SAP API Policy Evidence Skill
Assesses whether a described SAP API usage aligns with the SAP API Policy, gathering live evidence from SAP's own sources and returning a sourced assessment with a stated confidence — and routing the legal questions away from itself.
The question several MCP servers in this corpus raise and none of them answer: ADT is scoped as development tooling, so is what you are about to do inside that scope? This gathers evidence against the policy — v.4.2026a and its FAQ — from SAP Help, the Business Accelerator Hub, SAP Notes, the Architecture Center and released-object data, through MCP servers, and returns an assessment that cites what it found and labels how confident it is. Installed cross-agent through the skills CLI.
Facts
Where it sits
Who is behind it
In the atlas: maintains 35, contributes to 86, wrote 25@marianfoomaintainer
Before choosing this
Conditions
PolicySAP API Policy 4.2026a§ 1.1, 1.2, 2.2.2, 3The skill is used to assess a described SAP API or interface usage scenario.
- § 1.1 Published APIs. Published APIs are made available for the documented purposes identified by SAP, including integration, extensions and data exchange.
- § 1.2 Non-Published APIs. Customer and third-party applications must not access non-published APIs except where documentation permits it or SAP otherwise authorizes it.
- § 2.2.2 AI call sequences and data extraction. Outside SAP-endorsed architectures, data services or expressly identified pathways, the policy prohibits specified agentic API use and systematic or large-scale extraction.
- § 3 Monitoring and remedies. SAP states that it may monitor API use and take enforcement actions when use does not comply with the documentation and policy.
The skill assesses scenarios against SAP API Policy v4.2026a and returns sourced evidence. Its output is not a legal or compliance decision; confirm binding questions against the applicable agreement or with SAP.
SAP API Policy 4.2026a →Also, from Tool governance§ 1.1, 1.2, 2.2.2, 3: Technical controls decide what an agent can call; the SAP API Policy separately governs whether the API is published for the intended use and identifies special AI-call and extraction cases. An evidence-gathering tool can assess against that policy but cannot issue a binding compliance decision.
PracticalFunctional boundary
It says so itself, in bold, and the atlas repeats it: not legal advice and not a compliance decision. Only SAP, your contract, or SAP support can answer bindingly, and the skill routes legal, commercial and roadmap questions there rather than guessing at them. Treat the output as evidence gathered, not as a verdict.
What it declares
Every artifact
- Type
- Skill
- Origin
- Independently maintained
As a skill
- Distributed through
- npmCopied into the project
Connections
Controlling what an agent may call, with an audit trail
A library that drives Chromium, Firefox and WebKit from code, written for end-to-end browser testing. For the things here it is the browser a tool starts itself, to get through an SAP login or to load a page headless and photograph it.
MCP server over the ADT REST API for ABAP objects
MCP server searching seventeen SAP documentation repositories
Read-only MCP server over the SAP Business Accelerator Hub
MCP server searching and fetching SAP Notes and KBAs
MCP server over SAP Road Map Explorer
Download
Learn more
- A Clearer View of Your SAP Integrations Under the New API PolicyA Clearer View of Your SAP Integrations Under the New API PolicyThe SAP API Policy Evidence Skill assesses one SAP interface or usage pattern at a time against SAP API Policy v.4.2026a, reading evidence from five MCP servers, among them servers for the Business Accelerator Hub and SAP Notes, mcp-sap-docs and a read-only ARC-1, and returns one of four labels with a confidence level, an evidence table, residual risk and questions for SAP. It gives no compliant or not compliant answer on purpose, because SAP's FAQ (Q49) declines to publish a binding decision matrix, and it sends legal, commercial and roadmap questions to SAP and lowers its confidence when a source is not connected. Four sample runs show the method, among them ODP-RFC extraction labelled likely not aligned under SAP Note 3255746 and the same API_SALES_ORDER_SRV assessed differently for an autonomous agent behind a custom gateway and for a Boomi middleware flow; the SAP Notes and Business Accelerator Hub servers read SAP sites through a browser login, which the post says to use at your own risk.published 2026-06-02Marian Zeis, blog.zeis.de — Marian Zeis
README
quoted from marianfoo/sap-api-policy-skill under MIT, readSAP API Policy Evidence Skill
An agent skill that assesses whether a given SAP API usage scenario aligns with the SAP API Policy (v.4.2026a + FAQ) and returns an evidence-based, sourced technical assessment with a confidence level — by gathering live evidence from official SAP sources (SAP Help, Business Accelerator Hub, SAP Notes, Architecture Center, released-object data) via MCP servers.
Not legal advice, not a final SAP compliance decision. Only SAP, your contract, or SAP support/account/legal can give a binding answer. This skill gets as close as the evidence allows, labels its confidence, and routes legal/commercial/roadmap questions to SAP rather than answering them.
Install
Cross-agent via the skills CLI (works with Claude Code,
Cursor, Codex, and others):
# install just this skill (use your own owner/repo if you fork it)
npx skills add marianfoo/sap-api-policy-skill --skill sap-api-policy-evidence
# or install everything in the repo
npx skills add marianfoo/sap-api-policy-skill
# globally, across all projects
npx skills add -g marianfoo/sap-api-policy-skill --skill sap-api-policy-evidenceManual install (no CLI): copy skills/sap-api-policy-evidence/ into your agent's skills directory
(e.g. ~/.claude/skills/ for Claude Code) — see MCP_SETUP.md → "Using the skill".
Prerequisite: the SAP MCP servers
The skill gathers evidence through SAP MCP servers — set them up once (most are npx-installable, SAP
Docs has a hosted URL):
| Server | Install | Role |
|---|---|---|
| SAP Docs | hosted URL or mcp-sap-docs | SAP Help, Architecture Center, released-object status |
| SAP API Hub | npx -y sap-api-hub-mcp | prove Published-API status / version / specs |
| SAP Notes | sap-note-search-mcp (node) | "not permitted" / deprecated / successor notes |
| SAP Roadmap | npx -y sap-roadmap-mcp | future replacement APIs (planning only) |
| ARC-1 | npx -y arc-1@latest | live-system release state / custom-API checks |
The three authenticated servers (API Hub, Roadmap, Notes) and their shared SAP login module live in
one repo — sap-mcp-servers (npm workspaces) — but
each is still published to npm individually, so the npx -y forms above work as-is.
Full setup (auth, MFA, portable config, per-client usage): MCP_SETUP.md. The skill
degrades gracefully if some are missing and says which were unavailable; SAP API Hub + an
authenticated SAP Notes session are what let assessments reach high confidence.
What it covers
Published-API vs internal/private status · "Documented Use" · third-party tools / iPaaS / RPA · agentic & generative-AI / MCP access · bulk extraction & replication · custom Z/Y OData & RFC/BAPI wrappers & Clean Core · ADT developer-tooling boundaries (FAQ Q33) · ODP-RFC and other "not permitted" interfaces · partner Integration Certification · RISE remediation · an inventory/scan mode ("which of these APIs are allowed?").
Example prompts
- Decisive: "Is it allowed under SAP's API policy to extract data from our BW/4HANA into Snowflake nightly via ODP-RFC through a third-party ETL tool?"
- Should be aligned: "We sync ~500 Shopify orders/day into S/4HANA Cloud via the standard Sales Order OData API using Boomi — OK under the 2026 API policy?"
- Scan a list: "Which of these are OK to keep using: API_SALES_ORDER_SRV, RFC_READ_TABLE, SD_SALESDOCUMENT_CREATE, ODP-RFC, I_SalesDocument?"
Repo layout
skills/sap-api-policy-evidence/ the skill — SKILL.md + references/ + agents/openai.yaml
evals/evals.json 22 scenario evals (the test suite)
tests/skill_static_checks.py contract checks (fixed labels, required refs, URLs)
MCP_SETUP.md MCP server setup + how to consume the skill
CLAUDE.md contributor/maintainer guide (how to edit + validate the skill)
.cursor/mcp.json.example portable MCP client config — copy to .cursor/mcp.json and fill in
Validation
The skill was hardened over 6 eval iterations across 22 scenarios spanning every policy branch plus
adversarial over/under-flag, legal-wall, and scan-mode probes. It returns a fixed verdict label
(Likely aligned / Likely not aligned / Needs SAP confirmation / Not assessable from provided facts), a single confidence level, cited sources, and the non-legal disclaimer.
License
MIT — see LICENSE.
Others providing
Compare all 9 on the Tool governance page →- a2a-plugina2a-pluginExposes an annotated CDS service as an Agent-to-Agent protocol agent — @a2a opts the service in, @a2a.Skill declares what it offers, and an agent handler answers.independent, capExposes an annotated CDS service as an Agent-to-Agent agentfrom CAP
- arc-mcp-hubarc-mcp-hubA hub on SAP BTP that puts several arc-1 instances, one per SAP system, behind one login and a route each, exchanging the caller's token through a destination so each system still sees the real user.independent, btpHub on SAP BTP putting several arc-1 instances behind one loginfrom BTP/BAIP
- SuperClaude for SAPSuperClaude for SAPA Claude Code plugin that installs and wires its own ABAP MCP server, then puts a two-layer write guard between the agent and any system profile marked QA or production.independent, abapClaude Code plugin with an ABAP MCP server and write guardsfrom ABAP
- API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btpAPI proxies with security and traffic policies and Developer Hubfrom BTP/BAIP
- bw-modeling-mcpbw-modeling-mcpReads, creates and modifies BW/4HANA modelling objects through the same internal APIs Eclipse BWMT and the BW/4HANA Cockpit use — and can run centrally on BTP with each caller reaching BW as themselves.independent, btpMCP server for BW/4HANA modelling objectsfrom BTP/BAIP
- Maherd18/sap-mcp-serverMaherd18/sap-mcp-serverAn MCP server for ABAP development over the ADT resources: eight tools, each checked against a JSON policy file before the call reaches the system, with activation and transport release held for a person to approve.independent, abapPolicy-checked MCP server for ABAP development over ADTfrom ABAP
- cds-agentscds-agentsTurns a CAP service into a tool layer for agent frameworks — a CAPToolkit bound to a named service, with a tool strategy controlling how much of it becomes callable.independent, capToolkit turning a CAP service into tools for agent frameworksfrom CAP
- pyrfc-mcppyrfc-mcpAn MCP server for calling an SAP system's RFC-enabled function modules from an agent, built so that discovering a function does not authorise calling it: a read or a write is denied unless the function name matches an allowlist the server is configured with.independent, abapMCP server calling RFC-enabled function modules behind an allowlistfrom ABAP
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
History in the atlas
- five conditional edges to the MCP servers the README lists as its prerequisites
- Triaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README; the catalogue is credited as where it was found and its words are not reused. Hard rule 7: skills are indexed, never authored here.
- First seen.
For your agent
- Ref
artifact:marianfoo-sap-api-policy-skill- JSON
- /artifacts/marianfoo-sap-api-policy-skill.json
- MCP
- Connecting an agent