Everything in BTP/BAIP

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

A tenant with its own model layer, its own transport and its own user administration — content moves between tenants through export and import jobs rather than through your pipeline, and planning brings a calendar and a workflow that a reporting-only use never touches.

A tenant with spaces and a role model, not a database you point an application at — privileges are granted per space, and what somebody can model depends on the scoped role they hold. Federation is the default answer to moving data, and where it is not, a load has to be scheduled and watched.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Business Source License 1.1, which is source-available rather than open source: reading and evaluating are fine, and production use is restricted until the licence's change date. That is a procurement question, not a technical one, and it is the thing to settle first. Read-only also means read-only — no modelling, no loads.

It presumes the estate it governs: intelligent content is installed and viewed rather than authored, and the catalog is only as useful as what has been published into it. The Databricks path is a direction data goes, which is a decision about where analytics happens and not only about a tool.

A tenant with spaces and a role model, not a database you point an application at — privileges are granted per space, and what somebody can model depends on the scoped role they hold. Federation is the default answer to moving data, and where it is not, a load has to be scheduled and watched.

Business Source License 1.1: source-available, with production use restricted until the change date — settle that before anything technical. And the governed execution path in v0.2 does act on data, which is a different grant from the discovery the v0.1 baseline offered.

Provisioned per plan and per component, so capacity and cost are decisions taken before any model exists. And it is the database, not a warehouse — modelling, loading and cataloguing are the products above it, and reaching it directly bypasses every semantic they add.

Provisioned per plan and per component, so capacity and cost are decisions taken before any model exists. And it is the database, not a warehouse — modelling, loading and cataloguing are the products above it, and reaching it directly bypasses every semantic they add.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

A tenant with its own model layer, its own transport and its own user administration — content moves between tenants through export and import jobs rather than through your pipeline, and planning brings a calendar and a workflow that a reporting-only use never touches.

A tenant with spaces and a role model, not a database you point an application at — privileges are granted per space, and what somebody can model depends on the scoped role they hold. Federation is the default answer to moving data, and where it is not, a load has to be scheduled and watched.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

It expects a real landscape, not just a project: a `.service.metadata` file naming the Mobile Services app, endpoint and destination, the Cloud Foundry CLI, and access to a BTP Cloud Foundry environment. From 0.4.0 macOS support is ARM64 only — Intel Macs are not supported — alongside Linux and Windows on x64 and ARM64.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Configuration over an API you must already have entitled and provisioned; and the smallest of these repositories, so what it covers is what its config file happens to name.

It administers a live Cloud Foundry landscape: `Apps`, `Organizations`, `Spaces`, `ServiceInstances` and `SecurityGroups` all carry create, update and delete alongside list and get. What a caller can reach is set by the role they hold, and the three templates in `xs-security.json` are MCPViewer for read, MCPEditor for read and write, and MCPAdmin for full administrative access.

It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.

It puts create, update and delete on business entities behind natural language. Whatever the destination's principal may change, an agent may change — and "create a new customer" is a sentence, not a form somebody signed off.

A thin declaration over CPI's APIs: it reaches what those APIs expose and nothing else, and it inherits whatever the tenant's own authorisations allow.

Neither the package manifest nor the repository tree declares a licence.

Design-time only: no message monitoring, no deployment, no runtime status. That is a different server in this same section, and the two do not overlap.

This is the database, not an application in front of it, so what an agent can read is whatever the connection user can read — the guardrails bound the shape of a query, not the sensitivity of what it returns. Grant the connection the rights you would grant a person.

It acts on a real account. Authorisation is the caller's own — single sign-on through the SAP Default Identity Provider, across the global accounts that identity reaches — so what it can change is what you can change, and an agent invoking it is doing administration rather than proposing it. No public source, so what it exposes is what the documentation says it exposes.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

It deploys and undeploys, and it enumerates credentials, keystores and OAuth2 configurations. Listing security material is a read, and it is still a read of the thing that protects everything else the tenant talks to.

Business Source License 1.1, which is source-available rather than open source: reading and evaluating are fine, and production use is restricted until the licence's change date. That is a procurement question, not a technical one, and it is the thing to settle first. Read-only also means read-only — no modelling, no loads.

It reads the landscape inventory, not the systems in it — nothing here reaches a running application, and nothing here changes anything. A landscape description is also commercially sensitive in its own right: versions and hosts are what a targeting exercise starts from.

OData v2 only, and untouched since August 2025 — the same author's [Go port](artifact:oisee-odata-mcp-go) is where v4 support and the tool-explosion work went.

Universal mode trades discoverability for size: one generic tool is harder for a model to pick correctly than a named one, which is why it is not the default. On a small service, standard mode is the better answer.

It fronts APIs you already have; nothing here reads a system's source or model, and a config file is only as good as the entity sets somebody wrote into it. OData V2 is the query surface it names.

This is enterprise-architecture data, not a development surface — it answers what your landscape contains, never what your code does, and nothing in it belongs in a build. Entered here because it is a first-party SAP MCP endpoint and the catalogue that tracks this corner lists it; the atlas maps SAP development, so treat it as adjacent rather than as tooling for a project.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

Business Source License 1.1: source-available, with production use restricted until the change date — settle that before anything technical. And the governed execution path in v0.2 does act on data, which is a different grant from the discovery the v0.1 baseline offered.

Inspection only, and it takes a host, a user and a password from the environment rather than a managed credential. PI and PO are also on their own end-of-maintenance path, which is the context any investment here sits in.

Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.

Provisioned per plan and per component, so capacity and cost are decisions taken before any model exists. And it is the database, not a warehouse — modelling, loading and cataloguing are the products above it, and reaching it directly bypasses every semantic they add.

Archived The declared repository is archived.

Functional boundary With one SAP system the README says to point the client at that arc-1 directly. Version 1 exchanges tokens within a single subaccount, so backends spread across subaccounts are out; it keeps its session map in memory, so more than one instance needs sticky sessions or a shared store. It routes deterministically and runs no model, which is a different thing from an assistant that reasons across systems. The `/all` endpoint drops the per-connection isolation, and the maintainer's answer to that is a PROD backend set read-only at the SAP end rather than a tool surface that hides the writes.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.

It acts on a real account. Authorisation is the caller's own — single sign-on through the SAP Default Identity Provider, across the global accounts that identity reaches — so what it can change is what you can change, and an agent invoking it is doing administration rather than proposing it. No public source, so what it exposes is what the documentation says it exposes.

1 of 8 plans deprecated.

Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.

SAP's own guidance is narrower than the service's reach: it names standalone, single-tenant applications that do not connect to other applications as the fit, and says to stay on [the HTML5 Application Repository](artifact:btp-html5-application-repository) and the application router where those meet your needs better. Four hard limits decide it before taste does — 300 requests per second per subaccount, ten retained versions per application, 100 MB per application and 400 MB for the deployment archive.