Static analysis
Catching problems in code before it runs: naming, obsolete statements, security findings, and compatibility with a target environment. Style linting, security scanning and cloud-readiness checks are often treated as one concern.
Overview
Catching problems before activation — naming, obsolete statements, security findings, and the cloud-readiness of a given object.
Standard ABAP →
code pal for ABAP ATC and Code Inspector checks for the parts of Clean ABAPClean ABAPSAP's open, versioned style guide for ABAP: the answer to how a piece of ABAP should be written, an agreement a team adopts rather than anything to install.sap official, abap a static analyser can actually check, installed into a system with [abapGitabapGitmaintains 1 entrycommunity org](artifact:abapgit-abapgit) rather than delivered with it.
Not covered: It stops at the system boundary. ATC needs a system to run in, so it cannot gate a pull request before the code reaches one.
Checks that run outside the system on serialised source, in a pull request or in CI: abaplintabaplintStatic analysis for ABAP that runs outside a system on serialised source in a repository, so ABAP checks run in a pull request and in CI before the code ever reaches a system.community org, abap, with abaplint-Ext-for-abapgitabaplint-Ext-for-abapGitSurfaces abaplint results inside abapGit itself, at the point where a developer is already looking.independent, abap and the abaplint SCI client bringing its findings into abapGit, Code Inspector and ATC. Rule packs that run inside the system, such as code pal for ABAPcode pal for ABAPATC and Code Inspector checks for the parts of Clean ABAP a static analyser can actually check, installed into a system with [abapGit](artifact:abapgit-abapgit) rather than delivered with it.sap official, abap from SAP and abapOpenChecksabapOpenChecksAn open-source rule pack for SAP Code Inspector and ABAP Test Cockpit, installed via abapGit and activated as a check variant.independent, abap, extend ATC and Code Inspector, and analysers for CDS source and for single programs sit beside them.
Artifacts
Content
Group by8 of 8 pieces
Piece, what it offers
SAP BAIP, ABAP environment – How to build partner solutions and get them certifiedSAP BAIP, ABAP environment – How to build partner solutions and get them certifiedA Devtoberfest 2026 session on the two ways a partner ships an ABAP Cloud solution built on SAP BTP ABAP environment, which the session calls the ABAP environment of SAP Business AI Platform: software delivery, where an add-on product is published with the solution ID from SAP Store onboarding and the customer discovers and deploys it into their own system, and service delivery, where the partner operates the same add-on as a multi-tenant SaaS and a new version is deployed rather than published again. That is the ABAP environment edge; the static analysis edge rests on the quality steps shown in the landscape portal, where the Manage Continuous Testing app released with 2608 runs an ATC check variant against a configured system on a recurrence pattern, beside test product version builds and managed test tenants. The second half walks through the SAP Integration and Certification Center process and the three BTP certification options open to an add-on product.SAP Developers, published 2026-10-12
News from Custom Code Migration: ECC to SAP S/4HANA Powered by Agentic AINews from Custom Code Migration: ECC to SAP S/4HANA Powered by Agentic AIA Devtoberfest 2026 session (ABA-23) on what SAP has added to the ECC to SAP S/4HANA custom code migration tools, demonstrated across a live ECC and an S/4HANA system. The first half stays deterministic and explains static analysis in that process: the custom code migration app's scoping over ABAP test cockpit findings, an explain of a legacy report and of an S/4HANA simplification finding, and transferable quick fixes exported from the app and applied on the ECC system through the SAP GUI ATC transaction before conversion. The second half runs the S/4HANA custom code migration agent in ABAP Development Tools for Eclipse: GitHub Copilot drives the ADT MCP Server's ATC and quick-fix tools in a loop, SAP Joule for Developers, ABAP AI capabilities produces the AI code proposals behind it, and only the high-confidence ones are written into the code, the rest left as comments in one transport request.published 2026-09-28
How to Scan Custom ABAP for Security Issues in Eclipse (Step-by-Step)How to Scan Custom ABAP for Security Issues in Eclipse (Step-by-Step)Written by someone who works on the tool, this is a setup walkthrough for the RedRays ABAP Scanner Eclipse plugin: get a demo API key, install the plugin via an update site, point it at a backend, and scan an ABAP object from the Project Explorer. Findings for SQL/ADBC injection, OS command execution, path traversal, missing AUTHORITY-CHECK and similar are grouped by severity with a CVSS score and an automated exploitability check, and a REST API extends the same scan to a CI/CD allow/block gate on a transport.vahagn, published 2026-07-03
Show 5 more
How to extend ABAP Test Cockpit on SAP BTP for custom use casesHow to extend ABAP Test Cockpit on SAP BTP for custom use casesWalks through the released, C1-contract APIs and CDS views for extending ABAP Test Cockpit on SAP BTP: the single entry point CL_SATC_API=>CREATE_API_FACTORY, reading a run's findings and headers through SATC_API_FINDINGS and SATC_API_RESULT_HEADERS, starting synchronous local ATC runs for a transport, approving or rejecting exemptions programmatically, configuring approver responsibility areas without a UI, and implementing a custom check through IF_CI_ATC_CHECK. Code snippets show each API in use, including the CDS views that join ATC results to the Custom Code Migration app's own findings.OlgaDolinskaja, published 2026-05-20
ABAP Development Automation with ARC-1 and GitHub WorkflowsABAP Development Automation with ARC-1 and GitHub WorkflowsA sample repository puts an ABAP package into GitHub with abapGit and connects GitHub Actions to ARC-1 on BTP through an API key with no write tools, so abaplint on the diff, ABAP Unit and ATC through SAPDiagnose, label-triggered Copilot and Claude reviews, and ST22 dump triage all run as checks on a pull request. The review case is PR #14, where a SAPRead of the activated method let Claude state that a direct SELECT from MARA was new in the PR and not yet active in SAP, which a diff-only review cannot know. The test gate reads activated objects, so a team that pushes before activation needs a sandbox or a pull-and-activate step, and pulling a merged change back into SAP is named as the next step, not built.published 2026-05-12
Taking Control of Clean Core: When to Use Project Kernseife in addition to Standard SAP ToolsTaking Control of Clean Core: When to Use Project Kernseife in addition to Standard SAP ToolsWalks through how SAP's standard path classifies custom ABAP extensions into Clean Core Levels A through D, running ABAP Test Cockpit against the Cloudification Repository's release status for each SAP object an extension touches, then feeding results into the RISE with SAP Methodology Dashboard in SAP Cloud ALM. Contrasts that with Project Kernseife, an open-source custom ATC check that lets a team override SAP's classification with project-specific rules, define its own successor objects (including custom wrappers), and expose a Score and Potential Score per finding through a CDS view for prioritizing cleanup — at the cost of owning and maintaining that classification. States which situations favor each: Kernseife where the standard rules are too rigid for the project's reality, the standard dashboard where cross-system comparability and low maintenance effort matter more.LBretschneider, published 2025-11-04
Patterns for using LLMs in ABAP developmentPatterns for using LLMs in ABAP developmentLars Hvam compares eight ABAP development setups: assistance in SE80 or Eclipse, virtual files and MCP over ADT, a centrally managed MCP service, sandboxes, local Git, Git with read-only system context, and temporary ABAP systems for development and CI. The overview describes where source changes, review and system access happen, including abapGit synchronization and abaplint checks. It is dated March 2026; its risk, cost and autonomy ratings are the writer’s assessments.
Rethinking security for modern SAP solution landscapesRethinking security for modern SAP solution landscapesWhere risk goes when clean core moves custom logic out of SAP S/4HANA: into integration flows, CAP extensions, ABAP Cloud code and platform configuration, told through real attack stories, then scanning code, modelling attack paths, adding security gates to CI/CD pipelines and automating safely with Terraform. The scanning edge is to static analysis, the atlas's concern for security findings in ABAP code; the abstract lists the four surfaces and the four practices and describes none of them. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Tsovinar Chugaszyan, written here from SAP's abstract; the recording is not yet published.
Patterns for using LLMs in ABAP developmentPatterns for using LLMs in ABAP developmentLars Hvam compares eight ABAP development setups: assistance in SE80 or Eclipse, virtual files and MCP over ADT, a centrally managed MCP service, sandboxes, local Git, Git with read-only system context, and temporary ABAP systems for development and CI. The overview describes where source changes, review and system access happen, including abapGit synchronization and abaplint checks. It is dated March 2026; its risk, cost and autonomy ratings are the writer’s assessments.
Seen working
ArtifactSignalsLast activity
Samples
ATC-Best-Practice-GuideATC-Best-Practice-GuideCompanion material to DSAG's German-language ATC best-practice guide: four custom ABAP Test Cockpit check classes for formatting, code rules, header comments and German and English texts, plus snippets.independent, abap
ATC-Best-Practice-Guide
Last pushLast commit
off-stack-abapoff-stack-abapA demonstration of off-stack ABAP development: one class with an add method, linted by abaplint, transpiled to JavaScript and run with its ABAP Unit tests on Node.js.independent, abap
off-stack-abap
Last pushLast commit
Details
Coverage
For your agent
- Ref
capability:abap-static-analysis- JSON
- /capabilities/abap-static-analysis.json
- MCP
- Connecting an agent