements, GetObjectInfo: Migrate from deprecated fetchNodeStructure stub to AdtClient.getUtils().fetchNodeStructure() - fixes "not implemented" errors

Changed

• LowTester logging: Unified to compact format with emojis, matching LambdaTester output style

Added

• Startup diagnostics: Display SAP connection configuration at server startup when using --env parameter
  • Shows source file, SAP URL, client, auth type, and UAA URL
  • Tokens and secrets are safely masked (first/last 4 chars for long values, full mask for short)
  • Helps diagnose auth issues by showing which config is actually used

Fixed

• CreateLocalTestClass: Return full SAP error details on failure (including the original response payload).

Changed

• Documentation: Restored the stateful ADT flow guide without file-based session persistence references.
• Available tools: Regenerated docs/user-guide/AVAILABLE_TOOLS.md and restored links across docs.

Removed

• Lock/session persistence: Removed filesystem lock registry and session persistence helpers/config from core and tests.
• CLI commands: adt-lock-object, adt-unlock-object, adt-manage-locks, adt-manage-sessions, and adt-unlock-objects removed from package bins.
• User guides: Removed usage/scenario docs tied to legacy session flows.

Changed

• Lock registry types: LockState.objectType now uses AdtObjectType with normalization for legacy entries.
• adt-lock-object: No longer registers lock handles in .locks/active-locks.json; session save only.

Removed

• CLI commands: adt-unlock-object, adt-manage-locks, adt-manage-sessions, and adt-unlock-objects removed from package bins.

Changed

• @mcp-abap-adt/auth-broker: bumped to ^0.3.0 - auto-detect service key format, credentials wrapper support, debug logging
• @mcp-abap-adt/auth-stores: bumped to ^0.3.0

Fixed

• Updated @mcp-abap-adt/auth-broker so installs now pull 0.2.17 instead of the stale 0.2.14 release that was hiding upstream fixes.
• Removed the accidental @mcp-abap-adt/core dependency that caused consumers to download the old 1.4.1 tarball.

Changed

• @mcp-abap-adt/auth-broker: bumped to 0.2.15 so the locked dependency pulls in the latest fixes referenced by the release.

Fixed

• CI workflow package install: .github/workflows/ci.yml now looks for mcp-abap-adt-core-*.tgz, matching the actual npm pack output before testing global install.

Changed

• GetWhereUsed handler: Now uses getWhereUsedList() from adt-clients and returns parsed JSON with structured references instead of raw XML

Fixed

• Release workflow: Simplified to use npm registry instead of uploading tgz artifacts

Documentation

• Added glama.ai badge with security/license/quality grades
• Updated README example to use EmbeddableMcpServer instead of deprecated HandlerExporter.registerOnServer()

Added

• EmbeddableMcpServer: New server class for external integration (e.g., cloud-llm-hub)
  • Accepts injected AbapConnection from consumer
  • Extends BaseMcpServer with proper handler registration
  • Configurable exposition levels: readonly, high, low, system, search
  • Export via @mcp-abap-adt/core/server

Changed

• HandlerExporter: Now serves only as registry factory
  • Use createRegistry() to get IHandlersRegistry for custom scenarios
  • getHandlerEntries() and getToolNames() still available for inspection

Removed

• BREAKING: HandlerExporter.registerOnServer() method removed
  • Had bug with handler signature (passed context twice)
  • Replace with EmbeddableMcpServer for cleaner architecture

Migration Guide

// Before (v1.x - broken)
import { HandlerExporter } from '@mcp-abap-adt/core/handlers';
const exporter = new HandlerExporter({ includeReadOnly: true, includeHighLevel: true });
const mcpServer = new McpServer({ name: 'mcp-abap-adt', version: '1.0.0' });
exporter.registerOnServer(mcpServer, () => connection, logger);

// After (v2.x)
import { EmbeddableMcpServer } from '@mcp-abap-adt/core/server';
const server = new EmbeddableMcpServer({
  connection,
  logger,
  exposition: ['readonly', 'high'],
});
await server.connect(transport);

Documentation

• CLI Help: Extended --help output with comprehensive environment variables documentation
  • Added MCP Server Configuration section (MCP_TRANSPORT, MCP_HTTP_HOST, MCP_HTTP_PORT, MCP_SSE_HOST, MCP_SSE_PORT, MCP_ENV_PATH, MCP_UNSAFE, MCP_USE_AUTH_BROKER, MCP_BROWSER)
  • Added Debug Options section (DEBUG_HANDLERS, DEBUG_CONNECTORS, DEBUG_CONNECTION_MANAGER, HANDLER_LOG_SILENT)
  • Extended SAP Connection section with JWT/OAuth2 variables (SAP_REFRESH_TOKEN, SAP_UAA_URL, SAP_UAA_CLIENT_ID, SAP_UAA_CLIENT_SECRET, SAP_LANGUAGE)
• CLI_OPTIONS.md: Added missing environment variables documentation
  • Added MCP_UNSAFE, MCP_USE_AUTH_BROKER, MCP_BROWSER to General section
  • Added JWT/OAuth2 authentication variables to SAP Connection section
  • New Auth-Broker section with AUTH_BROKER_PATH and debug variables
  • New Debug section with handler and connector logging options
• INSTALLATION.md: Expanded Environment Variables section with full reference and link to CLI_OPTIONS.md

Fixed

• Version path: Fixed incorrect path to package.json in --version command

Changed

• Package renamed: Changed from @fr0ster/mcp-abap-adt to @mcp-abap-adt/core for npm publishing
• Package now public: Removed private: true flag to allow npm publishing

Added

• Inspection-only mode: Server can now start in stdio mode without connection parameters for tool inspection (used by glama.ai)
• MockAbapConnection: Added mock connection class for inspection-only mode that returns descriptive error when tools are executed
• Docker inspection support: Added Dockerfile.inspect and docker-compose.inspect.yml for local testing of inspection mode
• CLAUDE.md: Added project documentation for Claude Code assistance

Added

• Added integration test tests/integration/handleGetFunction.int.test.js for handleGetFunction.
• Significantly expanded integration test coverage in src/index.test.ts for all main tools (GetProgram, GetClass, GetFunctionGroup, GetFunction, GetTable, GetStructure, GetTableContents, GetPackage, GetInclude, GetTypeInfo, GetInterface, GetTransaction, GetEnhancements, GetSqlQuery, SearchObject).
• Added new checks for advanced scenarios (e.g., SQL generation, error handling, enhancement XML parsing).

Changed

• Updated documentation regarding testing and integration scenarios.

Changed

• v1 McpHandlers Refactoring: Rewrote McpHandlers to use HandlerExporter internally. This ensures the legacy embeddable server (v1) stays in sync with all tools available in v2 while reducing code duplication.
• Shared Schema Utilities: Replaced duplicated jsonSchemaToZod logic in v1 with a central implementation from src/lib/handlers/utils/schemaUtils.ts.
• Documentation Generator: Updated tools/generate-tools-docs.js category mapping to support the standardized GetBehaviorDefinition naming.

Removed

• GetBdef compatibility adapter: Removed the manual adapter for GetBdef in v1 server. All tools now use standard names (e.g., GetBehaviorDefinition).

Added

• tsx added to devDependencies for improved TypeScript execution and testing.

Added

• GetPackageContents tool: New read-only tool to retrieve objects inside an ABAP package (moved from legacy GetPackage).

Changed

• GetPackage tool: Migrated to high-level API (AdtClient.getPackage().read()). Now returns package metadata and supports version parameter (active/inactive).
• GetFunction tool: Updated to support version parameter and migrated to new adt-clients signature.
• High-level handlers: Improved parameter handling and consistency with new adt-clients versioning requirements.
• Test cleanup documentation updated to clarify afterEach behavior and multi-object cleanup requirements.
• Test runners (LowTester/HighTester) now emit step-level flow logs for validate/create/lock/update/unlock/activate.
• Package cleanup can use a fresh connection with optional connection_config for locked session cases.

Fixed

• Package create now treats ADT "import" 404 as success when the package is readable.
• Function group/module low-level create handles transient 400/empty responses with read verification.
• Table create now validates and creates with explicit descriptions to satisfy ADT requirements.
• Package low-level tests avoid double-unlock during cleanup.

Changed

• GetPackageTree now builds the tree from node-structure traversal to preserve package/subpackage hierarchy and ordering.
• Package tree nodes now include adtType, normalized type, codeFormat, and restoreStatus for parity with backup tooling.
• Migrated handler usage to AdtClient now that CrudClient/ReadOnlyClient are removed in @mcp-abap-adt/adt-clients.

Fixed

• Updated handler typings to match @mcp-abap-adt/adt-clients@0.3.2 (I* config/state interfaces).
• SearchObject now uses AdtUtils.searchObjects instead of the removed SharedBuilder export.
• Restored encodeSapObjectName helper in utils to avoid relying on unstable client exports.

Fixed

• Fixed LICENSE file - corrected copyright attribution (removed incorrect fork author)
• Fixed TypeScript compilation errors in test files:
  • Updated handlers.test.ts to use high-level handlers instead of removed readonly handlers
  • Removed non-existent getAuthHeaders import from utils.test.ts
  • Fixed sessionHelpers.ts - added type assertions for connection methods not in IAbapConnection interface (getConfig, connect)
  • Fixed ClassCrudClientDirect.test.ts - added type assertions for connect() and reset() methods
  • Fixed BehaviorImplementationLowHandlers.test.ts - removed invalid session_id and session_state parameters from UnlockClassArgs

Removed

• Removed duplicate readonly handlers that duplicate high-level CRUD operations
  • Deleted handleGetClass.ts (replaced by high-level GetClass)
  • Deleted handleGetDomain.ts (replaced by high-level GetDomain)
  • Deleted handleGetDataElement.ts (replaced by high-level GetDataElement)
  • Deleted handleGetTable.ts (replaced by high-level GetTable)
  • Deleted handleGetStructure.ts (replaced by high-level GetStructure)
  • Deleted handleGetView.ts (replaced by high-level GetView)
  • Deleted handleGetServiceDefinition.ts (replaced by high-level GetServiceDefinition)
  • Deleted handleGetProgram.ts (replaced by high-level GetProgram)
  • Deleted handleGetInterface.ts (replaced by high-level GetInterface)
  • Deleted handleGetFunctionGroup.ts (replaced by high-level GetFunctionGroup)
  • Deleted handleGetBdef.ts (replaced by high-level GetBehaviorDefinition)

Changed

• v1 server now uses high-level handlers instead of readonly duplicates
  • GetClass, GetDomain, GetDataElement, GetTable, GetStructure, GetView, GetServiceDefinition, GetProgram, GetInterface, GetFunctionGroup now use high-level handlers internally
  • GetBdef now uses GetBehaviorDefinition high-level handler with parameter adapter for backward compatibility
  • All high-level handlers support version parameter (active/inactive) for better flexibility

Fixed

• Fixed TypeScript type errors in handleGetAbapSystemSymbols.ts
  • Added proper JSON parsing for GetClass and GetInterface responses
  • Fixed type assertions for class and interface data
• Fixed TypeScript type error in utils.ts
  • Added type assertion for makeAdtRequest return type
• Fixed documentation generator (tools/generate-tools-docs.js)
  • Updated regex pattern to support multi-line imports in handler groups
  • Now correctly detects all handlers including system and search handlers
  • Documentation now includes all 219 tools (76 high-level, 116 low-level, 27 read-only)

Changed

• Migrated from ESLint+Prettier to Biome
  • Removed ESLint and Prettier dependencies
  • Added @biomejs/biome for faster linting and formatting
  • Configured Biome with strict rules for production code
  • Relaxed rules for test files (noImplicitAnyLet, noExplicitAny)
  • Updated package.json scripts: lint, lint:check, format
  • Updated npm run build to include Biome check before TypeScript compilation

Fixed

• Fixed TypeScript errors in production code:
  • handleGetAbapAST.ts - Fixed regex match types and while loop patterns in 4 methods
  • handleGetObjectInfo.ts - Added type annotation for packageName
  • handleDescribeByList.ts - Added type annotation for parsed
  • handleValidateDataElement.ts - Added type assertion for AxiosResponse
  • handleCreateClass.ts - Added ClassBuilderState type import
  • handleDeleteObject.ts - Changed any to unknown for response
  • handleGetEnhancementSpot.ts - Fixed array types and while loops
  • handleGetProgFullCode.ts - Fixed 3 while loops with regex.exec() pattern
• All production code now passes strict Biome rules (no implicit any, no assignments in expressions)

Added

• Added Biome check to CI workflow (.github/workflows/ci.yml)
• Added Biome check to Release workflow (.github/workflows/release.yml)

Dependencies

• Updated @mcp-abap-adt/adt-clients to ^0.2.6
• Updated @mcp-abap-adt/adt-interfaces to ^0.2.6
• Added @biomejs/biome ^2.3.10 as devDependency
• Removed eslint and prettier dependencies

Fixed

• Removed unused import of IAbapConnectionExtended from @mcp-abap-adt/interfaces
  • Interface was removed in interfaces package v1.1.0

Changed

• BREAKING: Removed legacy-server.ts
  • Full removal of 3000+ line legacy server with CLI, AuthBroker, .env parsing, etc.
  • v1 module now exports only lightweight EmbeddableMcpServer class

Added

• EmbeddableMcpServer - lightweight MCP server for embedding
  • Minimal class (~100 lines) for external HTTP server integration
  • Constructor takes context: HandlerContext with connection and logger
  • Handlers registered immediately in constructor - no run() method needed
  • Access underlying McpServer via .mcpServer getter
  • Configurable exposition levels: readonly, high, low, system

Removed

• mcp_abap_adt_server class (was 3000+ lines with CLI, transports, AuthBroker)
• setAbapConnectionOverride() function
• ServerOptions interface
• All CLI argument parsing
• All transport management (stdio, SSE, streamable-http)
• AuthBroker integration
• .env file loading logic

Migration Guide

For embedding in external servers (cloud-llm-hub, etc.):

// Before (1.2.x)
import { mcp_abap_adt_server } from '@fr0ster/mcp-abap-adt/server/v1';
const server = new mcp_abap_adt_server({ connection, allowProcessExit: false });
server.registerHandlers({ connection, logger });

// After (1.2.2)
import { EmbeddableMcpServer } from '@fr0ster/mcp-abap-adt/server/v1';
const server = new EmbeddableMcpServer({
  context: { connection, logger },
  exposition: ['readonly', 'high']
});
const mcpServer = server.mcpServer; // Use with transport

Added

• Subpath export ./utils for internal utilities access
  • @fr0ster/mcp-abap-adt/utils - exports sessionContext, getManagedConnection, and other utilities
  • Required for cloud-llm-hub integration to access session context

Changed

• GetWhereUsed now supports any ADT object type (e.g. table/TABL, bdef/BDEF, etc.), not just class, program, include, function, interface, package.
• Updated documentation in README.md and jsdoc for supported object types and usage examples.

Added

• v2 HTTP Server Injection: Added support for external HTTP application injection in v2 servers
  • New IHttpApplication interface for Express-like HTTP applications
  • StreamableHttpServer and SseServer now support app option in constructor
  • New registerRoutes(app, options?) method for embedding into existing Express/CDS/CAP servers
  • Enables integration with cloud-llm-hub and other CAP-based applications
  • Helper methods: getPath(), getSsePath(), getPostPath()

Fixed

• CLI --version flag: Fixed package.json path resolution for both v1 and v2 servers
  • Path now correctly resolves from dist/server/v1/ and dist/server/v2/ to root package.json

Added

• MCP Server v2 Architecture:

  • New modular server architecture with BaseMcpServer, StdioServer, StreamableHttpServer
  • Handler registration system with Dependency Injection pattern
  • HandlerContext for unified connection and logging access in handlers
  • ServerConfigManager for centralized configuration management
  • AuthBrokerConfig for V2 server configuration
  • StdioLogger for minimal logging in stdio transport
  • Transport-specific server implementations (stdio, SSE, HTTP)

• Headless Browser Mode: Added --browser CLI parameter for SSH and remote sessions

  • --browser=headless: Logs authentication URL and waits for manual callback
  • --browser=none: Logs URL and rejects immediately (for automated tests)
  • --browser=system: Opens system default browser (default)
  • --browser=chrome|edge|firefox: Opens specific browser
  • Environment variable: MCP_BROWSER
  • Ideal for SSH sessions, Docker containers, and CI/CD environments

• YAML Configuration Support:

  • Load server configuration from YAML files
  • Enhanced command-line transport handling
  • Improved configuration validation

• Structured Logging:

  • Handler logging with configurable options and integration
  • Structured logging for handler functions
  • Logger cleanup and enhanced handler implementations

• Testing Improvements:

  • Jest configuration and enhanced testing framework
  • Unified test refactoring roadmap with base tester classes
  • Integration tests for low-level view handlers
  • Read-only handler tests for WhereUsed analysis
  • AuthBrokerFactory for test configuration

• Infrastructure & Handlers:

  • Added tabletypes to integrated terminal profiles
  • Handler migration to infrastructure module
  • Basic auth support in MCP destination handling

Changed

• Token Refresh Architecture (Breaking):

  • Removed legacy createDestinationAwareConnection() wrapper (~150 lines)
  • Token refresh now handled internally by JwtAbapConnection via DI ITokenRefresher
  • getConnectionForSession() creates tokenRefresher from AuthBroker and passes to createAbapConnection()
  • Removed all reset() calls from 23+ handler files (no longer needed)
  • Removed unused disposeConnection() and getAuthHeaders() functions
  • Simplified HandlerContext to use IAbapConnection instead of deprecated IAbapConnectionExtended

• Handler Refactoring:

  • All handlers updated to utilize HandlerContext for connection and logging
  • Standardized import statements across handlers
  • Enhanced error handling and logging across all handlers
  • Replaced direct connection creation with managed connection

• Configuration Module:

  • Extracted configuration logic into dedicated module
  • Improved YAML configuration loading and command line parsing
  • Enhanced connection handling and configuration validation

Fixed

• Network error handling in createDestinationAwareConnection
• Handler results properly awaited and errors handled in BaseMcpServer
• Basic auth support in MCP destination handling

Removed

• Legacy test files and deprecated test scripts (85 files)
• Obsolete v2 components from earlier iterations
• Deprecated tools: update-crudclient-api.js, update-handlers-with-tool-definitions.js, etc.

Documentation

• Comprehensive documentation for various components and usage scenarios
• MCP Server architecture and implementation roadmap
• Handler refactoring roadmap
• YAML configuration support documentation
• Issue roadmap system for structured issue tracking
• Updated development guidelines

Dependencies

• @mcp-abap-adt/interfaces: ^0.2.3 → ^0.2.6
  • Removed deprecated IAbapConnectionExtended interface
  • Added ITokenRefresher interface for DI
• @mcp-abap-adt/connection: ^0.2.3 → ^0.2.5
  • createAbapConnection() now accepts 4th parameter tokenRefresher
  • JwtAbapConnection handles token refresh internally
• @mcp-abap-adt/auth-providers: ^0.2.1 → ^0.2.3 (headless mode, cross-platform fixes)
• @mcp-abap-adt/auth-broker: ^0.2.4 → ^0.2.9
  • Added createTokenRefresher() factory method
  • Headless mode passthrough
• @mcp-abap-adt/auth-stores: ^0.2.5 → ^0.2.8 (EnvFileSessionStore with JWT persistence)
• @mcp-abap-adt/clients: ^0.2.4 → ^0.2.5

Added

• Parameter Passing Unit Tests Roadmap: Added comprehensive roadmap for unit tests to verify parameter passing
  • Created doc/roadmaps/parameter_passing_unit_tests_roadmap.md
  • Detailed test strategy for verifying all parameters pass correctly from MCP handlers through CrudClient to Builder classes and finally to low-level functions
  • Test implementation plan with 4 phases covering infrastructure, individual object types, and integration tests
  • Test examples for ViewBuilder, CrudClient, and low-level functions
  • Coverage goals (100% for parameter passing) and success criteria
  • Addresses issue where parameters like transportRequest can be lost during the call chain

Documentation

• Roadmap Documentation: Added roadmap for future unit test development
  • Comprehensive plan for preventing parameter loss regression
  • Test file structure and organization guidelines
  • Maintenance and CI/CD integration recommendations

Changed

• Header Constants Migration: Replaced all hardcoded header strings with constants from @mcp-abap-adt/interfaces
  • All header references now use constants (e.g., HEADER_SAP_URL, HEADER_SAP_AUTH_TYPE, HEADER_MCP_DESTINATION, etc.)
  • Improved type safety and consistency across packages
  • Updated error messages and hints to use header constants
• Updated dependencies:
  • @mcp-abap-adt/header-validator: ^0.1.6 → ^0.1.7
    • Added comprehensive header sets documentation
    • Enhanced validation for Basic Auth and UAA refresh token sets
    • All header references migrated to constants from @mcp-abap-adt/interfaces
  • @mcp-abap-adt/interfaces: ^0.1.1 → ^0.1.2
    • Added HTTP header constants for all headers used across packages
    • Added header groups and authentication type constants

Technical

• Code Quality: Improved maintainability by centralizing header name definitions
• Type Safety: Better compile-time checking for header names

Changed

• Updated dependencies:
  • @mcp-abap-adt/auth-broker: ^0.1.9 → ^0.1.10
    • Added constructor validation for stores and tokenProvider parameters
    • Ensures required dependencies are present upon AuthBroker instantiation

Added

• Comprehensive usage documentation – Added complete MCP function call documentation:
  • Created doc/user-guide/usage/ directory with structured documentation
  • Simple Objects (22 files): High-level and low-level handlers for 11 object types:
    • Classes, Interfaces, Programs, Function Groups, Function Modules
    • Tables, Structures, CDS Views, Domains, Data Elements, Service Definitions
    • Each object has separate -high.md and -low.md files with exact MCP call examples
  • RAP Business Objects documentation:
    • Complete workflow for creating RAP BO with all components
    • Deferred group activation guide
    • Step-by-step examples with exact MCP function calls
  • All documentation uses compact, laconic format with only exact MCP calls and parameters
  • No unnecessary descriptions, maximum clarity
• Test syntax checking – Added npm run test:check command:
  • Performs TypeScript syntax check on test files without running tests
  • Uses tsc --noEmit -p tsconfig.test.json
  • Helps catch type errors before running tests

Changed

• Updated dependencies to latest versions:
  • @mcp-abap-adt/adt-clients: ^0.1.35 → ^0.1.36
  • @mcp-abap-adt/auth-broker: ^0.1.8 → ^0.1.9
  • @mcp-abap-adt/auth-providers: ^0.1.1 → ^0.1.2
  • @mcp-abap-adt/auth-stores: ^0.1.3 → ^0.1.4
  • @mcp-abap-adt/connection: ^0.1.14 → ^0.1.15
  • @mcp-abap-adt/header-validator: ^0.1.4 → ^0.1.6
  • @mcp-abap-adt/interfaces: ^0.1.1 (unchanged)
  • @mcp-abap-adt/logger: ^0.1.0 → ^0.1.1

Fixed

• TypeScript type errors in TableLowHandlers.test.ts – Fixed type inference issues:
  • Corrected lockSessionForCleanup variable declaration and usage
  • Fixed type narrowing in catch and finally blocks

Added

• --mcp=<destination> parameter – Default MCP destination name for auth-broker:
  • Allows using auth-broker (service keys) with stdio and SSE transports
  • When specified, this destination is used when x-mcp-destination header is not provided in requests
  • For stdio transport: Server initializes auth-broker with the specified destination at startup
  • For SSE transport: Server uses the specified destination as fallback when header is missing
  • For HTTP transport: Server uses the specified destination as fallback when header is missing
  • Example: mcp-abap-adt --transport=stdio --mcp=TRIAL
  • This enables auth-broker usage with stdio and SSE transports, which previously required .env file configuration

Changed

• Auth-broker support for stdio and SSE transports – Extended getOrCreateAuthBroker() to support stdio and SSE transports:
  • Previously, auth-broker was only available for HTTP/streamable-http transport
  • Now works with all transport types when --mcp parameter is specified
  • For stdio: Auth-broker is initialized at server startup with the destination from --mcp parameter
  • For SSE: Auth-broker works the same way as HTTP transport (via headers or --mcp fallback)

Fixed

• --mcp parameter now skips .env file loading – When --mcp is specified:
  • .env file is not automatically loaded (even if it exists in current directory)
  • .env file is not considered mandatory for stdio and SSE transports
  • Auth-broker configuration takes precedence over .env file
  • This ensures that --mcp parameter works correctly without conflicts from .env file settings
• SSE transport with --mcp parameter – Fixed issue where SSE transport was using .env configuration instead of auth-broker when --mcp was specified:
  • Server now initializes auth-broker at startup for SSE transport when --mcp is provided
  • applyAuthHeaders() now handles empty headers correctly when defaultMcpDestination is set
  • Configuration from auth-broker takes precedence over .env file

Documentation

• Updated CLI_OPTIONS.md with --mcp parameter documentation and examples
• Updated CLIENT_CONFIGURATION.md with information about using --mcp parameter for stdio and SSE transports
• Added examples for Cline configuration with stdio transport and --mcp parameter
• Updated help text in both src/index.ts and bin/mcp-abap-adt.js with --mcp parameter information

Changed

• Safe session storage by default – Session data is now stored in-memory using SafeSessionStore by default:
  • Session tokens are no longer persisted to disk by default (secure by default)
  • Session data is lost after server restart (requires re-authentication)
  • Use --unsafe flag to enable file-based session storage (legacy behavior)
  • File-based storage (UnixFileSessionStore/WindowsFileSessionStore) is only used when --unsafe is specified

Added

• --unsafe flag – Enables file-based session storage (persists tokens to disk):
  • When specified, session data is saved to platform-specific locations:
    • Unix: ~/.config/mcp-abap-adt/sessions/{destination}.env
    • Windows: %USERPROFILE%\Documents\mcp-abap-adt\sessions\{destination}.env
  • Can be set via environment variable: MCP_UNSAFE=true
  • Use this flag if you need session persistence across server restarts

Dependencies

• Updated @mcp-abap-adt/auth-broker to ^0.1.5:
  • Benefits from new SafeSessionStore implementation (in-memory, secure)
  • Updated to use new ISessionStore interface (replaces SessionStore)

Fixed

• Help text correction – fixed incorrect help message for x-mcp-destination header:
  • Removed incorrect statement that x-mcp-destination requires x-sap-url header
  • Updated help text to correctly state that URL is automatically derived from service key (same as x-sap-destination)
  • Help text now accurately reflects that x-sap-url is not required and will be ignored if provided

Dependencies

• Updated @mcp-abap-adt/adt-clients to ^0.1.33:
  • Benefits from optimized CSRF token endpoint (/sap/bc/adt/core/discovery)
  • Faster connection initialization for all CRUD operations
• Updated @mcp-abap-adt/auth-broker to ^0.1.4:
  • Benefits from optimized CSRF token endpoint in connection layer
  • Faster authentication flows when managing JWT tokens

Added

• ABAP Unit class test tools: Added [low-level] handlers to cover the new CrudClient APIs for class test includes and ABAP Unit orchestration:
  • LockClassTestClassesLow, UpdateClassTestClassesLow, UnlockClassTestClassesLow, ActivateClassTestClassesLow
  • RunClassUnitTestsLow, GetClassUnitTestStatusLow, GetClassUnitTestResultLow
  • All new tools live in class/low/ and are registered with the server and documentation generator.
• Package creation options: CreatePackage (high- and low-level) now accepts optional package_type, software_component, transport_layer, application_component, and responsible parameters and forwards them directly to CrudClient, enabling Cloud systems to pass values such as ZLOCAL while keeping the transport layer empty.

Fixed

• x-mcp-destination validation – fixed issue where x-mcp-destination header was incorrectly requiring x-sap-url:
  • x-mcp-destination now works identically to x-sap-destination - URL is automatically derived from service key
  • x-sap-url is now optional for x-mcp-destination (and will be ignored with a warning if provided)
  • Fixed issue on Windows where x-mcp-destination was being ignored
  • Updated header validator to check headers in both lowercase and original case for better compatibility

Added

• Custom auth-broker path – added --auth-broker-path command-line option:

  • Allows specifying custom base path for service keys and sessions
  • Automatically creates service-keys and sessions subdirectories in the specified path
  • Example: --auth-broker-path=~/prj/tmp/ uses ~/prj/tmp/service-keys/ and ~/prj/tmp/sessions/
  • Directories are created automatically if they don't exist
  • Can be used together with --auth-broker flag

• Automatic directory creation – service keys and sessions directories are now created automatically:

  • Directories are created at server startup if they don't exist
  • Prevents errors when saving sessions for the first time
  • Works for both default platform paths and custom --auth-broker-path

• Enhanced startup information – improved auth-broker path display at server startup:

  • Shows all search paths for service keys (in order of priority)
  • Shows all save paths for sessions
  • Formatted with clear visual separators for better readability
  • Only displayed when --auth-broker flag is used

• Diagnostic logging – added platform-aware logging for better debugging:

  • Logs platform information when processing authentication headers
  • Logs all header keys that start with x-sap or x-mcp
  • Logs search paths when creating AuthBroker instances
  • Helps diagnose issues on different platforms (especially Windows)

Changed

• Header validation logic – improved validation order and case handling:

  • x-mcp-destination is now checked immediately after x-sap-destination, regardless of x-sap-url presence
  • Added case-insensitive header checking for better compatibility
  • Both x-sap-destination and x-mcp-destination now check headers in both lowercase and original case

• Documentation updates – comprehensive documentation improvements:

  • Added --auth-broker-path parameter documentation in help text
  • Updated CLIENT_CONFIGURATION.md with custom path examples
  • Updated INSTALLATION.md with new command-line option
  • Updated SERVICE_KEY_SETUP.md with custom path usage examples
  • Added Cline configuration example in help text

Dependencies

• Updated @mcp-abap-adt/auth-broker to ^0.1.3 – upgraded to latest version
• Updated @mcp-abap-adt/header-validator to ^0.1.3 – upgraded to latest version

Changed

• Help documentation improvements – updated help messages with detailed instructions for saving service keys:
  • Added platform-specific instructions for Linux, macOS, and Windows
  • Replaced example JSON structure with instructions to copy service key from SAP BTP
  • Fixed backslash escaping in Windows PowerShell commands
  • Updated both launcher help (bin/mcp-abap-adt.js) and server help (src/index.ts)
  • Updated documentation files: SERVICE_KEY_SETUP.md and CLIENT_CONFIGURATION.md

Changed

• Handler refactoring – migrated handlers to use CrudClient and SharedBuilder from @mcp-abap-adt/adt-clients:

  • handleSearchObject now uses SharedBuilder.search() instead of manual URL construction
  • Eliminates redundant URL concatenation and potential duplication errors
  • Better code reuse and consistency across handlers

• URL handling simplification – removed unnecessary URL cleaning logic:

  • URLs from .env files and service keys are expected to be clean
  • Removed aggressive URL cleaning that was causing issues
  • Only basic trimming is performed where needed

• Transport-specific auth-broker handling – auth-broker is now ignored for stdio and sse transports:

  • AuthBroker initialization is skipped for non-HTTP transports
  • Prevents unnecessary errors and resource usage
  • .env file is used directly for stdio and sse transports

Fixed

• URL duplication in stdio transport – fixed incorrect URL formation when using stdio transport:
  • Resolved getaddrinfo ENOTFOUND ...comhttps errors
  • Proper URL handling in connection initialization
  • Correct .env file parsing for stdio mode

Added

• Lazy AuthBroker initialization – AuthBroker instances are now created on-demand per destination:

  • AuthBroker is only created when a destination is actually needed (not at server startup)
  • Each destination gets its own AuthBroker instance, cached in a map for reuse
  • Reduces memory usage and startup time when auth-broker is not needed
  • Default AuthBroker instance for non-destination requests

• Improved method filtering – only tools/call requires SAP configuration:

  • All other MCP methods (tools/list, tools/get, initialize, ping, notifications/initialized, etc.) work without SAP config
  • Prevents unnecessary authentication errors for metadata requests
  • Better separation between metadata operations and actual tool execution

Changed

• AuthBroker instance management – switched from single instance to per-destination map:

  • authBrokers map stores AuthBroker instances keyed by destination name
  • defaultAuthBroker for requests without specific destination
  • Lazy initialization via getOrCreateAuthBroker() method
  • Better isolation between different destinations

• Platform store imports – fixed ES module compatibility:

  • Replaced require() with static imports in getPlatformStores()
  • Fixes "UnixFileSessionStore is not a constructor" error
  • Proper ES module support for platform-specific stores

Fixed

• ES module compatibility – fixed "UnixFileSessionStore is not a constructor" error:

  • Changed getPlatformStores() to use static imports instead of require()
  • Properly handles ES module exports for Unix/Windows store implementations
  • AuthBroker now correctly initializes on Unix systems

• Request processing logic – improved handling of requests that don't require SAP connection:

  • Only tools/call method triggers SAP configuration validation
  • All other methods bypass authentication checks
  • Prevents false errors for metadata and initialization requests

Added

• Cross-platform session storage – optional persistent session management:

  • Session storage now disabled by default (stateless mode)
  • Enable via MCP_ENABLE_SESSION_STORAGE=true environment variable
  • Custom session directory via MCP_SESSION_DIR=/path/to/sessions
  • Platform-specific defaults: Windows temp dir, /tmp on Linux, /var/folders on macOS
  • Prevents ENOENT errors when running from different working directories

• Cline configuration documentation – comprehensive setup guide:

  • Created doc/installation/CLINE_CONFIGURATION.md with detailed configuration for all transport types
  • Added example configs in doc/installation/examples/ for NPX, global install, and local development
  • Platform-specific notes for macOS, Linux, and Windows
  • Session storage configuration examples and best practices
  • Troubleshooting guide for common connection issues

• Cross-platform fixes documentation – created doc/development/CROSS_PLATFORM_FIXES.md:

  • Documented dotenv removal and stdio transport fixes
  • Cross-platform path handling with os.tmpdir() and path.join()
  • Platform-specific session storage locations
  • Testing instructions for all three transports (stdio, HTTP, SSE)

Changed

• Session storage architecture – improved reliability and cross-platform support:

  • Moved from relative .sessions path to absolute paths using os.tmpdir()
  • Session storage now optional and controlled by environment variables
  • Removed FileSessionStorage usage from individual handlers (e.g., handleDeletePackage)
  • All session management now centralized in connection manager (utils.ts)

• Environment variable documentation – comprehensive env var reference:

  • Added table of all available environment variables in Cline configuration docs
  • Documented MCP_ENABLE_SESSION_STORAGE and MCP_SESSION_DIR usage
  • Platform-specific default values and examples
  • Guidance on when to enable/disable session storage

Fixed

• Session directory creation errors – fixed ENOENT: no such file or directory, mkdir '/.sessions':

  • Replaced relative .sessions path with absolute paths
  • Session directory now uses OS-specific temp directory by default
  • Works correctly when running as global npm package or via npx
  • No longer depends on current working directory

• Handler session management – simplified connection handling:

  • Removed custom FileSessionStorage creation in handleDeletePackage
  • Deprecated force_new_connection parameter (now ignored)
  • All connections use centralized session management
  • Restart server to force new session instead of per-handler sessions

Dependencies

• No dependency changes in this release

Removed

• dotenv dependency – completely removed dotenv package from dependencies:
  • Eliminated dotenv as a dependency to prevent stdout pollution in stdio mode
  • Resolved "[dotenv@17."... is not valid JSON error that was breaking stdio transport
  • Server now uses manual .env file parsing for all transport modes

Changed

• .env file parsing – replaced dotenv library with manual parsing:

  • Manual .env file parsing for all transport modes (stdio, http, sse)
  • Supports both Unix (\n) and Windows (\r\n) line endings
  • Handles comments, quoted values, and empty lines correctly
  • Cross-platform compatible (works on Linux, Windows, macOS)
  • No external dependencies for environment variable loading

• stdio mode auto-detection – improved stdio mode detection:

  • Auto-detects stdio mode when stdin is not a TTY (piped by MCP Inspector or other tools)
  • Checks !process.stdin.isTTY in addition to command-line arguments and environment variables
  • Allows seamless connection from MCP Inspector and other stdio-based clients without explicit --transport=stdio flag

• stderr handling in stdio mode – restored stderr for error logging:

  • Following reference implementation pattern, stderr is now available for error logging in stdio mode
  • stdout remains reserved exclusively for MCP JSON-RPC protocol
  • console.error() and console.warn() now work correctly in stdio mode (write to stderr)

Fixed

• stdio transport connection – fixed issue where server was not connecting properly in stdio mode:
  • Server now correctly detects stdio mode when launched by MCP Inspector
  • Tools are properly registered and available when connecting via stdio
  • Resolved connection issues that prevented tools from being listed

Dependencies

• Updated @mcp-abap-adt/connection to ^0.1.12:
  • Connection package no longer reads .env files or depends on dotenv
  • Consumers must pass SapConfig directly to connection constructors
• Updated @mcp-abap-adt/adt-clients to ^0.1.27:
  • Updated to work with connection@0.1.12
  • Fixed example scripts to use manual .env parsing

Fixed

• Git tag management – fixed issues with release tag creation and management:
  • Corrected tag placement on the latest commit with CHANGELOG updates
  • Ensured proper tag synchronization between local and remote repositories
  • Fixed tag deletion and recreation workflow for release management

Added

• Command-line flags --version/-v and --help/-h – added support for standard command-line flags:
  • --version or -v – displays package version and exits
  • --help or -h – displays help message and exits
  • Flags are processed before any other initialization, allowing quick version/help checks

Changed

• .env file search logic – improved .env file discovery and loading:

  • Search location: Now searches for .env file only in the current working directory (where the command is executed)
  • No recursive search: Removed fallback searches in parent directories or project root
  • Explicit path support: Still supports --env=/path/to/.env or MCP_ENV_PATH environment variable for custom locations
  • Cross-platform paths: Uses path.resolve() and path.join() for proper path handling on Windows, Linux, and macOS

• Transport mode and .env file relationship – refined logic for transport mode selection and .env file requirements:

  • Default behavior: If transport is not explicitly specified and no .env file is found, server starts in HTTP mode (no .env required)
  • Explicit transport with .env: If transport is explicitly set to stdio or sse but .env file is missing, server exits with clear error message
  • Explicit transport without .env: If transport is explicitly set to http or streamable-http, server starts without .env file (as expected)
  • Error messages: Improved error messages that clearly indicate what transport mode requires .env file and how to specify custom .env location

Fixed

• Cross-platform compatibility – ensured all file path operations work correctly on Windows, Linux, and macOS:
  • All path operations use Node.js path module methods (path.join(), path.resolve(), path.isAbsolute())
  • Proper handling of Windows path separators (\) vs Unix path separators (/)
  • Version reading from package.json uses cross-platform path resolution

Fixed

• Handler parameter schemas alignment with CrudClient – comprehensive fix to ensure all handler input schemas match actual CrudClient method parameters:
  • Data Element handlers:
    • Added type_name parameter to handleCreateDataElement schema (was missing but used in code)
    • Added search_help, search_help_parameter, set_get_parameter to handleUpdateDataElement schema (now properly passed to builder)
    • Updated field label descriptions to clarify they are applied during update step after creation
  • Domain handlers:
    • Removed unsupported parameters from handleCreateDomain low-level handler: domain_type, application, master_system, responsible
  • Program handlers:
    • Removed master_system and responsible from both high and low-level handlers (these are set automatically by system)
  • Class handlers:
    • Removed master_system and responsible from high-level handler schema (set automatically by system)
    • Removed master_system and responsible from low-level handler schema and code
  • Interface handlers:
    • Removed master_system and responsible from both high and low-level handlers (set automatically by system)
  • Structure, View, Table handlers:
    • Removed master_system and responsible from low-level create handlers (set automatically by system)
  • Behavior Definition, Metadata Extension handlers:
    • Removed master_system and responsible from low-level create handlers (set automatically by system)
  • Impact: All handler schemas now accurately reflect what parameters are actually supported and used by CrudClient methods, preventing confusion and ensuring correct API usage

Changed

• Data Element handlers – search help support – enhanced data element handlers to support search help configuration:
  • handleCreateDataElement now accepts search_help, search_help_parameter, set_get_parameter parameters
  • handleUpdateDataElement now accepts search_help, search_help_parameter, set_get_parameter parameters
  • These parameters are properly passed through to DataElementBuilder and included in update operations
  • Enables full configuration of search help and parameter settings for data elements

Dependencies

• Updated @mcp-abap-adt/adt-clients to ^0.1.26 – upgraded to latest version which includes:
  • Added searchHelp, searchHelpParameter, setGetParameter to DataElementBuilderConfig
  • Updated DataElementBuilder.update() to pass search help parameters to UpdateDataElementParams
  • Full support for search help configuration in data element operations

Fixed

• DomainHighHandlers - Update workflow detection bug – fixed critical issue where domain update operations were incorrectly using CREATE workflow instead of UPDATE workflow:
  • Root cause: DomainBuilder.update() method determines which workflow to use (CREATE vs UPDATE) by checking if this.state.createResult exists. When CrudClient.getDomainBuilder() reuses a builder instance from a previous createDomain() call, the builder still has createResult in its state, causing update() to incorrectly use CREATE workflow (upload() function) instead of UPDATE workflow (updateDomain() function).
  • Solution: Modified handleUpdateDomain to pass packageName directly to lockDomain() call, ensuring the builder is created with correct configuration from the start. This prevents builder reuse issues and ensures proper workflow detection.
  • Additional fix: Removed redundant validation step from handleUpdateDomain handler. The validation was checking if domain exists, but lockDomain() will fail if domain doesn't exist anyway, making the validation step unnecessary and potentially causing confusion.
  • Impact: Domain update operations now correctly use UPDATE workflow for existing domains, preventing "Domain already exists" errors that were occurring when the system tried to create an already-existing domain.

Changed

• DomainHighHandlers test logging – completely refactored test logging system for better information density and clarity:
  • Removed verbose debugLog() system – eliminated all debugLog() calls that were cluttering test output with verbose JSON structures and nested data objects
  • Introduced concise logging – replaced with simple, informative console.log() statements that provide clear, actionable information:
    • Clear operation names (e.g., "High Create: Creating domain...", "High Update: Updating domain...")
    • Success/failure status with object names
    • Skip reasons when tests are skipped
    • Visual infographics (emojis) for quick visual scanning of test output
  • Simplified error handling – removed redundant try-catch blocks and verbose error logging, now relies on Jest's native error handling which provides better stack traces
  • More informative output – each log statement now provides essential information (operation type, object name, status) without JSON noise
  • Consistent with other tests – matches logging patterns used in BehaviorDefinitionHighHandlers, PackageHighHandlers, and other high-level handler tests
  • Better maintainability – removed ~50 lines of verbose debug logging code, making tests easier to read and maintain
  • Improved debugging – concise logs make it easier to identify which operation failed and why, without scrolling through JSON dumps

Dependencies

• Updated @mcp-abap-adt/adt-clients to ^0.1.25 – upgraded to latest version which includes:
  • Improved DomainBuilder.update() workflow detection logic
  • Better handling of CREATE vs UPDATE workflow selection based on builder state
  • Enhanced error messages for domain operations

Documentation

• Test Issues Roadmap – comprehensive update to development roadmap:
  • Issue #10 (DomainHighHandlers) – changed status from "Expected Skip" to "Fixed" with detailed explanation
  • Updated statistics: 8 fixed issues (was 7), 1 expected skip (was 3)
  • Added detailed problem analysis: Documented root cause, solution approach, and code changes
  • Improved issue tracking: Better categorization of issues vs expected skips vs cloud limitations

Development Process

• Issue Roadmap System – introduced systematic problem analysis and resolution tracking:
  • New workflow: Test failures are now systematically analyzed and documented in doc/development/TEST_ISSUES_ROADMAP_*.md
  • Issue classification: Problems are categorized as Simple (⚡) or Complex (🔍), with clear distinction between real issues and expected skips
  • Problem analysis: Each issue includes detailed error messages, root cause analysis, solution approach, and code references
  • Progress tracking: Roadmap maintains statistics on fixed vs pending vs expected issues, providing clear visibility into test suite health
  • Solution documentation: All fixes are documented with code references, making it easier to understand what was changed and why
  • Continuous improvement: Roadmap is updated after each test run, ensuring it reflects current state and helps prioritize future work
  • Benefits: Enables faster problem resolution, prevents duplicate work, and provides historical context for similar issues

Added

• Client Connection Isolation: Implemented per-session connection isolation to prevent data mixing between different clients

  • Each client session now maintains its own isolated SAP connection based on sessionId and configuration hash
  • Connections are cached per unique combination of sessionId + sapUrl + authentication parameters
  • Uses AsyncLocalStorage to pass session context to handlers, ensuring each request uses the correct connection
  • Prevents race conditions where concurrent requests from different clients could overwrite each other's connection settings
  • Backward compatible: falls back to global connection cache for non-HTTP transports (stdio)

• Non-Local Connection Restrictions: Added security restrictions for non-local connections

  • SSE Transport: Always restricted to localhost connections only (127.0.0.1, ::1, localhost)
  • HTTP Transport: Non-local connections are restricted when:
    • .env file exists (was found at startup)
    • AND request does not include SAP connection headers (x-sap-url, x-sap-auth-type)
  • Non-local connections with SAP headers are allowed (enables multi-tenant scenarios)
  • Local connections are always allowed regardless of .env file presence
  • Clear error messages guide users when connections are rejected

Changed

• Connection Management: Refactored getManagedConnection() to support session-based connection caching

  • Added generateConnectionCacheKey() function to create unique cache keys from sessionId and config signature
  • Implemented getConnectionForSession() to retrieve or create session-specific connections
  • Added automatic cleanup of old connection cache entries (older than 1 hour)
  • Each session uses unique sessionId for its AbapConnection to prevent session mixing

• Session Tracking: Enhanced streamableHttpSessions to store SAP configuration per session

  • Added sapConfig field to session objects to track configuration per client
  • applyAuthHeaders() now stores configuration in session object
  • Session cleanup automatically removes associated connection from cache

Security

• Connection Isolation: Prevents one client from receiving another client's data when multiple clients connect to different SAP systems
• Access Control: Restricts non-local access when .env file is present, requiring explicit SAP headers for remote connections

Added

• Client Connection Isolation: Implemented per-session connection isolation to prevent data mixing between different clients

  • Each client session now maintains its own isolated SAP connection based on sessionId and configuration hash
  • Connections are cached per unique combination of sessionId + sapUrl + authentication parameters
  • Uses AsyncLocalStorage to pass session context to handlers, ensuring each request uses the correct connection
  • Prevents race conditions where concurrent requests from different clients could overwrite each other's connection settings
  • Backward compatible: falls back to global connection cache for non-HTTP transports (stdio)

• Non-Local Connection Restrictions: Added security restrictions for non-local connections

  • SSE Transport: Always restricted to localhost connections only (127.0.0.1, ::1, localhost)
  • HTTP Transport: Non-local connections are restricted when:
    • .env file exists (was found at startup)
    • AND request does not include SAP connection headers (x-sap-url, x-sap-auth-type)
  • Non-local connections with SAP headers are allowed (enables multi-tenant scenarios)
  • Local connections are always allowed regardless of .env file presence
  • Clear error messages guide users when connections are rejected

Changed

• Connection Management: Refactored getManagedConnection() to support session-based connection caching

  • Added generateConnectionCacheKey() function to create unique cache keys from sessionId and config signature
  • Implemented getConnectionForSession() to retrieve or create session-specific connections
  • Added automatic cleanup of old connection cache entries (older than 1 hour)
  • Each session uses unique sessionId for its AbapConnection to prevent session mixing

• Session Tracking: Enhanced streamableHttpSessions to store SAP configuration per session

  • Added sapConfig field to session objects to track configuration per client
  • applyAuthHeaders() now stores configuration in session object
  • Session cleanup automatically removes associated connection from cache

Security

• Connection Isolation: Prevents one client from receiving another client's data when multiple clients connect to different SAP systems
• Access Control: Restricts non-local access when .env file is present, requiring explicit SAP headers for remote connections

Added

• DDLX (Metadata Extension) Management Tools:

  • CreateMetadataExtension: Create new ABAP Metadata Extensions (DDLX) with automatic activation
  • UpdateMetadataExtension: Update source code of existing Metadata Extensions
  • Full CRUD workflow: Create → Lock → Check → Unlock → Activate
  • Support for transport request validation
  • Integrated with CrudClient API for consistent behavior

• BDEF (Behavior Definition) Management Tools:

  • CreateBehaviorDefinition: Create new ABAP Behavior Definitions (BDEF) with support for Managed, Unmanaged, Abstract, and Projection implementation types
  • UpdateBehaviorDefinition: Update source code of existing Behavior Definitions
  • Full CRUD workflow: Create → Lock → Check → Unlock → Activate
  • Support for root entity specification and implementation type selection
  • Transport request validation integrated

• Full Low-Level CRUD Coverage:

  • Added dedicated create, lock, unlock, check, validate, delete, and update handlers for classes, programs, interfaces, function groups/modules, domains, data elements, packages, tables, views, structures, transports, and more to cover every CrudClient method.
  • Each handler now has a consistent naming scheme (CreateX, UpdateX, etc.) to match the high-level counterparts.

• System Management Tools:

  • GetInactiveObjects: Retrieve list of inactive ABAP objects (objects that have been modified but not activated)
  • Provides count and detailed list of objects waiting for activation
  • Useful for monitoring development progress and identifying objects requiring attention

Changed

• Handler Organization Refactoring: All handlers reorganized into categorized subdirectories with explicit high/, low/, and readonly/ layers for better maintainability. Each low-level handler description now starts with [low-level], and every read handler was moved to the new readonly/ folders and tagged [read-only]. This improves discoverability, enforces single-responsibility boundaries, and makes it clear which tools mutate SAP data.

  • bdef/ - Behavior Definition handlers (GetBdef, CreateBehaviorDefinition, UpdateBehaviorDefinition)
  • class/ - Class handlers (GetClass, CreateClass, UpdateClass, ValidateClass, CheckClass)
  • common/ - Common handlers (ActivateObject, DeleteObject, CheckObject, LockObject, UnlockObject, ValidateObject)
  • data_element/ - Data Element handlers (GetDataElement, CreateDataElement, UpdateDataElement)
  • ddlx/ - Metadata Extension handlers (CreateMetadataExtension, UpdateMetadataExtension)
  • domain/ - Domain handlers (GetDomain, CreateDomain, UpdateDomain)
  • enhancement/ - Enhancement handlers (GetEnhancements, GetEnhancementImpl, GetEnhancementSpot)
  • function/ - Function handlers (GetFunction, GetFunctionGroup, CreateFunctionGroup, CreateFunctionModule, UpdateFunctionModule, ValidateFunctionModule, CheckFunctionModule)
  • include/ - Include handlers (GetInclude, GetIncludesList)
  • interface/ - Interface handlers (GetInterface, CreateInterface, UpdateInterface)
  • package/ - Package handlers (GetPackage, CreatePackage)
  • program/ - Program handlers (GetProgram, CreateProgram, UpdateProgram)
  • search/ - Search handlers (SearchObject, GetObjectsByType, GetObjectsList)
  • structure/ - Structure handlers (GetStructure, CreateStructure)
  • system/ - System handlers (GetTypeInfo, GetTransaction, GetSqlQuery, GetWhereUsed, GetObjectInfo, GetSession, GetAbapAST, GetAbapSemanticAnalysis, GetAbapSystemSymbols, GetAllTypes, GetObjectStructure, GetObjectNodeFromCache, GetInactiveObjects)
  • table/ - Table handlers (GetTable, GetTableContents, CreateTable, ValidateTable, CheckTable)
  • transport/ - Transport handlers (GetTransport, CreateTransport)
  • view/ - View handlers (GetView, CreateView, UpdateView)
  • This reorganization improves code navigation, reduces merge conflicts, and makes the codebase more maintainable

• Dependencies Updated:

  • @mcp-abap-adt/adt-clients: ^0.1.9 → ^0.1.12
  • @mcp-abap-adt/connection: ^0.1.4 → ^0.1.9
  • Updated to leverage new CrudClient methods for DDLX and BDEF operations

• Index and Tools Registry Updates:

  • src/index.ts: Updated all handler imports to reflect new subdirectory structure
  • src/lib/toolsRegistry.ts: Updated tool definitions imports to match new handler locations
  • All 81 handler files moved and imports updated consistently

• Tooling Improvements:

  • tools/generate-tools-docs.js now outputs a navigation tree that mirrors the document structure, separates high-/low-/read-only tools, and adds summary counts for each level.
  • doc/user-guide/AVAILABLE_TOOLS.md regenerated to include the new navigation, level-specific anchors, and the [read-only] marker.
  • Test suite, configs, and helper scripts updated to follow the new directory layout and renamed high-level handlers (UpdateClass, UpdateProgram, etc.).

• Low-Level Tool Names:

  • Every low-level handler now advertises a unique MCP tool name suffixed with Low (e.g., CreateClassLow, UpdateDomainLow, LockPackageLow). This prevents Tool <name> is already registered errors when both low/high versions exist and keeps the server compatible with clients that look up tools by name.

Documentation

• Added implementation_plan.md: Plan for future refactoring of read handlers to src/readers directory
• Removed roadmap.md: Work items are complete, so the standalone roadmap is no longer required

Documentation for this tag is intentionally minimal; see the Git tag v1.1.8 for its exact contents.

Documentation

• Comprehensive CLI documentation: Added detailed documentation for all command line options and configuration
  • Updated README.md with global installation guide and CLI usage examples
  • Enhanced INSTALLATION.md with complete CLI options reference
  • Created new CLI_OPTIONS.md with comprehensive command line reference
  • Documented environment file priority and auto-discovery behavior
  • Added troubleshooting section for common CLI issues

Added

• --help flag: Added comprehensive help message showing all CLI options, environment variables, and usage examples
  • Shows transport options (stdio, http, sse)
  • Lists all HTTP and SSE configuration options
  • Documents SAP connection environment variables
  • Includes practical usage examples

Fixed

• Global installation .env loading: Fixed .env file discovery for globally installed packages
  • Now correctly prioritizes process.cwd()/.env (user's working directory) over package directory
  • Works correctly when installed via npm install -g
  • Better error messages showing current directory and suggesting --env flag
• --env argument parsing: Fixed custom .env file path support
  • Both --env=/path/to/.env and --env /path/to/.env formats now work correctly
  • Relative paths are resolved from current working directory
  • Clear feedback messages showing which .env file is being used
• Runtime dependencies: Moved dotenv from devDependencies to dependencies
  • Fixes "Cannot find module 'dotenv'" error when installed globally
  • Ensures all runtime dependencies are available in production

Changed

• All handlers refactored to use CrudClient – replaced Builder pattern with unified CrudClient API
  • 18 handlers converted: Create (Program, DataElement, Domain, FunctionGroup, FunctionModule, Package, Structure, Table, Transport, View), Update (ClassSource, DataElement, InterfaceSource), Check (Class, FunctionModule, Table, Object), Validate (Class, Object), Lock/Unlock (Object)
  • Removed direct Builder instantiation from all handlers
  • All CRUD operations now use CrudClient methods (createProgram, lockClass, updateInterface, etc.)
  • Session ID no longer exposed - internal to CrudClient implementation
  • Simplified error handling with try-catch around lock/update/unlock sequences

Fixed

• utils.ts deprecated methods – added TODO comments for missing ReadOnlyClient methods
  • fetchNodeStructure() - marked for future implementation
  • getSystemInformation() - marked for future implementation
  • Both throw errors with clear TODO messages instead of attempting non-existent method calls

Added

• Parameter Optionality Sync Tool: Created tools/sync-optional-from-interfaces.js to extract optional parameter information from TypeScript interfaces
  • Extracts required vs optional fields from @mcp-abap-adt/adt-clients builder interfaces
  • Provides single source of truth for parameter optionality
  • Prevents drift between TypeScript interfaces and MCP tool definitions
  • Documentation added in doc/development/SYNC_OPTIONAL_PARAMS.md

Changed

• CreateDomain Handler: Synced parameter optionality with DomainBuilderConfig interface
  • Only domain_name is required (was incorrectly requiring package_name)
  • Marked all optional parameters with (optional) prefix in descriptions
  • Ensures consistency with TypeScript interface definitions

Fixed

• STDIO Transport: Fixed STDIO transport broken by mixing old Server and new McpServer APIs
  • Removed legacy Server class and setupHandlers() method
  • Unified all transports (STDIO, HTTP, SSE) to use single McpServer instance
  • Fixed STDIO connection to use mcpServer.server.connect(transport) pattern
  • Removed unused imports: Server, CallToolRequestSchema, ListToolsRequestSchema

Added

• SSE Development Tool: Created tools/dev-sse.js for proper SSE server development workflow
  • Launches SSE server on port 3001 (default)
  • Automatically starts MCP Inspector with correct SSE endpoint (http://localhost:3001/sse)
  • Mirrors dev-http.js functionality for consistent development experience
  • Updated npm run dev:sse to use new development script

Added

• All MCP handler functions now support an optional filePath parameter. If provided, the handler will save the result to the specified file path (any absolute or relative path, with any extension).
• All CLI test scripts now accept the --filePath=... argument to save the result to a file.
• The result written to file is exactly what is returned to the user (no extra formatting or caching).
• Improved error logging and debug output for file writing operations.
• Updated documentation and usage examples in README.md to reflect new file output support.
• Implemented utility writeResultToFile for safe file writing with directory restriction and logging.

Added

• Added integration test tests/integration/handleGetFunction.int.test.js for handleGetFunction.
• Significantly expanded integration test coverage in src/index.test.ts for all main tools (GetProgram, GetClass, GetFunctionGroup, GetFunction, GetTable, GetStructure, GetTableContents, GetPackage, GetInclude, GetTypeInfo, GetInterface, GetTransaction, GetEnhancements, GetSqlQuery, SearchObject).
• Added new checks for advanced scenarios (e.g., SQL generation, error handling, enhancement XML parsing).

Changed

• Updated documentation regarding testing and integration scenarios.

Changed

• GetWhereUsed now supports any ADT object type (e.g. table/TABL, bdef/BDEF, etc.), not just class, program, include, function, interface, package.
• Updated documentation in README.md and jsdoc for supported object types and usage examples.

Added

• New GetTransaction tool to retrieve ABAP transaction details.
  • Allows fetching transaction details using the ADT endpoint /sap/bc/adt/repository/informationsystem/objectproperties/values.
  • Added documentation in README.md.

Changed

• Added Jest Test Script index.test.ts available through npm test
• Enhanced makeAdtRequest method to support:
  • Custom headers through an optional parameter
  • Query parameters through an optional params parameter
• Improved handleGetPackage method to use ADT's nodeContent API
  • Now uses POST request with proper XML payload
  • Added specific content type headers for nodeContent endpoint
  • Added filtering to return only objects with URI
• Improved CSRF token handling in utils.ts
  • Added automatic CSRF token fetching for POST/PUT requests
  • Enhanced token extraction to work with error responses
  • Added cookie management for better session handling
  • Implemented singleton axios instance for consistent state
  • Added proper cleanup for test environments

Added

• New GetInterface tool to retrieve ABAP interface source code
  • Allows fetching source code of ABAP interfaces using the ADT endpoint /sap/bc/adt/oo/interfaces/
  • Similar functionality to GetClass but for interfaces
  • Added documentation in README.md

Added

• Initial release of the MCP ABAP ADT server
• Basic ABAP object retrieval functionality
• Support for programs, classes, function modules, and more
• Documentation and setup instructions