{"ref":"artifact:marianfoo-sap-mcp-auth","page":"/artifacts/marianfoo-sap-mcp-auth","json":"/artifacts/marianfoo-sap-mcp-auth.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"marianfoo-sap-mcp-auth","name":"@marianfoo/sap-mcp-auth","artifact_type":"package","ecosystem":"btp","domain":"security-and-compliance","origin_ring":"independent","description":{"one_line":"A shared browser-login and session module for SAP MCP servers: it drives a [Playwright](external:playwright) browser through SAP Identity Authentication, caches the session cookies and returns a cookie header an HTTP client can send.","short":"Browser login and session module for SAP MCP servers","what_it_solves":"Three MCP servers in the same monorepo read official SAP sources from behind an SAP login: [sap-api-hub-mcp](artifact:marianfoo-sap-api-hub-mcp), [sap-roadmap-mcp](artifact:marianfoo-sap-roadmap-mcp) and [sap-note-search-mcp](artifact:marianfoo-sap-note-search-mcp). This is the one place that login lives. It drives a [Playwright](external:playwright) browser through SAP Identity Authentication at `accounts.sap.com` by username and password, by an SAP Passport PFX certificate, or interactively when a multi-factor code is needed, and returns an `AuthSession` carrying a `cookieHeader`, the scoped cookies, the expiry and the method used. What differs per service, which page to open, how to scope the cookies and how to check that a session still works, arrives in a `ServiceProfile`; concurrent callers share one login attempt, cookies are cached until they near expiry, and a shared storage-state file lets one SAP login serve all three servers. It stops at the session: nothing in it calls an SAP API or reads a page, and the maintainer states that the token cache and the storage-state file hold live SAP session cookies and are to be treated as secrets.","when_not_to_use":"The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead."},"links":{"npm":"https://www.npmjs.com/package/@marianfoo/sap-mcp-auth","repo":"https://github.com/marianfoo/sap-mcp-servers/tree/main/packages/auth"},"identity":{"author":"Marian Zeis","license":"Apache-2.0"},"source_available":true,"maintainers":["actor:marianfoo"],"compat":{"runtimes":["node"]},"type_properties":{"placement":{"value":"own-process","sources":[{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README, Quick start","checked":"2026-10-19","quote":"import { SapWebAuthenticator, type AuthConfig, type ServiceProfile } from '@marianfoo/sap-mcp-auth';"},{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/README.md","title":"sap-mcp-servers — README, Shared SAP authentication","checked":"2026-10-19","quote":"All three servers authenticate to SAP the same way, via `@marianfoo/sap-mcp-auth`:"}]},"distribution":{"value":["npm"],"sources":[{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README, Install","checked":"2026-10-19","quote":"npm install @marianfoo/sap-mcp-auth playwright"}]}},"provides":[{"capability":"capability:authentication","what_it_does":"Signs a program in to an SAP service as the person running it: it completes the SAP Identity Authentication login in a browser, by password, by SAP Passport certificate or interactively where a multi-factor code is required, and keeps the resulting session until it expires so the caller can send it with each request.","sources":[{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README","checked":"2026-10-19","quote":"Shared SAP IAS (`accounts.sap.com`) browser-login and session module for SAP MCP servers."},{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README","checked":"2026-10-19","quote":"It drives a [Playwright](https://playwright.dev) browser to complete SAP login — username/password, SAP Passport (PFX) certificate, or interactive/manual — captures and caches the resulting session cookies, and returns a structured `AuthSession`."},{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/README.md","title":"sap-mcp-servers — README, packages table","checked":"2026-10-19","quote":"Shared SAP IAS/SSO browser-login + session module (Playwright). Used by the three servers below."}]}],"requires":[{"ref":"external:playwright","for":"The browser it drives through the SAP login page, installed by the caller rather than bundled, so the project decides which browsers are downloaded.","requirement":"required","basis":"binding","sources":[{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README, Install","checked":"2026-10-19","quote":"`playwright` is a **peer dependency** — install it in your project (the SAP MCP servers already do):"},{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README, Install","checked":"2026-10-19","quote":"npm install @marianfoo/sap-mcp-auth playwright"}]}],"connects":[{"ref":"artifact:btp-cloud-identity-services","kind":"authentication","direction":"outbound","protocols":["http"],"for":"The login itself: the browser it drives opens SAP Identity Authentication, fills the credentials or presents the SAP Passport certificate there, and the cookies that login leaves are the session it hands back to the caller.","sources":[{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README, Customer IAS and corporate identity providers","checked":"2026-10-19","quote":"Direct password login supports the standard SAP Cloud Identity Services tenant domains"},{"url":"https://raw.githubusercontent.com/marianfoo/sap-mcp-servers/main/packages/auth/README.md","title":"@marianfoo/sap-mcp-auth — README, Customer IAS and corporate identity providers","checked":"2026-10-19","quote":"Set `SAP_LOGIN_URL`\nto the intended tenant's HTTPS URL; only that exact tenant origin and `https://accounts.sap.com`\nare allowed to receive credentials."}]}],"provenance":{"discovered_via":[{"source":"source:github-orgs","channel":"marianfoo"}],"first_seen":"2026-09-25"},"history":[{"date":"2026-09-25","field":"entry","from":null,"to":"created","reason":"Entered with the three servers of the same monorepo that name it. It publishes on its own and answers a question of its own — how a tool outside SAP gets an authenticated session against an SAP portal — so it is an entry rather than an implementation detail of the three."},{"date":"2026-10-19","field":"description, type_properties, connects","from":"an opening that asserted SAP's portals have no token endpoint, no type block and no stated connection","to":"the module as its README states it, where it runs and how it is installed, and the login edge to the identity service the README names","reason":"Re-read against the README as it stands today. \"No token endpoint\" and \"there is no client-credentials flow to use instead\" were absence claims about SAP's portals that no source makes, so they are gone and the paragraph now says what the module does and whom it serves. The maintainer's own unofficial caveat, and the origins password login refuses, are in when_not_to_use. The package block states that it is imported into the caller's own program and installed from npm. The README names [Cloud Identity Services](artifact:btp-cloud-identity-services) as the tenant the login goes to, which is an edge rather than a phrase in a paragraph."}],"drafted_with_ai":true,"contributors":["actor:adam0thman","actor:army113","actor:marianfoo"]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"good","evidence":"released this month"},{"label":"Continuity","tier":"good","evidence":"6 contributors, 1 publisher"},{"label":"Repository","tier":"good","evidence":"pushed 2026-10, not archived"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Maintainer's CI","tier":"good","evidence":"CI green, 2026-10-19"}],"practice":[{"label":"Tests","tier":"good","evidence":"27 test files, npm test"},{"label":"Docs","tier":"good","evidence":"docs/ with 2 pages, README 11 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":422,"unit":"installs/week"},{"value":26,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-25","latest_version":"0.1.3","majors":{"0.1":{"version":"0.1.0","date":"2026-05-28"}},"license":"Apache-2.0","first_release":"2026-05-28","last_release":"2026-10-17","releases":4,"cadence_days":4,"maintainers":1,"repository":"git+https://github.com/marianfoo/sap-mcp-servers.git","repository_directory":"packages/auth","peer_cds":null,"dependencies":0,"node_engine":">=22.12.0","test_script":true,"types":true,"downloads_weekly":422,"downloads_monthly":1108,"stars":26,"forks":10,"open_issues":1,"archived":false,"pushed_at":"2026-10-19","license_spdx":"Apache-2.0","org_owned":false,"default_branch":"main","created_at":"2026-05-29T20:24:07Z","open_prs":1,"tree_truncated":false,"test_files":27,"workflows":2,"other_ci":false,"readme_bytes":11765,"docs_files":2,"changelog":false,"license_file":true,"dts_files":0,"first_commit":"2026-05-29","last_commit":"2026-10-19","commits":27,"contributors":6,"ci_status":"success","ci_run_at":"2026-10-19","ci_workflow":"CI","ci_event":"push","readme_path":"packages/auth/README.md","readme_sha":"360b0d114c9bbcea938b6c3ff2714030b1bd943e","months_since_release":0,"dormant":false,"repo_read":"2026-10-25"},"release_notes":{"license":"Apache-2.0","quotable":true,"source":{"kind":"repo","path":"packages/auth/CHANGELOG.md","ref":"main","url":"https://github.com/marianfoo/sap-mcp-servers/blob/main/packages/auth/CHANGELOG.md"},"format":"conventional","releases":[{"version":"0.1.3","date":"2026-10-17","date_source":"heading","heading":"0.1.3 (2026-10-17)","url":"https://github.com/marianfoo/sap-mcp-servers/blob/main/packages/auth/CHANGELOG.md#013-2026-10-17","sections":[{"kind":"feature","heading":"Features","items":1},{"kind":"fix","heading":"Bug Fixes","items":4}],"hash":"702e32f5e03e49a9"},{"version":"0.1.2","date":"2026-06-02","date_source":"heading","heading":"0.1.2 (2026-06-02)","url":"https://github.com/marianfoo/sap-mcp-servers/blob/main/packages/auth/CHANGELOG.md#012-2026-06-02","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"5530504b8a6fe840"},{"version":"0.1.1","date":"2026-05-29","date_source":"heading","heading":"0.1.1 (2026-05-29)","url":"https://github.com/marianfoo/sap-mcp-servers/blob/main/packages/auth/CHANGELOG.md#011-2026-05-29","sections":[{"kind":"docs","heading":"Documentation","items":1}],"hash":"d5356bcc28f59d3d"}],"versions":[{"version":"0.1.3","date":"2026-10-17"},{"version":"0.1.2","date":"2026-06-03"},{"version":"0.1.1","date":"2026-05-29"},{"version":"0.1.0","date":"2026-05-28"}],"crawled_at":"2026-10-25"},"edges":{"maintainers":[{"ref":"actor:marianfoo","name":"Marian Zeis","json":"/actors/marianfoo.json"}],"contributors":[{"ref":"actor:adam0thman","name":"adam0thman","json":"/actors/adam0thman.json"},{"ref":"actor:army113","name":"David Sluga","json":"/actors/army113.json"},{"ref":"actor:marianfoo","name":"Marian Zeis","json":"/actors/marianfoo.json"}],"explained_by":[],"alternative_to_this":[],"needed_by":[],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}