Everything in BTP/BAIP

Its own feature comparison marks connection pooling, automatic reconnect, active-active reads, client-side data encryption, statement distribution, Kerberos authentication, the hdbuserstore, promises and TypeScript types as [@sap/hana-client](https://www.npmjs.com/package/@sap/hana-client) only, so a service that wants a pool or a promise API writes both itself over a callback interface. OpenSSL is its one security provider where the other driver lists SAP CommonCryptoLib, OpenSSL and MSCrypto, and it runs on Node.js 18 or later.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

An early alpha release whose README says to pin the version and test recipes against non-production data first. HANA synchronisation is snapshot-only and does not reconcile deleted rows, so a document for a row deleted in the source stays in the index. A recipe's field allow-list does not decide what the service account may read: the README states that field allow-listing does not replace SAP authorization, and that the package infers no SAP module semantics, authorization scope or safe fields from table names. Only Business Partner has a built-in recipe, every other dataset needs a `KnowledgeRecipe` written for it, and [Qdrant](external:qdrant) local mode is stated to be for development and smaller indexes.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.

The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.

Never as the figure a billing decision rests on: the repository states this is not a replacement for the official billing documents, that the information it provides is purely indicative, and that it recommends verifying against the official BTP Cockpit usage reports. It is published as a sample or reference implementation and says it is not intended for production use without review, testing and hardening.

Never as the figure a billing decision rests on: the repository states that the tool is provided as-is, is not covered by SAP Support, is not a replacement of the official billing documents you receive from SAP, and that the information it provides is purely indicative. Its daily delta is also an approximation over a 24-hour period rather than a hard data point for the consumption on that day, because some services report usage only the day after it happened.

Specific to MDK metadata projects — nothing here builds or deploys a CAP service or a plain Fiori app. Closed-source, under SAP's own developer licence rather than a public repository.

Not as the provider behind a live tenant estate: tenant state is kept in a file-based store for demonstration, and the README's own operations notes say a production implementation should use a reliable database so that state survives restarts.

Nothing here runs on its own: a plugin sample needs a Digital Manufacturing tenant to be uploaded into, and the integration samples need a Cloud Integration tenant plus an ERP system, or a mock server as the outbound example uses, before they do anything.