Marian Zeis
Entries
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
XSUAA authentication stack for an MCP server on SAP BTP
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
Browser login and session module for SAP MCP servers
It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.
MCP server searching seventeen SAP documentation repositories
It says so itself, in bold, and the atlas repeats it: not legal advice and not a compliance decision. Only SAP, your contract, or SAP support can answer bindingly, and the skill routes legal, commercial and roadmap questions there rather than guessing at them. Treat the output as evidence gathered, not as a verdict.
Skill assessing API usage against the SAP API Policy
The maintainer states it is unofficial, not endorsed by SAP, and that it uses authenticated Hub web and catalogue endpoints and browser session cookies in ways SAP's terms of service, SAP account terms or an organisation's own policies may restrict. The same README asks the reader not to use it for production, broad distribution or shared access without explicit approval, and says that installing it grants no permission to automate SAP services.
Read-only MCP server over the SAP Business Accelerator Hub
A diagram of anything other than an SAP, BTP or on-premise landscape: the skill is tuned to the Horizon style and its 71 templates. It drafts rather than finishes, and its README budgets 15 to 30 minutes of edits in draw.io per diagram. Without Python the validator does not run.
Claude Code plugin and skill drawing validated BTP diagrams
It needs an S-user with SAP Support Portal access, so there is nothing to search without a support contract behind the login. The maintainer states it uses private SAP APIs behind authentication, asks the reader to check whether that use breaches SAP's terms of service, and disclaims both liability and any guarantee that it keeps working. MFA is handled only by typing the code into a visible browser, so a headless deployment cannot complete a login that demands one.
MCP server searching and fetching SAP Notes and KBAs
What it returns is planning material, not a commitment, and the monorepo labels the server's role "future/planned features (planning only)". The maintainer also states it is unofficial, not endorsed by SAP, and that it uses authenticated Road Map Explorer web endpoints and browser session cookies in ways SAP's terms of service or an organisation's policies may restrict, with production, broad distribution and shared access called out as needing explicit approval. An account that requires MFA has to be bootstrapped once through a visible browser.
MCP server over SAP Road Map Explorer
MCP server for SAP BTP and Cloud Foundry acting as the logged-in user
Archived The declared repository is archived.
Functional boundary With one SAP system the README says to point the client at that arc-1 directly. Version 1 exchanges tokens within a single subaccount, so backends spread across subaccounts are out; it keeps its session map in memory, so more than one instance needs sticky sessions or a shared store. It routes deterministically and runs no model, which is a different thing from an assistant that reasons across systems. The `/all` endpoint drops the per-connection isolation, and the maintainer's answer to that is a PROD backend set read-only at the SAP end rather than a tool surface that hides the writes.
Hub on SAP BTP putting several arc-1 instances behind one login
It puts create, update and delete on business entities behind natural language. Whatever the destination's principal may change, an agent may change — and "create a new customer" is a sentence, not a form somebody signed off.
Exposes S/4HANA or ECC OData services as MCP tools
Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.
MCP server for BW/4HANA modelling objects
MCP server with read tools over the SAP Cloud ALM APIs
Writing and topics
Details
History
- @marianfoo/sap-mcp-authRe-read against the README as it stands today. "No token endpoint" and "there is no client-credentials flow to use instead" were absence claims about SAP's portals that no source makes, so they are gone and the paragraph now says what the module does and whom it serves. The maintainer's own unofficial caveat, and the origins password login refuses, are in when_not_to_use. The package block states that it is imported into the caller's own program and installed from npm. The README names [Cloud Identity Services](artifact:btp-cloud-identity-services) as the tenant the login goes to, which is an edge rather than a phrase in a paragraph.
- @arc-mcp/xsuaa-authThe BTP door now compares its authentication options on whether the signed-in identity reaches the next system. The README's sentence about the `./btp` entrypoint states it for this package, and it was read again on this date.
- sap-architecturecapability:agent-guidance declared the installs_into property on the BTP door. The README states the skill is portable and then names the instruction file for each tool in a table, so the statement is the portability sentence and each value carries the row that names it. The table also names Jules, Amp and Factory, which are outside the property's values and are left for the curation queue rather than entered as written.
- sap-architectureThe entry said other agents can run it and not what that costs. The README's own caveat, read on 2026-10-15, is that the auto-load is Claude's alone, which is the difference between this option and a Claude-only one.
- @marianfoo/sap-mcp-authEntered with the three servers of the same monorepo that name it. It publishes on its own and answers a question of its own — how a tool outside SAP gets an authenticated session against an SAP portal — so it is an entry rather than an implementation detail of the three.
- btp-cf-mcpRead out of the marianfoo account listing. Entered as a starting-point, since the maintainer's own status line calls it "a working proof-of-concept", so its boundaries sit in description.to_build_on_it rather than in a warning. capability:mcp-servers already reads core-only on the BTP door because every provider there is SAP-published; this is an independent one, which is a reading the capability will have to move.
- SAP API Policy Evidence SkillThe entry described the skill as gathering evidence "through MCP servers" without naming one, because four of the five were not in the corpus. Three entered in the same batch as their own packages, and mcp-sap-docs and arc-1 were already here, so the README's own prerequisites table becomes edges. Conditional rather than required: the README states the skill degrades gracefully when one is missing and names which two raise confidence to high.
- sap-api-hub-mcp[The SAP API Policy Evidence Skill](artifact:marianfoo-sap-api-policy-skill) was entered on 2026-09-10 naming this server as what proves an API's Published-API status, and the server itself was not in the corpus. Entered as its own package, from its own README, because the monorepo publishes each server to npm independently.
- sap-note-search-mcpThe decline recorded for candidate:marianfoo/mcp-sap-notes on 2026-09-10 named this as the successor and as an open gap: "SAP Notes search is a real gap in the corpus and the thing that fills it has to be found some other way." Entered from the monorepo package rather than the archived repository, and from the package's own README.
- sap-roadmap-mcpNamed in [the SAP API Policy Evidence Skill](artifact:marianfoo-sap-api-policy-skill)'s prerequisites as the source for replacement APIs, and absent from the corpus. Entered as its own package, from its own README, because the monorepo publishes each server to npm independently.
- mcp-sap-docsCorrected against the README: its offline-sources table lists seventeen repositories, abap-docs-standard through wdi5.
- SAP API Policy Evidence SkillTriaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README; the catalogue is credited as where it was found and its words are not reused. Hard rule 7: skills are indexed, never authored here.
- mcp-sap-docsNamed in docs/NEIGHBOURS.md §3.1 as a project of the bestofcapjs author but never entered. It is a documentation retrieval server, not an index of options — the complement posture the same section assigns ARC-1, and hard rule 5 makes it exist here only as an attached entry.
- First entry seenDiscovered via GitHub API · arc-mcp, GitHub organisations and accounts · marianfoo, GitHub API · marianfoo, sap-ai-mcp-servers, Added by hand.
Profile
For your agent
- Ref
actor:marianfoo- JSON
- /actors/marianfoo.json
- MCP
- Connecting an agent