onedevatlasBeta
Browse the atlas
AllCAPABAPBTPUI5
SkillSkilltypeA procedure an agent follows. Indexed here, never written here.See every one →What this type is →independently maintainedindependently maintainedoriginPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →

SAP API Policy Evidence Skill

Assesses whether a described SAP API usage aligns with the SAP API Policy, gathering live evidence from SAP's own sources and returning a sourced assessment with a stated confidence — and routing the legal questions away from itself.

The question several MCP servers in this corpus raise and none of them answer: ADT is scoped as development tooling, so is what you are about to do inside that scope? This gathers evidence against the policy — v.4.2026a and its FAQ — from SAP Help, the Business Accelerator Hub, SAP Notes, the Architecture Center and released-object data, through MCP servers, and returns an assessment that cites what it found and labels how confident it is. Installed cross-agent through the skills CLI.

GitHub11 ★

Facts

Last pushLicenceMIT

Where it sits

Lives in
BTP/BAIP
Provides
Tool governanceBTPCAPABAPTool governancecapabilityControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.
Serves
CAPABAP
Requires
PlaywrightPlaywrightoutside the atlasto install Chromium for the authenticated MCP servers (API Hub, Roadmap, Notes) this skill requires evidence from
Optional
sap-api-hub-mcpsap-api-hub-mcpartifactProves an endpoint's Published-API status, its version and its specification, which is the fact most of the policy branches turn on.sap-note-search-mcpsap-note-search-mcpartifactFinds the notes that say an interface is not permitted, is deprecated, or has a named successor.mcp-sap-docsmcp-sap-docsartifactSupplies SAP Help, the Architecture Center and released-object status, and is the one prerequisite reachable at a hosted URL rather than installed.sap-roadmap-mcpsap-roadmap-mcpartifactLooks up a replacement API SAP has announced as planned; the README marks what it returns as planning only.arc-1arc-1artifactChecks the release state of a live system and the custom APIs in it, which no published catalogue can answer.evidence source

Who is behind it

Marian ZeisMarian ZeisPersonMaintains this
In the atlas: maintains 35, contributes to 86, wrote 25@marianfoomaintainer

Before choosing this

Conditions

PolicySAP API Policy 4.2026a§ 1.1, 1.2, 2.2.2, 3The skill is used to assess a described SAP API or interface usage scenario.
  • § 1.1 Published APIs. Published APIs are made available for the documented purposes identified by SAP, including integration, extensions and data exchange.
  • § 1.2 Non-Published APIs. Customer and third-party applications must not access non-published APIs except where documentation permits it or SAP otherwise authorizes it.
  • § 2.2.2 AI call sequences and data extraction. Outside SAP-endorsed architectures, data services or expressly identified pathways, the policy prohibits specified agentic API use and systematic or large-scale extraction.
  • § 3 Monitoring and remedies. SAP states that it may monitor API use and take enforcement actions when use does not comply with the documentation and policy.

The skill assesses scenarios against SAP API Policy v4.2026a and returns sourced evidence. Its output is not a legal or compliance decision; confirm binding questions against the applicable agreement or with SAP.

SAP API Policy 4.2026a →

Also, from Tool governance§ 1.1, 1.2, 2.2.2, 3: Technical controls decide what an agent can call; the SAP API Policy separately governs whether the API is published for the intended use and identifies special AI-call and extraction cases. An evidence-gathering tool can assess against that policy but cannot issue a binding compliance decision.

PracticalFunctional boundary

It says so itself, in bold, and the atlas repeats it: not legal advice and not a compliance decision. Only SAP, your contract, or SAP support can answer bindingly, and the skill routes legal, commercial and roadmap questions there rather than guessing at them. Treat the output as evidence gathered, not as a verdict.

What it declares

Every artifact

Type
Skill
Origin
Independently maintained

As a skill

Distributed through
npmCopied into the project

Connections7

Download
SAP API Policy Evidence Skill connectionsSAP API Policy EvidenceSkillPROVIDES→ provides1provides stated Turns "is this use of an SAP API within policy" into a sourced, dated assessment with a confidence level, gathered from SAP's own material rather than asserted — and declines the questions only SAP can answer. SAP API Policy Evidence Skill — README: https://github.com/marianfoo/sap-api-policy-skillTool governanceNEEDS→ needs1needs stated to install Chromium for the authenticated MCP servers (API Hub, Roadmap, Notes) this skill requires evidence from sap-api-policy-skill: MCP_SETUP.md: https://raw.githubusercontent.com/marianfoo/sap-api-policy-skill/main/MCP_SETUP.mdPlaywright→ optionally needs5optionally needs stated If: the scenario involves a live system's release state or a custom API Checks the release state of a live system and the custom APIs in it, which no published catalogue can answer. SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skillarc-1ifoptionally needs stated If: the assessment rests on SAP Help, Architecture Center or released-object status Supplies SAP Help, the Architecture Center and released-object status, and is the one prerequisite reachable at a hosted URL rather than installed. SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skillmcp-sap-docsifoptionally needs stated If: an assessment is to reach the skill's high confidence level Proves an endpoint's Published-API status, its version and its specification, which is the fact most of the policy branches turn on. SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skill SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skillsap-api-hub-mcpifoptionally needs stated If: an assessment is to reach the skill's high confidence level Finds the notes that say an interface is not permitted, is deprecated, or has a named successor. SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skill SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skillsap-note-search-mcpifoptionally needs stated If: the question is whether a replacement API is planned Looks up a replacement API SAP has announced as planned; the README marks what it returns as planning only. SAP API Policy Evidence Skill — README, Prerequisite: the SAP MCP servers: https://github.com/marianfoo/sap-api-policy-skillsap-roadmap-mcpif

Learn more1

Readings
  1. A Clearer View of Your SAP Integrations Under the New API PolicyMarian Zeis, blog.zeis.de — Marian Zeis

README

quoted from marianfoo/sap-api-policy-skill under MIT, read
marianfoo/sap-api-policy-skill/README.mdOn GitHub

SAP API Policy Evidence Skill

An agent skill that assesses whether a given SAP API usage scenario aligns with the SAP API Policy (v.4.2026a + FAQ) and returns an evidence-based, sourced technical assessment with a confidence level — by gathering live evidence from official SAP sources (SAP Help, Business Accelerator Hub, SAP Notes, Architecture Center, released-object data) via MCP servers.

Not legal advice, not a final SAP compliance decision. Only SAP, your contract, or SAP support/account/legal can give a binding answer. This skill gets as close as the evidence allows, labels its confidence, and routes legal/commercial/roadmap questions to SAP rather than answering them.

Install

Cross-agent via the skills CLI (works with Claude Code, Cursor, Codex, and others):

# install just this skill (use your own owner/repo if you fork it)
npx skills add marianfoo/sap-api-policy-skill --skill sap-api-policy-evidence

# or install everything in the repo
npx skills add marianfoo/sap-api-policy-skill

# globally, across all projects
npx skills add -g marianfoo/sap-api-policy-skill --skill sap-api-policy-evidence

Manual install (no CLI): copy skills/sap-api-policy-evidence/ into your agent's skills directory (e.g. ~/.claude/skills/ for Claude Code) — see MCP_SETUP.md → "Using the skill".

Prerequisite: the SAP MCP servers

The skill gathers evidence through SAP MCP servers — set them up once (most are npx-installable, SAP Docs has a hosted URL):

ServerInstallRole
SAP Docshosted URL or mcp-sap-docsSAP Help, Architecture Center, released-object status
SAP API Hubnpx -y sap-api-hub-mcpprove Published-API status / version / specs
SAP Notessap-note-search-mcp (node)"not permitted" / deprecated / successor notes
SAP Roadmapnpx -y sap-roadmap-mcpfuture replacement APIs (planning only)
ARC-1npx -y arc-1@latestlive-system release state / custom-API checks

The three authenticated servers (API Hub, Roadmap, Notes) and their shared SAP login module live in one repo — sap-mcp-servers (npm workspaces) — but each is still published to npm individually, so the npx -y forms above work as-is.

Full setup (auth, MFA, portable config, per-client usage): MCP_SETUP.md. The skill degrades gracefully if some are missing and says which were unavailable; SAP API Hub + an authenticated SAP Notes session are what let assessments reach high confidence.

What it covers

Published-API vs internal/private status · "Documented Use" · third-party tools / iPaaS / RPA · agentic & generative-AI / MCP access · bulk extraction & replication · custom Z/Y OData & RFC/BAPI wrappers & Clean Core · ADT developer-tooling boundaries (FAQ Q33) · ODP-RFC and other "not permitted" interfaces · partner Integration Certification · RISE remediation · an inventory/scan mode ("which of these APIs are allowed?").

Example prompts

  • Decisive: "Is it allowed under SAP's API policy to extract data from our BW/4HANA into Snowflake nightly via ODP-RFC through a third-party ETL tool?"
  • Should be aligned: "We sync ~500 Shopify orders/day into S/4HANA Cloud via the standard Sales Order OData API using Boomi — OK under the 2026 API policy?"
  • Scan a list: "Which of these are OK to keep using: API_SALES_ORDER_SRV, RFC_READ_TABLE, SD_SALESDOCUMENT_CREATE, ODP-RFC, I_SalesDocument?"

Repo layout

skills/sap-api-policy-evidence/   the skill — SKILL.md + references/ + agents/openai.yaml
evals/evals.json                  22 scenario evals (the test suite)
tests/skill_static_checks.py      contract checks (fixed labels, required refs, URLs)
MCP_SETUP.md                      MCP server setup + how to consume the skill
CLAUDE.md                         contributor/maintainer guide (how to edit + validate the skill)
.cursor/mcp.json.example          portable MCP client config — copy to .cursor/mcp.json and fill in

Validation

The skill was hardened over 6 eval iterations across 22 scenarios spanning every policy branch plus adversarial over/under-flag, legal-wall, and scan-mode probes. It returns a fixed verdict label (Likely aligned / Likely not aligned / Needs SAP confirmation / Not assessable from provided facts), a single confidence level, cited sources, and the non-legal disclaimer.

License

MIT — see LICENSE.

MIT, read

Others providing3

Compare all 4 on the Tool governance page →
Tool governance
  1. arc-mcp-hubHub on SAP BTP putting several arc-1 instances behind one login
  2. API ManagementAPI proxies with security and traffic policies and Developer Hub
  3. bw-modeling-mcpMCP server for BW/4HANA modelling objects

Details

Sources3
sap-ai-mcp-serversdiscovered herechecked
github.com/marianfoo/sap-api-policy-skilltree, pushes, contributors, CIchecked
README.mdquoted, and what the entry declareschecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
discovered viasap-ai-mcp-servers
first seen in the atlas
ecosystem and domainbtp, ai-and-agents
History in the atlas3
  1. five conditional edges to the MCP servers the README lists as its prerequisites
  2. Triaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README; the catalogue is credited as where it was found and its words are not reused. Hard rule 7: skills are indexed, never authored here.
  3. First seen.
For your agent
Ref
artifact:marianfoo-sap-api-policy-skill
JSON
/artifacts/marianfoo-sap-api-policy-skill.json
MCP
Connecting an agent