{"ref":"artifact:syntaai-sap-security-mcp","page":"/artifacts/syntaai-sap-security-mcp","json":"/artifacts/syntaai-sap-security-mcp.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"syntaai-sap-security-mcp","name":"sap-security-mcp","artifact_type":"mcp-server","ecosystem":"abap","domain":"security-and-compliance","origin_ring":"independent","description":{"one_line":"An entirely read-only security analysis surface: nineteen tools, five resources and eight prompts for audits, SOX and segregation-of-duties review, behind OAuth 2.0 with PKCE. The vendor hosts an endpoint, and the README documents running it yourself.","short":"Read-only security analysis MCP server for SAP audits and SoD review","what_it_solves":"Everything else pointed at an SAP system in this corpus can change something; this one cannot, and says so as a feature. Nineteen tools across user management, security analysis, compliance auditing and role and authorisation review, all read-only; five resources describing the system, its security posture, the compliance frameworks and the controls; and eight prepared prompts for the workflows an auditor actually runs, SOX and segregation of duties among them. Authentication is full RFC 8414 and 9728 OAuth with PKCE and dynamic client registration, which is more than most hosted endpoints in this corner attempt.","when_not_to_use":"Read-only does not mean low-stakes: a complete picture of who can do what in an SAP system is exactly what an attacker would want, and the ready-made endpoint is the vendor's rather than yours — the README also documents running the server yourself. The authentication is careful; the question of what leaves your landscape is still yours."},"links":{"repo":"https://github.com/SYNTAAI/sap-security-mcp","homepage":"https://mcp.syntaai.com/mcp"},"identity":{"license":"Apache-2.0","author":"SyntaAI"},"provides":[{"capability":"capability:agent-systems-access","what_it_does":"Exposes an SAP system's security posture — users, roles, authorisations, controls and compliance frameworks — as a read-only surface with prepared audit workflows, rather than as tools that could change any of it.","sources":[{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"SyntaAI ERP Security MCP Server — README","checked":"2026-09-10","quote":"19 Tools — User management, security analysis, compliance auditing, role & authorization review (all read-only)"}]}],"provenance":{"discovered_via":[{"source":"source:sap-ai-mcp-servers"}],"first_seen":"2026-09-10"},"history":[{"date":"2026-09-10","field":"entry","from":null,"to":"created","reason":"Triaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README. Filed on the BTP door because there is no door for the SAP product it fronts and hard rule 9 allows one — the same strain recorded on the LeanIX entries."},{"date":"2026-09-11","field":"description.one_line, description.when_not_to_use","from":null,"to":"corrected against the README","reason":"Corrected against the README, whose Deployment section documents running server.py yourself with OAuth."},{"date":"2026-10-09","field":"provides","from":"capability:mcp-servers","to":"capability:agent-systems-access","reason":"The concern it answers is reaching into an SAP system from outside, split out of MCP servers on this day; the sentence on the edge is unchanged."}],"type_properties":{"runs":{"value":["vendor-hosted","central-server"],"sources":[{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"**Server URL:** `https://mcp.syntaai.com/mcp`"},{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"# with OAuth (production)"}]},"auth":{"value":["oauth"],"sources":[{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"OAuth 2.0 with PKCE."}]},"tool_count":{"value":19,"source":{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"**19 Tools**"}},"read_only":{"value":true,"source":{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"role & authorization review (all read-only)"}},"guardrails":[{"source":{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"Supports Dynamic Client Registration (RFC 7591) and token revocation (RFC 7009)."}},{"source":{"url":"https://github.com/SYNTAAI/sap-security-mcp","title":"sap-security-mcp — README","checked":"2026-09-11","quote":"MCP_NO_AUTH=1 python server.py      # without OAuth (development)"}}]},"drafted_with_ai":true,"maintainers":["actor:syntaai"],"contributors":["actor:mohanjani79"]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"unknown","evidence":"no release data"},{"label":"Continuity","tier":"fair","evidence":"1 contributor, org-owned"},{"label":"Repository","tier":"good","evidence":"pushed 2026-08, not archived"}],"compatibility":[{"label":"Declared for","tier":"fair","evidence":"nothing declared"},{"label":"Survived majors","tier":"unknown","evidence":"not read on ABAP: its lines run side by side"},{"label":"Maintainer's CI","tier":"fair","evidence":"no CI configured"}],"practice":[{"label":"Tests","tier":"poor","evidence":"none found in the tree"},{"label":"Docs","tier":"good","evidence":"README 4 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":null,"unit":"installs/week"},{"value":2,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-24","npm":"not published under this name","stars":2,"forks":0,"open_issues":0,"archived":false,"pushed_at":"2026-08-21","license_spdx":"Apache-2.0","org_owned":true,"default_branch":"main","contributors":1,"tree_truncated":false,"test_files":0,"workflows":0,"other_ci":false,"readme_bytes":4244,"docs_files":0,"changelog":false,"license_file":true,"dts_files":0,"readme_path":"README.md","readme_sha":"541b7addeda18e4e7f8c440d842e6163c5d8aea9","created_at":"2026-02-23T09:48:55Z","open_prs":0,"first_commit":"2026-02-26","last_commit":"2026-08-21","commits":8,"repo_read":"2026-10-24"},"edges":{"maintainers":[{"ref":"actor:syntaai","name":"SYNTAAI","json":"/actors/syntaai.json"}],"contributors":[{"ref":"actor:mohanjani79","name":"mohanjani79","json":"/actors/mohanjani79.json"}],"explained_by":[],"alternative_to_this":[],"needed_by":[],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}