Reference architectureReference architectureA published architecture with a diagram and named components. The topology outlasts the product names in it.See every one →SAP Architecture Center
Agentic AI & AI Agents
SAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.
Where it sits
Explains
Agent toolingAgent toolingBuilding an agent into your own application — the tools it may call, the state it keeps between turns, and the framework it runs in. Distinct from MCP servers, which expose an application to somebody else's agent, and from agent guidance, which is knowledge handed to a coding agent.Serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through [service integration](capability:service-integration), connecting its exposed contract with [agent access to your systems](capability:agent-systems-access). Development assistance belongs to [agent access to your code](capability:agent-code-access).Tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.
Source
reachable
Who is behind it
SAP Architecture CenterSAP Architecture CenterWrote this
In the atlas: maintains 1, wrote 26author
In the atlas: maintains 1, wrote 26author
Architecture
parts read from 9 readme files,Parts, as the source names them
- Business useran actorexpresses a goal in Joule, which orchestrates actions across SAP and non-SAP systemsRA0029 readme.md in SAP/architecture-center
Users express a goal and Joule orchestrates actions across SAP and non-SAP systems to get it done.
RA0029 8-ai-agent-identity/readme.md in SAP/architecture-centerThe user accesses SAP Joule through an application client (mobile or desktop).
- Developeran actorworks in their own IDE with the Joule Studio CLI and a coding agent connected via MCPon Built in Joule Studio's Pro-Code Flow with the jl CLI and a coding agent, deployed to the SAP-managed runtimeRA0029 2-building-ai-agents-with-joule-studio/readme.md in SAP/architecture-center
The **Pro-Code Flow** uses the Joule Studio CLI (`jl`) with a coding agent (Claude Code or OpenCode) connected via MCP.
RA0029 2-building-ai-agents-with-joule-studio/readme.md in SAP/architecture-centerYou work locally in your own IDE — the same IBD phases apply, but the coding agent drives implementation.
- Third-party AI agents and clientsan actorconsume Joule Agents via the Agent Gateway over A2A, or are orchestrated by Joule for SAP-specific tasks3rd Party IntegrationRA0029 readme.md in SAP/architecture-center
**AI Agents & Clients:** Google Cloud, Microsoft Azure, AWS, IBM Cloud and other AI platforms and clients — either consuming Joule Agents via the Agent Gateway (A2A) or being orchestrated by Joule for SAP-specific tasks.
RA0029 readme.md in SAP/architecture-center**Inbound (Agent Gateway — A2A):** Third-party AI platforms and clients consume Joule Agents through the Agent Gateway via A2A. Google Vertex AI, Microsoft Copilot Studio, AWS Bedrock and others can delegate SAP-specific tasks to Joule Agents, with trust established via SAP Cloud Identity Services.
- External MCP clientsan actorconnect to SAP business capabilities as tools through the MCP Gateway, Microsoft Copilot Studio among them3rd Party IntegrationRA0029 readme.md in SAP/architecture-center
**Third-Party MCP Access:** External MCP clients — such as Microsoft Copilot Studio — can connect to SAP business capabilities via the MCP Gateway in SAP Integration Suite, providing governed, enterprise-grade tool access without custom MCP server development.
RA0029 10-third-party-mcp-access/1-copilot-studio-with-mcp/readme.md in SAP/architecture-centerIn this pattern, Copilot Studio acts as the **MCP client**, and the **MCP Gateway in SAP Integration Suite** acts as the governed entry point that exposes SAP APIs, integration flows, and data sources as MCP-compliant tools.
- SAP Jouleunified AI engagement layer: Joule Work, Joule Assistants and Joule Agents, with the Joule Orchestrator routing requests to agentsSAP Business AI Platform, SAP-managedRA0029 readme.md in SAP/architecture-center
SAP's approach centers on **Joule** as the unified AI engagement layer: **Joule Work** is where users express intent and AI orchestrates outcomes across systems; **Joule Assistants** coordinate agents across business functions; and **Joule Agents** handle the specific, multi-step tasks that drive real process automation.
RA0029 readme.md in SAP/architecture-centerAll of this is powered by the **Joule Orchestrator (Agent Harness)**: a multi-step reasoning and orchestration engine that routes requests to agents and loads the tools and skills needed to execute them, including built-in capabilities for grounding and data access across SAP's application landscape.
- SAP AI Coremanaged runtime where Joule Studio agents executeSAP Business AI Platform, SAP-managedon Built in Joule Studio's browser-based Low-Code Flow, deployed to the SAP-managed runtime, Built in Joule Studio's Pro-Code Flow with the jl CLI and a coding agent, deployed to the SAP-managed runtimeRA0029 4-integrate-ai-agents-with-joule/readme.md in SAP/architecture-center
**Execution:** When a user's prompt matches the agent's purpose, Joule invokes the corresponding Dialog Function, which in turn delegates the execution to the managed runtime on SAP AI Core where the agent logic resides.
RA0029 2-building-ai-agents-with-joule-studio/readme.md in SAP/architecture-center**Managed Runtime:** Agents deploy to the SAP-managed runtime — SAP handles scaling, monitoring, and operations. Solutions are accessible immediately after deployment.
- @sap/joule-work-dev-cli-early-adoptersJoule Studio CLI: initialising projects, managing deployments and connecting to Joule Studio landscapeson Built in Joule Studio's Pro-Code Flow with the jl CLI and a coding agent, deployed to the SAP-managed runtimeRA0029 2-building-ai-agents-with-joule-studio/readme.md in SAP/architecture-center
**Joule Studio CLI (`jl`):** Command-line interface for initializing projects, managing deployments, and connecting to Joule Studio landscapes.
RA0029 2-building-ai-agents-with-joule-studio/readme.md in SAP/architecture-center**Managed Runtime:** Same deployment target as the Low-Code Flow — solutions deploy via `jl solution deploy` and register automatically with Joule.
- @sap/cdsorchestration framework structuring the pro-code agent's use case logic, data management and service integrationCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
The **SAP Cloud Application Programming Model (CAP)** serves as the orchestration framework for structuring agent use case logic, data management and service integration.
RA0029 readme.md in SAP/architecture-center**Custom Agents — Bring Your Own Agent:** Pro-code AI agents built with SAP Cloud SDK for AI (Python or TypeScript), deployed in the customer's BTP subaccount and connected to Joule via the A2A protocol.
- @sap-ai-sdk/orchestrationSAP Cloud SDK for AI: type-safe access to the Generative AI Hub, foundation models and AI-specific servicesCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**SAP Cloud SDK for AI:** The primary SDK for building pro-code agents on SAP BTP. Provides type-safe abstractions for interacting with Generative AI Hub, foundation models and AI-specific services. Supports both Python and TypeScript/JavaScript development and integrates with popular agent frameworks like LangGraph, AG2 (AutoGen), CrewAI, Smolagents and others.
- SAP AI CoreGenerative AI Hub: harmonized orchestration service layer with foundation model accessCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**Generative AI Hub:** Central AI capabilities platform delivered as features within SAP AI Core and SAP AI Launchpad:
RA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center**Harmonized Orchestration Service Layer:** Unified API layer providing access to foundation models with built-in capabilities including:
- SAP AI Launchpadmanaging AI scenarios, deployments and configurationsCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**SAP AI Launchpad:** Centralized interface for managing AI scenarios, deployments and configurations
RA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center**Generative AI Hub:** Central AI capabilities platform delivered as features within SAP AI Core and SAP AI Launchpad:
- SAP HANA CloudVector Engine for semantic retrieval and RAG, Knowledge Graph Engine for reasoning over SAP business objectsCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**SAP HANA Cloud:** Provides critical data services for AI agents:
RA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center**Vector Engine:** High-performance vector search for semantic retrieval and RAG (Retrieval-Augmented Generation) patterns
- SAP Destination servicedestination management for SAP cloud solutions, third-party applications and on-premise systemsCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**SAP Destination Service:** Centralized destination management for accessing SAP Cloud Solutions, third-party applications and on-premise systems via HTTPS protocols
- SAP Connectivity serviceconnectivity to on-premise systems via SAP Cloud ConnectorCustomer's BTP subaccounton Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**SAP Connectivity Service:** Secure connectivity to on-premise systems via SAP Cloud Connector
- Cloud Connectorreach into on-premise systemson Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**SAP Connectivity Service:** Secure connectivity to on-premise systems via SAP Cloud Connector
- SAP Integration SuiteMCP Gateway exposing SAP and non-SAP APIs as governed MCP tools, and A2A Connectivity between SAP and third-party agentsCustomer's BTP subaccountRA0029 readme.md in SAP/architecture-center
**MCP Gateway:** Customer-managed, governed MCP exposure for SAP and non-SAP APIs. Provides enterprise-grade tool access with security, rate limiting, observability and lifecycle management built in — without requiring custom MCP server development.
RA0029 readme.md in SAP/architecture-center**A2A Connectivity:** Governed, customer-controlled Agent-to-Agent (A2A) communication between SAP-native agents and third-party agents, or between heterogeneous third-party agents.
- Cloud Identity Servicesidentity hub for human and agent identities: authentication, authorization and identity federationRA0029 readme.md in SAP/architecture-center
**SAP Cloud Identity Services** is the identity hub — managing authentication, authorization and identity federation across all connections.
RA0029 8-ai-agent-identity/readme.md in SAP/architecture-centerSAP Cloud Identity Services acts as the central identity hub for both human identities and agent identities.
- SAP SuccessFactorsSAP cloud solution the agents connect to and the gateway's tools act onSAP Cloud SolutionsRA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**Integration with SAP Systems:** Seamless connectivity to SAP S/4HANA, SAP SuccessFactors, SAP Concur, SAP Customer Experience, SAP Business Networks and other SAP Cloud Solutions
RA0029 10-third-party-mcp-access/1-copilot-studio-with-mcp/readme.md in SAP/architecture-center**SAP S/4HANA, SuccessFactors, Concur, Customer Experience, Business Data Cloud, custom MCP servers, third-party APIs** | The authoritative systems the tools act on
- SAP Business Data Cloudgoverned SAP analytics data the gateway's tools act onRA0029 10-third-party-mcp-access/1-copilot-studio-with-mcp/readme.md in SAP/architecture-center
**SAP S/4HANA, SuccessFactors, Concur, Customer Experience, Business Data Cloud, custom MCP servers, third-party APIs** | The authoritative systems the tools act on
RA0029 10-third-party-mcp-access/1-copilot-studio-with-mcp/readme.md in SAP/architecture-center"Summarize Q2 revenue variance by region" — the agent grounds its answer in governed SAP analytics data rather than ungoverned exports.
- Serve your application over MCPexternal MCP servers and APIs that extend agent capabilities3rd Party IntegrationRA0029 readme.md in SAP/architecture-center
**Tools:** External MCP Servers and APIs that extend agent capabilities and provide additional data sources and actions.
- Serve your application over MCPcustom MCP server a customer or partner builds and operates on SAP BTPCustomer's BTP subaccountRA0029 10-third-party-mcp-access/readme.md in SAP/architecture-center
A customer or partner builds and operates a custom MCP server, deploying it on SAP BTP (Cloud Foundry, Kyma, or a containerized workload).
RA0029 10-third-party-mcp-access/readme.md in SAP/architecture-centerThis pattern places full operational and security responsibility, including the application code, SAP BTP configuration, credential lifecycle and security hardening, on the customer or partner deploying it. Hosting on SAP BTP reduces infrastructure risk but does not automatically provide governance tooling.
Roles the source leaves open
- Custom agent, bring your own agenta capability, Agent toolingcalled over A2ARA0029 3-bring-your-own-agent/readme.md in SAP/architecture-center
**Agent2Agent (A2A) Protocol:** Pro-code agents expose A2A-compliant server endpoints to integrate with Joule, enabling external systems to delegate tasks to custom agents
RA0029 1-a2a-and-mcp/readme.md in SAP/architecture-centerFor pro-code agents, exposing an **A2A-Server endpoint** is the primary mechanism for integrating with Joule.
The source draws it as @sap/cds, @sap-ai-sdk/orchestration.
Nothing in the graph covers it: the reader's own code fills it, and the figure draws it as a dashed box.
Ways the source names
- Built in Joule Studio's browser-based Low-Code Flow, deployed to the SAP-managed runtimeRA0029 readme.md in SAP/architecture-center
Custom agents can be built in Joule Studio and deployed to the SAP-managed runtime or developed and deployed to a customer-managed BTP subaccount.
RA0029 readme.md in SAP/architecture-centerTwo flows are available: a **Low-Code Flow** using the visual, browser-based builder (no local setup required), and a **Pro-Code Flow** using your own IDE with the Joule Studio CLI and a coding agent connected via MCP.
- Built in Joule Studio's Pro-Code Flow with the jl CLI and a coding agent, deployed to the SAP-managed runtimeRA0029 readme.md in SAP/architecture-center
Two flows are available: a **Low-Code Flow** using the visual, browser-based builder (no local setup required), and a **Pro-Code Flow** using your own IDE with the Joule Studio CLI and a coding agent connected via MCP.
RA0029 2-building-ai-agents-with-joule-studio/readme.md in SAP/architecture-centerThe **Pro-Code Flow** uses the Joule Studio CLI (`jl`) with a coding agent (Claude Code or OpenCode) connected via MCP.
- Bring your own agent: built with SAP Cloud SDK for AI and CAP in the customer's BTP subaccount, connected to Joule over A2ARA0029 readme.md in SAP/architecture-center
Custom agents can be built in Joule Studio and deployed to the SAP-managed runtime or developed and deployed to a customer-managed BTP subaccount.
RA0029 readme.md in SAP/architecture-center**Bring Your Own Agent:** Develop agents with full programmatic control using SAP Cloud SDK for AI (Python or TypeScript) and integrate popular frameworks (LangGraph, AG2, CrewAI, Smolagents). Deploy to the customer's BTP subaccount as a self-managed runtime and connect to Joule via the A2A protocol.
Properties
About this work
Group by154 of 154 pieces
Piece, what it offersStill applies
CAP in the age of AI #7 - vector embeddings wrap-upCAP in the age of AI #7 - vector embeddings wrap-upThe same embeddings model taken from SQLite to SAP HANA Cloud, then handed to an agent. Locally it is @cap-js/ai that adds the vector functions SQLite lacks and downloads an all-MiniLM L6v2 ONNX model on first start; on HANA natural language processing has to be switched on, the model name is a mandatory argument, the vectors it returns are 768 dimensions, and dimensions must match on both sides of a comparison. HANA itself can be given SAP AI Core as a remote source for other embedding models, which a CDS.ql expression has to inject because the postfix notation only takes what the CDS model holds, and the hour ends with a search function over cosine similarity exposed over @cap-js/mcp, so an agent asked about low output from solar panels calls semantic search instead of writing the query itself.published 2026-10-16
SAP Meets the Agentic Web: CAP MCP - UI5 WebMCPSAP Meets the Agentic Web: CAP MCP - UI5 WebMCPA Devtoberfest 2026 session (CAP-42) that puts MCP and WebMCP side by side: MCP exposes a backend to an agent, WebMCP exposes the tools of a web page to whatever agent arrives at it, and only Chrome behind a flag and Cloudflare's Kite browser support the second one today. The CAP half starts with two agents scraping a Fiori elements app with Playwright and browser dev tools, then annotates the catalogue service with the MCP protocol through @cap-js/mcp, after which the agent calls the generated describe tool instead of parsing pages. The UI5 half registers a search-authors tool on the browser's model context API inside the same app, with the cross-origin isolation header the API requires, and lists it through the WebMCP Chrome extension — the agent run against it ends on an exhausted Gemini key rather than a result.published 2026-10-16
Building Code-Based AI Agents on the BAIPBuilding Code-Based AI Agents on the BAIPA Devtoberfest 2026 session on writing the agent yourself rather than configuring one, which is the agent tooling edge: an agent is a model with tools, skills, memory and context around it, and the session reads the code of one built in CAP as a LangGraph state graph, with an agent node that calls the model, a tools node holding the MCP clients, and the edge between them looping until no tool is needed. It then shows the shorter route, a CDS service annotated for the agent protocol with its instructions and skills in an agent.md file. SAP AI Core carries both, with the CAP service in front of it as middleware so the credentials never reach the browser, and that is what cap-agent-ui5-webui is demonstrated against: added as a dependency, it gives the annotated service a UI5 chat interface that can be deployed rather than only previewed. A Python multi-agent application on Cloud Foundry, where an orchestrator delegates to per-stack specialists so no single model sees every tool, closes the session.published 2026-10-09
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
CAP in the age of AI #5 - agents wrap-upCAP in the age of AI #5 - agents wrap-upThe agents topic closed out on what sits around the agent rather than inside it, now that the documentation has moved into capire. The chat preview's session is persisted in the database rather than kept in memory, traces go out through @cap-js/telemetry to a self-hosted MLflow under the OpenTelemetry conventions for generative AI, and the panel is explicit that @agent reuses the MCP adapter's code programmatically without serving an MCP endpoint. It ends in the xtravels sample, where a travel agent delegates to a hotel-service sub-agent and reaches a separately started flight service over MCP through the service binding CAP resolves anyway. Earlier in the hour the same agent answers from a model running on the presenter's laptop, reached as an OpenAI-compatible endpoint.published 2026-10-02
What's in Daniel Hutzel's brain?What's in Daniel Hutzel's brain?A Devtoberfest 2026 session in the building-apps track, in which Daniel Hutzel and DJ Adams work through what the CAP team is building for agents. A bookshop gets an MCP endpoint beside its OData one from a single annotation, with the plugin writing the coding agent's configuration itself; in the xt-travels sample five services that know nothing about each other are served over MCP and an agent does the orchestration the hand-built UI and its value helps used to do. Hutzel then annotates a service as an agent so the ReAct loop and the choice of model move into the CAP service, and finally drops MCP for a skill that teaches the agent CQL instead, which is where the edges to Serve your application over MCP, Agent tooling and Agent guidance come from. The mechanism under all of it, a plugin file in the package root and event handlers that can be added to any CAP service, is the edge to Plugin authoring.published 2026-10-02
Real Pro-Code Development with Joule StudioReal Pro-Code Development with Joule StudioA Devtoberfest 2026 AI-track session that runs one agent build across both of Joule Studio's paths. Playing a procurement manager, one presenter states the intent in the browser, answers the clarifying questions, watches the fit-gap analysis name the S/4HANA APIs the use case needs, and pushes the intent and requirements document to GitHub; the other clones it and carries on in a terminal, logging in with the jl command line against her landscape URL and running its init command to fetch Joule Studio's skills for OpenCode. From there the coding agent writes the specification, the discovered API specifications, the MCP translation and the agent's Python file with its model configuration and evaluation scenarios, which is the edge to Agent tooling; the skills themselves, which SAP says not to edit but which a developer may add to, are the edge to Agent guidance.SAP Developers, published 2026-10-01
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Meet Joule Studio and Build your First AI AgentMeet Joule Studio and Build your First AI AgentA Devtoberfest 2026 session from the product manager of Joule Studio, walking one agent through the whole path the tool defines: an intent, the problem statement and goals a coding agent derives from it, the business context it takes from the SAP knowledge graph, and the solution type it proposes with a stated intent fit. The demo is a collections agent that drafts dunning emails: the product requirements document names the metrics and the human-in-the-loop review, the technical specification lists the artifacts to build — the MCP tools among them — and the build is followed by a business test run against business partner 10001, technical unit tests, and deployment to the managed runtime, where the agent and its MCP server appear as deployed assets. Two points shape how it is used rather than what it produces: every asset is a file, editable in the web editor or in the code view and pushable to git, and the same solution can be built from local pro-code tools; n8n workflows are stated as delivered out of the box inside the studio.SAP Developers, published 2026-09-24
What's new in SAP Cloud Application Programming Model – September 2026What's new in SAP Cloud Application Programming Model – September 2026The September 2026 release turns CAP services into A2A-callable agents through the new @cap-js/agents plugin, which generates MCP tools from a service's entities and actions, adds an @agent.hitl approval gate and can read an AGENTS.md/SKILL.md pair for custom behaviour. The @cap-js/mcp plugin for Node.js and com.sap.cds:cds-adapter-mcp for Java reach general availability, serving describe, query and call tools over existing CAP authentication and authorisation. It also names capire/skills, SAP's curated skill library that teaches coding agents current CAP practice.published 2026-09-24
Expose RFCs as MCP Tools in Integration SuiteExpose RFCs as MCP Tools in Integration SuiteWalks through creating an MCP server in SAP Integration Suite from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.ronit199666, published 2026-09-24
From APIs to Agent Tools: How MCP Gateway changes what Integration meansFrom APIs to Agent Tools: How MCP Gateway changes what Integration meansThe opening session of the Devtoberfest 2026 integration track, in which two product managers for SAP Integration Suite set out why the suite puts an MCP gateway between agents and backend systems, and then build one. The demo turns an HTTP endpoint and its OpenAPI specification into MCP tools on the integration cell runtime, does the same on top of an existing API-centric integration, and shows the policies tab where authentication through an external provider, quotas, spike arrest and IP filtering sit, plus the trace of the JSON-RPC calls in monitoring and the agent they are earmarked against in analytics. That is where the serve your application over MCP and tool governance edges hold; RFCs and BAPIs as sources are stated as supported, and MCP federation, custom domains and edge integration cell as roadmap.SAP Developers, published 2026-09-23
Supercharge Joule Desktop: Connect Any SAP API in Minutes with MCP GatewaySupercharge Joule Desktop: Connect Any SAP API in Minutes with MCP GatewayDevtoberfest 2026 session INT-13, in which an SAP solution advisor connects a live S/4HANA system to the desktop experience of Joule Work through the MCP gateway in SAP Integration Suite. One OpenAPI specification covering business partners, sales orders, material stock, billing and purchase requisitions is uploaded as an MCP server artifact, deployed to integration cell with XSUAA inbound authentication, and registered as an MCP connector; the destination behind it is then switched from basic authentication to principal propagation, and the Cloud Connector monitor shows the same question arriving as the presenter's own user. That demonstration is the serve your application over MCP edge, and the second half is Joule Work itself: a Markdown skill that fixes the steps and format of a customer briefing, and a Space the skill rebuilds with each run.SAP Developers, published 2026-09-23
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
Combining AI Agents with the power of SAP HANA embedded ML (part 1)Combining AI Agents with the power of SAP HANA embedded ML (part 1)Devtoberfest 2026 session DAT-12, the first of two parts, in which Vitaliy Rudnytskiy does a data scientist's work against the embedded machine learning of SAP HANA Cloud by talking to an agent. The session first takes an agent apart into its LLM, its tools, its memory and the loop between them, then stacks the Predictive Analysis Library under the hana-ml Python wrapper and that under the HANA AI toolkit, whose tools an agent calls from plain English in a notebook to preview a sales refunds table, split it into train and predict tables, run a time-series check and train an AutoML forecast, keeping what it decided in Markdown memory files. That is the agent tooling edge; the same toolkit is then started as an MCP server over stdio and over streamable HTTP and reached from a coding agent and from Joule Work's desktop, which is where the live demo partly fails and the failure is shown.published 2026-09-22
Governance at Scale: Why a Clean Core Is What Makes Agent Governance EnforceableGovernance at Scale: Why a Clean Core Is What Makes Agent Governance EnforceableClosing a six-part clean-core series, the post argues that SAP's two agentic-AI governance mechanisms only work against a documented tool surface: MCP Gateway in SAP Integration Suite auto-translates API specifications into MCP tool schemas augmented with natural-language semantics, carrying forward existing authentication, authorization and rate limiting into the agentic layer, while AI Agent Hub, built on SAP LeanIX, discovers and runs verification assessments on agents, LLMs and MCP servers before the resulting badge is read by Joule Studio or SAP Integration Suite to decide what is trusted. Its argument holds the mechanisms up against an undocumented internal interface, where the auto-generated schema and the verification badge have nothing real underneath them, and against a consolidated CAP service exposing only released APIs, where both do.DEEPA_DORAIRAJ, published 2026-09-21
September 15th: What's New on developers.sap.comSeptember 15th: What's New on developers.sap.comThomas Jung walks through a week of changes aimed at agentic consumption of developers.sap.com itself: the hosted MCP server gains a published .well-known/mcp.json manifest, curated tools (search_tutorials, get_tutorial_step with a Markdown format option, search_channels), and a listing in the ORD catalog beside its OData, REST and GraphQL APIs. It also documents the site's existing A2A endpoint for the first time and ships a way to turn a tutorial into an installable, cryptographically signed AI Skill with a generated verification script, both concrete instances of agent tooling; separately, five broken GraphQL example queries were fixed and the full SDL is now served, and new sitemap.md, llms.txt fixes and ORD entries round out the site's own metadata publishing.published 2026-09-15
No-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentNo-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentWalks through turning a deployed API artifact into a no-code MCP server in SAP Integration Suite's MCP Gateway: the API artifact's OpenAPI spec must be version 3.0.0-3.0.3, since Swagger 2.0 is rejected, and its backend is reached through a BTP Destination using OAuth2ClientCredentials so the agent calling the server never sees the backend secret. The API artifact's own Authorization policy sets an OAuth scope and Trust Upstream MCP Authorization, and the gotcha list traces a 403 on a valid token to that policy rather than to authentication, before the finished MCP server is published through Developer Hub and connected to Claude Code.eddiedu, published 2026-09-15
CAP in the age of AI #4 - more on agentsCAP in the age of AI #4 - more on agentsAsking a human first, and telling the agent how to behave. Ordering a book through @cap-js/agents happens without a question being asked; the human-in-the-loop annotation on the action turns the same request into an approve-or-reject step, which the episode follows down to the A2A status update that stores the task in an input-required state in the database — A2A itself being JSON-RPC 2.0 over HTTP with server-sent events for the stream. The rest is instructions on disk: an agents.md in the service's own folder removes the question about how many copies to order, a skill under a skills folder is advertised by its description and read only when the agent decides the case applies, and either file makes the plugin build a deep agent instead of the plain one.published 2026-09-11
Building and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleBuilding and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleA hands-on walkthrough of building a native MCP server artifact on SAP Integration Suite's Integration Cell runtime: an API artifact built from an OpenAPI 3.0 specification (the author converted the SAP Business Accelerator Hub's Swagger 2.0 OData spec) through API Management policies, with the MCP artifact's own Authorization policy set to the api.invoke scope for Developer Hub credentials or a custom role such as ESBMessaging.send for BTP OAuth credentials. The same server is then wired to Claude as a custom connector over an OAuth redirect, and to a Joule Studio agent through BTP destinations carrying the sap.mcp.tools.enabled property, with three worked agents (CPI monitoring, a SuccessFactors testing flow, IDoc reprocessing) run from both.Padmanathan_Vijayan, published 2026-09-11
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
ABAP + MCP: Let AI Do Real Development in Your SAP SystemABAP + MCP: Let AI Do Real Development in Your SAP Systemabap-adt-mcp is an open-source MCP server that gives an AI agent full ABAP development capability over ADT: it searches, reads, edits, activates and unit-tests objects, and runs ATC checks, on a connected S/4HANA Cloud or on-premise system, acting as the signed-in developer. It runs on abap-adt-api, the same REST client Eclipse's own ADT tooling uses, and sits beside SAP's own ADT MCP Server, shipped with ADT for VS Code and Eclipse under a different server key, and marianfoo's abap-docs, a read-only server over the ABAP Keyword Documentation and Clean ABAP. Each destination carries a policy — read-only, allowed packages, denied tables and tools — the server checks before every call, and an optional audit file logs each tool call with its outcome and policy gate.Willian_Saez, published 2026-09-03
SAP Integration Suite + MCP: A Practical Architecture for AI Agents and SAPSAP Integration Suite + MCP: A Practical Architecture for AI Agents and SAPLays out the runtime chain for exposing S/4HANA APIs to an AI agent through SAP Integration Suite: the agent calls a tool on the MCP Gateway, which is built from a governed API Artifact, which still runs on Cloud Integration for mapping, routing and error handling before reaching the backend. It states that the API-artifact approach requires the Integration Cell runtime rather than the normal CPI message-processing runtime, an OAuth-secured REST or OData artifact on OpenAPI 3.0.0-3.0.3, and an entitlement that is service-plan dependent (citing SAP Note 2903776) — so the architecture question is whether the landscape already has the right MCP entitlement, runtime and API foundation.aayushaggarwal, published 2026-09-02
SAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenSAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenReading SAP's API Policy v.4.2026a and its FAQ against the reference architectures, the piece narrows the widely repeated claim that SAP bans AI to what Section 2.2.2 actually restricts: an agent planning and chaining API calls outside an SAP-endorsed route, closed off further by Section 3's block on bypassing API Controls through custom code. It compares the endorsed and allowed paths — the MCP Gateway on SAP Integration Suite reaching S/4HANA and ECC through RFC-based back ends under a 15-tool, 200,000-token limit, SAP-provided MCP servers through Joule Studio, the A2A protocol, customer-operated MCP servers allowed under FAQ Question 56, and the ADT MCP Server, whose 18 tools work only on development artifacts and are documented as not intended for productive use. It leaves open whether Section 2.2.2 covers ABAP code that calls a model from inside the system, since enforcement is defined at the API-traffic level rather than by a list of tools.published 2026-08-31
From SAP Sales and Service Cloud V2 APIs to AI: Building an MCP Server with CAP Node.jsFrom SAP Sales and Service Cloud V2 APIs to AI: Building an MCP Server with CAP Node.jsA step-by-step CAP Node.js walkthrough that wraps the SAP Sales Cloud V2 Case API as a remote service, then exposes the resulting service over both OData V4 and MCP through a single @protocol: ['odata-v4', 'mcp'] annotation together with @cap-js/mcp's per_action_tool setting. Each CDS action — listCases, getCaseById, createCase, patchCase — becomes its own MCP tool served at /mcp/caseservices, discoverable through tools/list and invoked from a natural-language request.pvsbprasad, published 2026-08-31
Build Your AI Agent prototype for free using SAP CAP, LangChain and Ollama cloudBuild Your AI Agent prototype for free using SAP CAP, LangChain and Ollama cloudA CAP Node.js service action calls an Ollama-hosted model through LangChain's ChatOllama, with the API key read from a .env file instead of any destination or credential binding — the hand-rolled-key route SAP's own SDK call exists to avoid. The same handler then builds a LangChain agent with createAgent and one mock tool, so a question about restaurants triggers a tool call and any other question does not, independent of the @cap-js/agents plugin's A2A-served harness.rajeevgoswami1, published 2026-08-29
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
From Dashboard to Conversational AI in Minutes: Adding MCP to an Existing CAP ApplicationFrom Dashboard to Conversational AI in Minutes: Adding MCP to an Existing CAP ApplicationA walkthrough of adding @cap-js/mcp to an existing CAP service behind the SuccessFactors Localization Dashboard: two annotations (@odata, @mcp) expose the service over MCP beside its existing OData endpoint, and doc comments added to the 18 entities and their fields are surfaced through the describe tool so a querying model gets business context instead of bare field names. During local development cds watch auto-registers the endpoint in ~/.claude.json, and the author connects the same endpoint to Joule Work Desktop as an MCP connector so users can ask coverage questions in natural language.i533678, published 2026-08-24
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
CAP in the age of AI #3 - from MCP to A2ACAP in the age of AI #3 - from MCP to A2AThe episode that finishes @cap-js/mcp with authorisation and then crosses to agents. @requires and @restrict are the same annotations CAP already has, and the plugin reads them to filter the tool list and the describe output per user and per request, so a model is not told about entities the caller cannot reach — where the OData metadata of the same service lists every exposed entity regardless. The second half annotates a service with @agent from @cap-js/agents, which serves it over A2A with an agent card and a chat preview, runs first against a mocked response and then against SAP AI Core bound with cds bind and a hybrid profile, and reuses the MCP adapter's tools rather than defining new ones.published 2026-08-21
MCP Servers are the New Z-TablesMCP Servers are the New Z-TablesA single CAP service exposed as three overlapping MCP servers tools, queried by the same prompt nineteen times, returned the same tool every time — evidence, the author argues, that tool selection rests on the resemblance between a prompt and a tool's description rather than on any binding a where-used list could enumerate before retiring it. It contrasts that setup with @cap-js/mcp, which exposes a whole service as three generic tools instead of one per operation, and quotes the adapter's own beta documentation admitting no rate limiting, audit logging, input validation or approval workflow, and no use as a gateway to SAP Application APIs. From there it names four small Tool governance practices it has adopted: an owner recorded in the tool's own metadata, logging every invocation, deprecating inside the description, and exposing fewer tools.published 2026-08-21
Building a Pro-Code Agent on SAP BTP — Part 2: The Agent (LangGraph + GenAI Hub)Building a Pro-Code Agent on SAP BTP — Part 2: The Agent (LangGraph + GenAI Hub)Part 2 of a three-part series builds a separate, non-CAP Node/TypeScript agent that calls the Part 1 CAP service's MCP tools and reasons through SAP AI Core via @sap-ai-sdk/orchestration, using LangGraph's createAgent ReAct loop for provider-agnostic model calls across GPT, Claude and Gemini deployments. It explains why the tool's Zod schema and model-facing description are the agent's actual contract, the gotcha between a foundation-models deployment and an orchestration-scenario one, and how edge-case testing replaced date inference with a server-computed daysOverdue field after the agent wrongly called a delayed order 'on schedule'.rodfior, published 2026-08-20
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Adapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionAdapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionA custom Joule Agent and Joule Skill, built in Joule Studio, classic edition to extend SAP Joule past its built-in Purchase Order display and change features: a buyer's single sentence naming a Purchase Requisition number becomes a created Purchase Order, with the skill wrapping the Purchase Requisition and Purchase Order OData V4 APIs as Action Packages reached through two destinations. The author anchors the agent's success condition to a PurchaseOrderNumber in the skill's output rather than an HTTP status code, and reports that the Purchase Requisition item structure does not map one-to-one onto the Purchase Order creation payload.jonathanvi59, published 2026-08-19
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
CAP in the age of AI #2 - more on the MCP adapterCAP in the age of AI #2 - more on the MCP adapterWhat the query tool costs in tokens, and the third tool @cap-js/mcp registers. Counted against a model running locally under llama.cpp, the same query is 26 tokens as CQL and 173 as CQN, and the tool definition sent with every system prompt drops from around 5,500 tokens to around 600 — the reason CQL became the default format. The call tool then exposes a service's unbound actions and functions, as one generic tool or, behind a flag, one tool per action with its own description and input schema; a question from the chat about extension points gets the answer that the adapter does the tools, which the panel calls a small subset of the protocol.published 2026-08-14
Add MCP capabilities to a CAP serviceAdd MCP capabilities to a CAP serviceA fifteen-minute walkthrough of turning a plain CAP service into an MCP server: annotate the service with @mcp, install @cap-js/mcp, and it is served alongside OData at /mcp/<path>. The part worth reading it for is what happens next — cds watch writes the endpoint into the local agent's own configuration file, so OpenCode or Claude Code can call the service without anyone editing JSON by hand. It is built on the tiny-sample facet, so there is nothing to prepare, and it shows the protocol traffic rather than only the result. Written while the adapter was in beta, and it says so.published 2026-08-13
SAP Joule: Invoice Agent for Faster Supplier Invoice Release in SAP S/4HANA Accounts PayableSAP Joule: Invoice Agent for Faster Supplier Invoice Release in SAP S/4HANA Accounts PayableWalks through building an Invoice Release Agent in SAP Joule: a custom OData service surfaces supplier invoices whose S/4HANA Flexible Workflow approval is overdue, the agent ranks them by invoice value, aging, payment tenor or a combined score, and a Joule Skill calls the standard SAP AP Invoice OData API to release them, re-prioritizing the remainder after each action. It sets out the detect-prioritize-act loop and the four ranking criteria in enough detail to rebuild the pattern, and leaves authorization, auditability and segregation-of-duty controls to the reader's own design.idc, published 2026-08-11
CAP in the age of AICAP in the age of AISeven live episodes of Hands-on SAP Dev in which DJ Adams works through CAP's AI features with the people who build them, each one a screen-share against a sample project. The first three are @cap-js/mcp: the @mcp annotation on a service, the describe, query and call tools, CQL as the query format, and what authorisation takes out of the tool list. From episode three the run moves to A2A and @cap-js/agents — human approval of an action, agents.md and skills, session persistence, telemetry and sub-agents — and the last two episodes are vector embeddings in CDS, local on SQLite and native on SAP HANA Cloud.published 2026-08-07
CAP in the age of AI #1 - the MCP adapterCAP in the age of AI #1 - the MCP adapterThe episode that opens the series and the first pass over @cap-js/mcp, with four of the people building it on the call. Two of the adapter's tools are worked through: describe, the one an MCP client reaches for first to get the overview of what it may do, and query, which the panel establishes as read-only. It also writes the server entry into a local agent's own configuration file, which episode three comes back to as auto-wiring.published 2026-08-07
Expose S/4HANA Cloud OData API as an MCP Server via CAP Node.jsExpose S/4HANA Cloud OData API as an MCP Server via CAP Node.jsA CAP Node.js service imports the S/4HANA Cloud Outbound Delivery OData v2 API's EDMX metadata with cds import, proxies its reads and a custom createDelivery action against it, and annotates the service @protocol: ['odata-v4', 'mcp'] with @cap-js/mcp's per_action_tool setting on, so the custom action gets its own MCP tool rather than one generic call_action. It tests the result with raw JSON-RPC tools/list and tools/call requests before deploying to SAP BTP, Cloud Foundry Runtime.Jacky Liu, published 2026-07-29
Expose S/4HANA Cloud OData API as an MCP Server via CAP Node.jsExpose S/4HANA Cloud OData API as an MCP Server via CAP Node.jsA step-by-step walkthrough that wraps SAP S/4HANA Cloud's Outbound Delivery OData v2 API in a CAP Node.js service and exposes it through @cap-js/mcp, so an MCP client can list the generated tools, query the delivery entities and call a custom createDelivery action over JSON-RPC. The remote S/4HANA connection is configured two ways in package.json: direct Basic Authentication credentials for local hybrid testing, and a named BTP destination for the app once deployed to Cloud Foundry.Jacky_Liu1, published 2026-07-29
RFC/BAPIs Meet AI Agents: Why SAP Integration Suite MCP Server MattersRFC/BAPIs Meet AI Agents: Why SAP Integration Suite MCP Server MattersExplains that SAP Integration Suite's MCP Server artifact can expose RFC-enabled BAPIs, alongside API artifacts and HTTP endpoints, as MCP tools — letting BAPIs on SAP ECC or on-premise S/4HANA participate in agentic workflows without rewriting business logic or waiting for a full ERP transformation. Frames RFC support as a bridge for organisations still modernising rather than a recommendation to build new RFC-based integrations, and notes the exposed BAPIs inherit the server's existing authentication, rate limiting and IP filtering. A demo built against an SAP ECC backend shows an MCP client discovering and invoking several read-only BAPIs from natural-language prompts, with no custom wrapper code.arunmaarirajha_kv, published 2026-07-28
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Integration Suite: Building an MCP Server for a SAP CI Monitoring AssistantIntegration Suite: Building an MCP Server for a SAP CI Monitoring AssistantA step-by-step walkthrough of building an MCP Server artifact on SAP Integration Suite's Integration Cell runtime that wraps the Cloud Integration OData Message Processing Logs API, so a client such as Claude Desktop or VS Code can query failed interfaces in natural language instead of clicking through Monitor. It covers importing an OpenAPI 3.0 specification so each operationId becomes a discoverable tool, selecting tools/resources/prompts, and wiring two separate OAuth service keys — one read-only credential the HTTPS adapter uses against the monitoring API, another the MCP client uses to reach the deployed endpoint. The server is deliberately read-only and ships with no rate limiting or audit logging, which the author flags as missing before any write operation or production use.Daggolu_PremSai, published 2026-07-17
MCP Server for SAP Incentive ManagementMCP Server for SAP Incentive ManagementA proof of concept putting SAP Incentive Management behind MCP so an agent can reach it, spanning the server, the backing APIs and SAP Advanced Workflow. The post opens with an unusually explicit disclaimer — personal capacity, no organisation's architecture or policies represented, and any real implementation needing customer and SAP review first — which is itself the useful part of reading it: it is a shape to think with, not a design to deploy.published 2026-07-16
Building Durable AI Agents - Announcing the cds-langgraph-persistence PluginBuilding Durable AI Agents - Announcing the cds-langgraph-persistence PluginThe announcement, and the argument behind it. Treating an agent as a software architecture rather than a model with tools makes a list of production requirements — identity, authn and authz, multitenancy, persistence, event-driven flows, scalability, observability, CI/CD — and the author's point is that CAP already answers most of them for BTP, which is what makes LangGraph inside CAP Node.js worth doing. The post then narrows to one of those requirements, durability, and the checkpointer that supplies it. Written from a year of building agents next to real business systems rather than as a framework tour.merbinjanselm, published 2026-07-15
Building Durable AI Agents - Announcing the cds-langgraph-persistence Plugin
@mi8y/cds-langgraph-persistence has been through 3 major lines since this was published: 0.5 (2026-07), 0.6 (2026-07), 0.7 (2026-09). Affects Runnable code.
MCP Servers on SAP Integration Suite : Build Your First MCP Server from an APIMCP Servers on SAP Integration Suite : Build Your First MCP Server from an APIWalks through building an MCP server on SAP Integration Suite from an existing managed API — SAP S/4HANA's Purchase Order API — rather than from an HTTP endpoint or an RFC, which the same creation wizard supports but a later post in the series is left to cover. Selected API operations become MCP Tools with generated input and output schemas, the server inherits its Authentication policy from the source API, and a Process Integration Runtime service instance supplies the OAuth credentials an external client needs to invoke it. Ends by connecting the deployed server to Cline in VS Code and having it chain tool calls to answer a natural-language purchase-order query.published 2026-07-15
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13
UI5 Has Entered the Chat: Building Interactive MCP Apps for SAPUI5 Has Entered the Chat: Building Interactive MCP Apps for SAPMCP Apps let an MCP tool point at a ui:// resource that a compatible host renders in a sandboxed iframe, and the post walks through the five samples of UI5con_2026_MCPApps, built with Mike Zaschka for UI5con, from a plain HTML time tool through UI5 Web Components and UI Integration Cards to UI5 lint findings from @ui5/mcp-server and an ARC-1 transport review. In the samples the model selects the tool and does not generate the interface, the prebuilt kind of generative UI, and the subject is the server side of MCP servers: register the resource, link it from the tool's _meta.ui.resourceUri, return text content as a fallback beside structuredContent, call callServerTool() only for tools of the server that owns the app, and send a message to the host when another server such as ARC-1 has to act. It stops at the host, whose support differs by client and whose iframe sandbox is not a complete security model, and Joule support for MCP Apps could not be verified at the time of writing.published 2026-07-13
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectBuilding MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectArgues that the tool design, not the connection, is the hard part of putting an API in front of an agent. Works one request — create a customer — through eight endpoint-shaped tools, where the agent carries ids between calls and rebuilds the business rules each run, then through a single intent-shaped create_customer that hides the sequence; and says what separates the two: a business operation for a name, parameters a caller can supply without a lookup, the rules in the server rather than the prompt, and a description written for an agent choosing a tool. The SAP Integration Suite half is short — three creation paths, an iFlow behind the API artifact when a tool has to cross systems — and it closes on a checklist to run before publishing.published 2026-07-07
The Easiest Way to Expose a CAP Node.js Project as an MCP ServerThe Easiest Way to Expose a CAP Node.js Project as an MCP ServerFrom cds init to a running MCP server in a handful of steps, ending at the MCP Inspector so the result is something you can see rather than something you have to trust. The claim it makes for the plugin is the absence of work: no REST wiring by hand, the CAP application exposed as a server because the package is installed. A walkthrough rather than an argument — the reasoning about what should be exposed lives elsewhere.Jacky Liu, published 2026-07-03
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
ABAP development tools for Visual Studio Code is now available on the VS Code marketplace!ABAP development tools for Visual Studio Code is now available on the VS Code marketplace!Announces the marketplace release of ABAP development tools for Visual Studio Code, an extension that works against any ABAP system already reachable from ADT for Eclipse and is focused on RAP UI service development, so the Fiori/SAPUI5 frontend and the ABAP backend can be built in the same tool. It ships a built-in ADT MCP Server, disabled by default and switched on from the extension settings, and points readers to a documentation template for capturing ABAP-specific rules in a project's AGENTS.md file for chat agents such as Microsoft Copilot.thomasalexander_ritter, published 2026-06-01
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the LaptopARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the LaptopThe BTP deployment of ARC-1: one Cloud Foundry app per SAP system, reached by MCP clients through XSUAA and reaching the backend through the SAP Destination service, the SAP Connectivity service and Cloud Connector, with a BasicAuth destination for startup probing and a Principal Propagation destination for per-user requests, and SAP_PP_STRICT=true so a propagation problem fails instead of falling back to the shared user. Tool governance is the three gates it spells out, the server ceiling set by environment variables, the user's permission from XSUAA role collections, OIDC scopes or API-key profiles, and the SAP backend authorisation, all of which must allow an action, and the staged rollout from read-only to writes in $TMP, then selected packages, then transport writes. It recommends the MTA deployment over Docker on Cloud Foundry or a buildpack push, treats BTP ABAP Environment as a separate service-key scenario with no Cloud Connector, and is not a full setup guide: the commands are left to the ARC-1 deployment docs.published 2026-04-29
ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the Laptop
arc-1 has been through 3 major lines since this was published: 0.8 (2026-05), 0.9 (2026-05), 1 (2026-07). Affects A recipe.
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Introducing ARC-1: A Secure ADT MCP Server for Enterprise SAP DevelopmentIntroducing ARC-1: A Secure ADT MCP Server for Enterprise SAP DevelopmentWhy ARC-1 exists beside earlier ADT MCP servers such as vibing-steampunk, fr0ster/mcp-abap-adt and dassian-adt: one centrally deployed instance per SAP system instead of a server on each developer laptop, with the MCP client to ARC-1 hop and the ARC-1 to SAP hop authenticated separately. It sets out the restrictive defaults (read-only, no free SQL or named table preview, writes confined to $TMP), the layering in which ARC-1's configuration, the user's role and SAP's own authorisation must all allow an action, Principal Propagation so SAP sees the real user, and audit events to the SAP Audit Log service; that is tool governance as much as agent access to your code. It leaves the BTP setup to the next part, and places ARC-1 beside SAP's ADT MCP Server, which SAP's configuration guide describes as a local HTTP server hosted by the IDE, and beside SAP API Policy 4.2026a, where ARC-1's stated position is to stay close to documented ADT behaviour and ask SAP before production use.published 2026-04-27
ABAP and Agentic AI: The Hidden Problem in Real ProjectsABAP and Agentic AI: The Hidden Problem in Real ProjectsAI in SAP development splits on three questions, how the model gets context, where writing happens and who controls the setup: UI5 and CAP work in local files where git, reviews, tests and pipelines already gate a change, while on-stack ABAP writes land directly in a shared development system. Six patterns follow, framed after a paper by Lars Hvam, from AI in the IDE to off-stack development with abapGit, and the post settles on a hybrid where the agent reads the system over ADT or MCP and writes through a gated git flow. Read access alone is put at maybe 80 percent of the work, and what agent access to your code still lacks is named as tool governance: read-only defaults, package restrictions, blocking free SQL, per-user identity and auditing.published 2026-04-22
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Custom Joule Agent for SAP Ariba SLP - Building an AI Agent for Supplier Registration ApprovalCustom Joule Agent for SAP Ariba SLP - Building an AI Agent for Supplier Registration ApprovalBuilds a Joule Studio agent that reviews SAP Ariba SLP supplier registration tasks: four custom skills bind to Ariba's API (pending tasks, task detail, questionnaire answers, post a decision), each needing a precisely configured BTP destination and action, and the agent's own Expertise, Instructions and Additional Context sections carry the domain knowledge, the step order, and the scoring rubrics that decide approve, deny or deny-with-resubmit. The author contrasts this with an earlier hand-wired flow on SAP Build Process Automation, where every connection, variable and error path had to be designed and wired manually.Giancarlo-Martinez, published 2026-04-07
SAP Agentic AI in Practice: Building the SAP Exception Log Triage Agent (Part 3 of 6)SAP Agentic AI in Practice: Building the SAP Exception Log Triage Agent (Part 3 of 6)Part 3 of a six-part series builds a router agent that classifies incoming SM21 system log errors and SM37 job failures, delegates each to a specialized sub-agent built with LangGraph's create_react_agent, and correlates findings across both logs into a single severity score and escalation list. State moves through a typed dict shared between the router and its sub-agents, with tools that query SAP HANA tables directly; a reactive on-demand mode sits alongside a scheduled monitoring loop that compares error counts to a baseline and escalates automatically past a threshold. The router-plus-sub-agent split carries forward to Part 6, where the same router coordinates the assessment agents built in the series' other parts.DEEPA_DORAIRAJ, published 2026-04-06
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
BTP Cloud Foundry MCP Server: Managing CF Environments with AIBTP Cloud Foundry MCP Server: Managing CF Environments with AIWalks through a server built on odata-mcp-proxy that exposes the Cloud Foundry V3 API's 28 entity sets — apps, orgs, spaces, services, networking, quotas — as MCP tools from a JSON config with no application code. It shows the config shape that bridges the API's snake_case paths to PascalCase tool names via a urlPath field, and the OAuth2 client-credentials destination setup an assistant needs to reach a CF landscape.published 2026-03-13
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
Building an Enterprise-Ready SAP AI Agent with Open SourceBuilding an Enterprise-Ready SAP AI Agent with Open SourceA self-hosted chat agent for SAP systems: LibreChat as UI and orchestrator with Entra ID sign-in and SharePoint connected, a local LLM through Ollama, and two MCP servers, mcp-sap-docs for public documentation and the ADT MCP server vibing-steampunk for the system itself. The ADT server runs in its read-only mode under a technical user with display authorisations only, so the agent can find a function module and pull its source, or locate a RAP business object with its behaviour definition and projection view, but cannot change anything. Two workflows show it, explaining what BAPI_DISPUTE_CREATE does in one system and planning a RAP action from a PDF specification, where the generated ABAP is copied into Eclipse by hand; the full setup is in the marianfoo/llm-client-sap-system-integration-sharepoint repository.published 2026-03-03
UI5 MCP Server Got Extended for UI Integration Cards GenerationUI5 MCP Server Got Extended for UI Integration Cards GenerationVersion 0.2.1 of the UI5 MCP Server adds three tools for UI Integration Cards: get_integration_cards_guidelines feeds an agent current best practices and API versions, create_integration_card scaffolds a new card project, and run_manifest_validation checks the generated manifest against the schema. The post frames these as closing the same gaps as the server's existing tools — an LLM's outdated or wrong card API knowledge — this time for scaffolding and validating a card rather than a full app.daniel_vladinov, published 2026-01-22
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP JOULE & ME : My First JOULE Skill in SAP EHSM-Incident Management Without CodingSAP JOULE & ME : My First JOULE Skill in SAP EHSM-Incident Management Without CodingWalks through building a transactional Joule Skill in Joule Studio, classic edition without writing code: activating an EHS Incident OData service in SAP S/4HANA, wrapping it as an Action Project with chosen input and output fields, then creating, saving and deploying the skill from those fields. Tested against a live system, the deployed skill lets a user create an EHS incident and list reported incidents through Joule's conversational interface or a configured button.Pardhasaradhi_Reddy_Chelikam, published 2026-01-05
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Event Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshEvent Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshA prototype, described as one: a plain CAP application made to react to external events on Kyma, with an agent in the loop and the UI refreshing itself rather than being reloaded. Short — it reports what was built and why, not how to rebuild it.Shahid, published 2025-12-01
How Redwood Software and SAP are shaping the next era of automation with Joule StudioHow Redwood Software and SAP are shaping the next era of automation with Joule StudioRedwood's Field CTO describes a tech preview where an SAP Basis administrator tells SAP Joule in natural language to pause background jobs and dependent Integration Suite iFlows for unplanned system maintenance; Joule acts as a control tower, triggering a pre-approved RunMyJobs workflow and asking for approval before the restart proceeds. The integration is built by publishing RunMyJobs operations to the SAP Business Accelerator Hub, securing access through SAP BTP with API keys and role-based permissions, and combining those actions into a skill inside Joule Studio's low-code design canvas.gmblom, published 2025-11-02
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Identity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesIdentity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesSAP Cloud Identity Services is the central identity interface for single sign-on across an SAP landscape: browser-based applications authenticate through SAML 2.0 or OpenID Connect, while applications reached over RFC rather than HTTP use Secure Login Client and Secure Login Service instead, since those web protocols do not apply there. That RFC path issues short-lived X.509 certificates from SCI-authenticated identities, carrying the same multi-factor authentication into on-premise access, with Kerberos tokens or local client certificates as alternatives.OxanaJ, published 2025-07-25
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
Making the Case for Enhanced REST Adapter in SAP Integration SuiteMaking the Case for Enhanced REST Adapter in SAP Integration SuiteCatalogues what SAP Integration Suite's native HTTP adapter supports for authentication (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handling (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPI import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.peter_ha3, published 2025-07-14
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
CAPM Basics - Part 2CAPM Basics - Part 2Walks through deploying a CAP application to SAP BTP, Cloud Foundry Runtime: provisioning a SAP HANA Cloud instance and HDI container, then running cds add hana and cds add xsuaa --for production, cds build --production, and an MTA build and deploy. Tests the deployed service in Postman with an OAuth 2.0 client credentials token from the XSUAA binding (SAP Authorization and Trust Management service), explicitly leaving out any role templates or scopes.archisman92, published 2025-02-28
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Proof Key for Code Exchange against Identity Authentication, revisited by the author after an earlier post on the same subject — the flow that lets a mobile or single-page client authenticate without a secret it cannot keep. Sample repository under SAP-samples.martinfrick, published 2023-09-21
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Content-based Agents with SAP Joule Studio Agent BuilderContent-based Agents with SAP Joule Studio Agent BuilderJoule Studio, classic edition, the capability in SAP Build the page calls Joule Studio, is where an organisation creates and manages its own Joule skills and Joule agents; its Agent Builder is for a custom agent that handles a multi-step task by combining instructions, model-backed planning and reasoning, and a configured set of tools, Joule skills, document resources, MCP servers, or other agents run as subagents. The page states an agent executes inside the calling user's own security context through SAP Cloud Identity Services, and can be tried against a test conversation before deployment. That is the tool-and-turn-taking ground agent tooling covers, here built through Joule Studio rather than in application code.
Pro-Code AI AgentsPro-Code AI AgentsPro-code agents are the most flexible way the page frames building an agentic workflow on SAP BTP: full autonomy, custom API integrations and algorithms chosen by the developer, set against declarative alternatives such as content-based agents and Joule Scenarios. It names LangGraph as the framework it recommends for production, enterprise-grade agentic workflows, alongside the ReAct pattern as the plan-act-observe loop such an agent runs. That is the ground agent tooling covers, building an agent's own tool-calling loop rather than exposing an application to somebody else's agent.
Generate agentic workflows using SAP-managed n8n in Joule StudioGenerate agentic workflows using SAP-managed n8n in Joule StudioSAP-managed n8n inside Joule Studio generates a workflow from a business intent a developer states, and the workflow is then tested and deployed, consuming line-of-business application APIs, events and agents in SAP Business AI Platform: process automation with the workflow generated from intent, and agent tooling where the workflow calls agents. The generated workflow sends notifications to the Joule Work mobile app of SAP Joule, to Microsoft Teams or to Slack. SAP's abstract names the pieces and not how the generation or the n8n hosting works. A two-hour hands-on TechEd 2026 session (Tuesday 27 October, Berlin), presented by Rama Sulakshani Murari, Rumen Dimitrov, Seshadri Sreenivas Ramanarayanan and Venugopal Chembrakalathil, written here from SAP's abstract; the recording is not yet published.
Connecting AI agents to the ABAP RESTful application programming modelConnecting AI agents to the ABAP RESTful application programming modelJoule Studio, classic edition connects Joule Agents to applications built with the ABAP RESTful application programming model through actions and skills, calling the OData services those applications expose their business objects through: the tools an agent may call, which is the agent tooling concern seen from the ABAP side. The abstract promises alternative integration patterns and does not name them. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Leon Karlau, written here from SAP's abstract; the recording is not yet published.
Building agentic applications with SAP HANA CloudBuilding agentic applications with SAP HANA CloudA CAP application extended with semantic search and agent features on top of SAP HANA Cloud's vector engine and SAP AI Core, built in a hands-on workshop. The abstract names the parts, CAP, the vector engine and AI Core, and the two additions: semantic search, the retrieval half of retrieval-augmented generation, and LLM-supported agent capabilities inside the application, which is agent tooling. Which embedding model, which CAP runtime and how the agent calls its tools are not stated. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Hui Li, Ritty Joseph, Shraddha Shetty and Tanuja Jadhav, written here from SAP's abstract; the recording is not yet published.
Agentic memory: Knowledge graph engine and recall in SAP HANA CloudAgentic memory: Knowledge graph engine and recall in SAP HANA CloudThe knowledge graph engine in SAP HANA Cloud as an agent's memory: what the engine, the graph side of graph, spatial and document data, does in an agentic workflow, how an agent keeps what it learns there, the state agent tooling holds between turns, and the SAP AI Core integration through which the database calls LLMs and tabular foundation models such as SAP-RPT-1. The abstract names the engine, the memory role and the AI Core link and does not say how the memory is written or read. DA263 on Wednesday 28 October is a two-hour hands-on on the same engine with a different cast. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Markus Fath and Shraddha Shetty, written here from SAP's abstract; the recording is not yet published.
Knowledge graph and agent memory: Build an agent that remembersKnowledge graph and agent memory: Build an agent that remembersThe knowledge graph engine in SAP HANA Cloud as an agent's memory: what the engine, the graph side of graph, spatial and document data, does in an agentic workflow, how an agent keeps what it learns there, the state agent tooling holds between turns, and the SAP AI Core integration through which the database calls LLMs and tabular foundation models such as SAP-RPT-1. The abstract names the engine, the memory role and the AI Core link and does not say how the memory is written or read. DA205 on Tuesday 27 October is the 45-minute talk on the same engine, with a near-identical abstract and a different cast. A two-hour hands-on TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christoph Morgen, Jan Zwickel, Markus Fath and Thomas Hammer, written here from SAP's abstract; the recording is not yet published.
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Model Context Protocol (MCP)Model Context Protocol (MCP)Frames the Model Context Protocol as the answer to an M-times-N integration problem: one shared protocol turns M agents and N tools into M plus N connections, and one server can be called by any compliant agent. On SAP BTP its implementation section lists an SAP MCP Hub as a no-code way to expose enterprise tools, SAP Integration Suite's MCP Gateway as what it calls the governed path for exposing SAP and non-SAP APIs as MCP-compliant tools, custom SDK-based servers, SAP's MCP servers for development, and an MCP adapter for CDS as a CAP plugin marked coming soon. That is the ground MCP servers covers; for security it points at a separate page.
Model Context Protocol Adapter — CAP guideModel Context Protocol Adapter — CAP guideDocuments @cap-js/mcp and com.sap.cds:cds-adapter-mcp, service annotations, generated describe/query/call tools and local client setup. The guide records Java doc-comment configuration, unbound-action-based data changes, incomplete XSUAA PKCE support and the adapter’s governance boundaries.
CAP Node.js Expert Session #6 - The MCP AdapterCAP Node.js Expert Session #6 - The MCP AdapterDaniel Schlachter and DJ Adams add @cap-js/mcp to a bookshop service, inspect its describe, query and action tools, and query the catalogue through an AI agent. The session distinguishes this runtime adapter from the development-time MCP server and demonstrates automatic registration of the running service with a local agent. The recording describes the adapter as beta in July 2026, with read-only queries and writes through unbound actions.
Configure an MCP Server Created from an HTTP EndpointConfigure an MCP Server Created from an HTTP EndpointDocuments configuring API Management’s HTTP-source MCP server tools, resources, prompts and policies. Resources are selected from GET operations and have URI templates/content types; prompts define User/Assistant messages with optional arguments, alongside MCP policy configuration.
MCP Server — SAP Integration SuiteMCP Server — SAP Integration SuiteSAP's own page for the MCP Server artifact in SAP Integration Suite, and where the gateway that runs it is described: MCP clients and API clients reach the same backends through two gateways that share security, traffic management and multi-protocol connectivity. Sets out the three primitives a server may expose — tools derived from API operations with an input and output schema, resources addressed by URI for context rather than action, and prompts as reusable interaction patterns. Says availability depends on the Integration Suite service plan, and points at the three creation paths as separate pages.
Examine the details of the Model Context Protocol on startupExamine the details of the Model Context Protocol on startupWhat the MCP adapter actually does when a CAP server boots, watched rather than described — the companion to the tutorial that switches it on.
Agentic CAP: Build MCP servers and enterprise AI agentsAgentic CAP: Build MCP servers and enterprise AI agentsCAP applications become AI agents over the Model Context Protocol and the Agent2Agent protocol, which is the serve your application over MCP concern, and SAP AI Core is the LLM integration through which AI is embedded in a CAP app, with recommendations from the SAP-RPT-1 model as the abstract's example. The abstract names the two protocols and the one model and does not say which packages carry them. A two-hour TechEd 2026 session in a hands-on room (Tuesday 27 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Sami Lechner, written here from SAP's abstract; the recording is not yet published.
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Agentic AI Security & GovernanceAgentic AI Security & GovernanceNames seven threat categories agentic AI introduces beyond ordinary application security: prompt injection, excessive agency, supply-chain and model-integrity compromise, memory poisoning, improper output handling, resource abuse and agent-to-agent communication poisoning. Its answer is a defence-in-depth structure of security controls, input validation, privilege management, supply-chain checks, memory segmentation, output validation, execution quotas, secure communication, paired with governance and oversight: audit logging, explainability, human-in-the-loop review, fairness assessment and continuous monitoring. States the reason plainly: an agent decides, chains actions across turns, keeps memory between them and can act on real systems, a different risk profile from a single request-response call. That is the authorisation and audit-trail question tool governance is named for.
OData entity as a governed query surface for agents, not a toolOData entity as a governed query surface for agents, not a toolAn OData entity, generated from the annotations a service already carries, as the surface an agent queries over SAP data: filterable, selectable and sortable fields, authorisation injected on the server side, and a bound query cost, instead of the entity as a tool. SAP's abstract sets this against the MCP gateway in SAP Integration Suite, where exposing an API is the easy part and getting an agent to pick the right one is not, which is the tool governance concern read through OData. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Aleksandr Ivanov and Evgenii Shirokikh, written here from SAP's abstract; the recording is not yet published.
Govern AI-supported actions across enterprise systemsGovern AI-supported actions across enterprise systemsGoverning what an AI agent may do once it takes business actions across enterprise systems, which is the Tool governance concern, with SAP Integration Suite as the place it is enforced. The abstract lists the mechanisms, scoped APIs, event-driven workflows, runtime policy enforcement, exception handling and observability across SAP and third-party systems, and names no Integration Suite feature behind any of them. A TechEd 2026 session (Tuesday 27 October, Berlin; also IN200V, virtual), presented by Finny Babu and Piyush Gakhar, written here from SAP's abstract; the recording is not yet published.
Model context protocol (MCP) unlocked: Enable governed access to AI agentsModel context protocol (MCP) unlocked: Enable governed access to AI agentsThe MCP Gateway in SAP Integration Suite: the place policy, security and analytics are applied to a curated set of MCP tools before an AI agent reaches enterprise tools and APIs through it, tool governance done in the integration layer and agent access to your systems routed through one gateway. The abstract names the gateway and its three functions and does not say how tools are curated, which policies exist or how the agent authenticates. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Bruno Renzo, Emily Mui, Markus Winter and Sunny Kapoor, written here from SAP's abstract; the recording is not yet published.
Intelligent, governed, and agentic integrations with SAP Integration SuiteIntelligent, governed, and agentic integrations with SAP Integration SuiteSAP Integration Suite positioned as the control plane that connects and governs agentic workflows across SAP and third-party systems, set against the abstract's claim that exposing back ends directly to AI brings security, compliance and cost risks. That governing role is the Tool governance concern; the abstract promises recent innovations and names none. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Finny Babu and Piyush Gakhar, written here from SAP's abstract; the recording is not yet published.
Building trusted applications on SAP Business AI Platform by designBuilding trusted applications on SAP Business AI Platform by designBuilding cloud applications on SAP Business AI Platform with security and compliance built in: the identity, connectivity, governance and security services SAP groups under the platform, secure-by-design development, and authorisation and access controls for AI agents. The edges are to Authorization and to Tool governance, the concern of what an agent may call with which authorisations; the abstract names the service categories and no service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christian Cohrs and Regine Schimmer, written here from SAP's abstract; the recording is not yet published.
Use mocking to embrace auth in your domain model from the outsetUse mocking to embrace auth in your domain model from the outsetMock users locally so authorization is modelled from the first commit instead of retrofitted — the argument being that auth added late reshapes a domain model rather than sitting on top of it.SAP
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
SAP Document AISAP Document AISAP's reference architecture for SAP Document AI, first as SAP composes the service on BTP for document extraction: OCR, pretrained models, customer-defined schemas and LLM calls through SAP AI Core and its Prompt Registry in one pipeline, with tenant-isolated persistence in SAP HANA Cloud, PostgreSQL and an object store. Its scenario pages then lay out a solution in three layers: intake through Outlook and SharePoint inbound channels, the workspace UI, the Joule Work mobile app or the upload API; classification and extraction with a confidence score per field, automatic confirmation above a threshold and review of the rest in the workspace; and posting through outbound channels, directly to a REST API, through an SAP Integration Suite flow, or through a CAP service that maps the fields and calls SAP S/4HANA over OData. Enrichment beyond the service's own master data lookup is left to a CAP application or an Integration Suite flow triggered from an outbound channel, and direct API posting leaves error handling, retries and monitoring to the application.published 2026-06-03
Establish a central entry point with SAP Build Work ZoneEstablish a central entry point with SAP Build Work ZoneSAP's reference architecture for a business site in SAP Build Work Zone, standard edition or SAP Build Work Zone, advanced edition as one entry point to business applications, processes, information and communication, on the web or in the Joule Work mobile app. Three of its eight flow steps are how content gets in, the ground launchpad and site content covers: custom apps through the channel to the subaccount's SAP HTML5 Application Repository service for SAP BTP, other content through content providers that expose it over APIs from cloud or on-premise systems and content packages uploaded as files, and SAP Cloud Transport Management or manual export and import to move it between environments. Users and role assignments come from Cloud Identity Services, and the components inside the subscription, among them Notifications, SAP Mobile Services and UI Theme Designer, cannot be decoupled from the product, so a custom mobile app needs its own SAP Mobile Services subscription.published 2026-05-22
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Designing Event-Driven ApplicationsDesigning Event-Driven ApplicationsSAP's guidance for building applications on event-driven architecture with BTP services. It sets out a two-part strategy: SAP Cloud Application Event Hub for events between SAP cloud applications and BTP, and the SAP Integration Suite family for dedicated event brokers in hybrid landscapes. Its sub-pages then cover EDA patterns, design considerations and AWS and Azure IoT integration. The framing is integration between systems; the in-process outbox and queueing inside one CAP service are not its subject.published 2025-10-10
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
Transitioning Architectures from SAP NetWeaverTransitioning Architectures from SAP NetWeaverA community contribution from Glencore, an SAP customer, on what replaces NetWeaver-based products as their standard maintenance ends in 2027: the scenarios where NetWeaver-era solutions fall short — integration with cloud-based landscapes, extensibility — and the successor options per use case, pointing at SAP's product availability matrix and note 1648480 for the official successors. Customer-authored, so the framing is a migration decision rather than a product description.published 2025-08-02
DevOps with SAP BTPDevOps with SAP BTPHow SAP frames a delivery pipeline for applications on BTP Cloud Foundry: continuous integration through the SAP Continuous Integration and Delivery service and its pipeline templates for CAP and Fiori, transport and change management across environments, and a section on reasonable alternatives for teams with existing CI infrastructure. Culture first, tools second, and explicit that the setup differs on other BTP environments.published 2025-06-06
Integrate and Extend with SAP Build Process AutomationIntegrate and Extend with SAP Build Process AutomationSAP's reference architecture for SAP Build Process Automation integrating and extending SAP and non-SAP solutions in cloud and hybrid landscapes, the ground process automation covers. Processes start from events, APIs, schedules or forms, the forms built in SAP Build Process Automation, as UI5 applications or in SAP Build Apps; they reach other systems through the SAP Connectivity service with actions over APIs from sources that include CAP and RAP OData destinations and SAP Business Accelerator Hub specifications, and users reach them through SAP Build Work Zone and SAP Mobile Start, with SAP Task Center as the place tasks are managed. Decisions, Process Visibility, Processes and Automations come inside the one subscription and cannot be decoupled from it; CAP appears only as a source of API actions, and the examples are business scenarios such as mass job requisitions in SAP SuccessFactors.published 2025-05-14
Edge Integration Cell on HyperscalersEdge Integration Cell on HyperscalersSAP's architecture for Edge Integration Cell, the runtime of SAP Integration Suite that executes integration flows in a Kubernetes cluster the customer runs, while design, monitoring and governance stay on SAP BTP and the runtime reaches BTP over outbound-only channels. The main page gives the reasons SAP names for it: data residency, security policies that forbid inbound access, and latency to a distant BTP region. Three sub-pages draw the same setup on AWS, Azure and Google Cloud, each with a private network across three availability zones, a managed Kubernetes cluster, managed PostgreSQL and Redis, sizing left to an SAP Note, and each says it outlines a small production deployment to be treated as a starting point.published 2025-04-18
Medallion Reference Architecture for Big Data Processing in SAP HANA CloudMedallion Reference Architecture for Big Data Processing in SAP HANA CloudSAP's medallion layout for SAP HANA Cloud: structured, semi-structured and unstructured data lands raw in HANA Cloud, data lake files as the bronze layer, is cleansed into a common structure in silver, held in data lake files or the HANA database, and is curated and read-optimised in gold, from where it can also be exposed as a Delta Share. The staged path from raw to consumable is the ground loading a warehouse covers, with Spark jobs and SAP Datasphere data flows named as ways to move data between layers and SAP Analytics Cloud among the consumers of gold. It leaves the ingestion method open, to be chosen by source, freshness and performance, and names no pipeline or schedule beyond that.published 2025-04-03
SAP HANA Cloud as an Esri GeodatabaseSAP HANA Cloud as an Esri GeodatabaseSAP's design for running an Esri ArcGIS Enterprise geodatabase inside SAP HANA Cloud, so that geometries and SAP business data sit in one database and are joined in a HANA calculation view, which is the spatial part of graph, spatial and document data. It traces three personas: an analyst in ArcGIS Pro building query layers over that view, a developer whose CAP application models spatial types such as ST_Point in CDS, and an analyst using a Fiori app on top of such an application. The deployment advice stops at placement: ArcGIS Server and HANA Cloud go in the same region and availability zone, because Esri's certified architectures allow under 5 milliseconds of network latency between them.published 2025-03-25
Architecting Multi-Region HA/DR resiliency patternsArchitecting Multi-Region HA/DR resiliency patternsPatterns for running BTP applications across regions when the default multi-availability-zone resilience is not enough: DNS-based load balancing across regional endpoints with Azure Traffic Manager, Route 53 or Cloud DNS, replication of data and configuration between regions, and the fundamentals of single-region versus multi-region resiliency in its sub-pages. BTP services are multi-AZ by default; a multi-region setup is something the customer architects, and this is SAP's description of how.published 2025-02-19
Establish a central inbox with SAP Task CenterEstablish a central inbox with SAP Task CenterSAP's reference architecture for SAP Task Center as one inbox for the tasks of several SAP applications, opened in the Task Center web app or as To-Dos in SAP Start and SAP Mobile Start, which is the inbox half of task and approval UIs. It rests on Cloud Identity Services: every task provider must work with Identity Authentication, its users must carry the Global User ID and so must the recipients of each task, and sign-on between the provider and Identity Authentication is what lets a user navigate from Task Center into the provider. Task Center reaches providers through destinations in a customer subaccount, with Cloud Connector for on-premise SAP S/4HANA.published 2025-02-11
Multitenant SaaS Application using CAPMultitenant SaaS Application using CAPSAP's reference architecture for a multitenant SaaS application on BTP built with CAP: one deployment serving many tenants with logically separated data, the subscription and onboarding flow, and the BTP services the design leans on. Written for partners and line-of-business teams building on BTP, and it is SAP's own side of the shape multitenancy takes on BTP.published 2025-01-31
Federated Machine Learning with SAP DatasphereFederated Machine Learning with SAP DatasphereSAP's design for training predictive models on an external machine learning platform against SAP Datasphere data that is not replicated to that platform. The open-source FedML Python library runs in the platform's notebook, connects to Datasphere over Python/SQLDBC and reads the analytic models in which Datasphere unifies SAP and non-SAP sources; a trained model can then be deployed to SAP AI Core, or in several sub-pages to SAP BTP, Kyma runtime, which is the predictive models path where training happens outside SAP. Sub-pages cover Amazon SageMaker, Azure Machine Learning, Google Vertex AI, Databricks, NVIDIA RAPIDS on GPUs and IBM watsonx.published 2025-01-23
API Managed IntegrationAPI Managed IntegrationSAP's reference architecture for API-managed integration, which puts the API Management capability of SAP Integration Suite in front of business applications as API proxies that intercept each call to apply security policies, transformations and governance and to collect usage metrics. SAP defines it as a pattern that complements the other integration patterns, and draws three routes behind the proxy: a managed API forwarded to its provider for simple transformations and protocol adaptations, the Graph capability exposing data from several sources as one connected API, and Cloud Integration for mediation beyond API Management's scope, with the edge integration cell runtime for managing APIs in a customer-managed Kubernetes environment. SAP states that it delivers no predefined scenarios for this pattern, so the proxies and policies are the customer's or partner's to build.published 2024-08-01
Application to Application IntegrationApplication to Application IntegrationSAP's reference architecture for application-to-application integration, where messages carrying transactional data such as sales orders pass between business applications in near real time and each one triggers the next process step. When the sender's and receiver's APIs do not match, Cloud Integration in SAP Integration Suite sits between them to determine receivers, filter, map structures and convert protocols, which is the ground of integration flows; SAP Connectivity service, Cloud Connector and SAP Destination service reach on-premise receivers, and the edge integration cell runtime keeps processing inside a customer-managed landscape where compliance requires it. Direct exchange without middleware is allowed when the two APIs already align, asynchronous communication is the default the page states, and it is drawn at the level of the pattern, following SAP's Integration Solution Advisory Methodology, without designing any one flow.published 2024-08-01
Business to Business IntegrationBusiness to Business IntegrationSAP's reference architecture for business-to-business integration, the exchange of business documents with customers, suppliers and other trading partners over agreed standards such as EDIFACT, ANSI X.12 and IDoc and protocols such as AS2. Its design-time steps are Cloud Integration in SAP Integration Suite, the predefined content of SAP Business Accelerator Hub, and Integration Advisor, which defines message implementation and mapping guidelines and generates runtime artifacts from them; Trading Partner Management then turns partner profiles into agreements pushed to the Partner Directory, and generic integration flows on Cloud Integration read those agreements at runtime to exchange messages with each partner. The alternatives it names are API-based exchange where an industry has standardised its APIs, and SAP Business Network with the managed gateway for spend management in place of connecting partners one by one.published 2024-08-01
Connect Business Processes with SAP Master Data IntegrationConnect Business Processes with SAP Master Data IntegrationSAP's reference architecture for keeping master data such as materials, business partners and cost centres consistent across applications with SAP Master Data Integration, a central hub that stores every change in an event log and distributes it to the solutions that consume it. Cloud Integration in SAP Integration Suite carries what the hub does not reach, SAP solutions it does not yet support and third-party or on-premise systems, through an SAP Master Data Integration adapter, which is where the design meets integration flows; newer SAP S/4HANA releases connect to the hub without it. Consolidation, data quality and central governance are outside the architecture and left to SAP Master Data Governance, and SAP Master Data Integration itself has no entry in the atlas yet.published 2024-08-01
Details
Graph
Agent toolingcapability, core and community
Serve your application over MCPcapability, core and community
Tool governancecapability, core and community
Authenticationcapability, core and community
SAP Architecture Centerpublishing source
Source
Type
reference-architecture
Published on
Host
architecture.learning.sap.com
Signals as of
Discovered via
First seen
History
- parts → 21 parts, 26 edges, 4 areasFilled from SAP's own readmes at the maintainer's request; the AI-native door reads these designs. Every part names what the graph holds; what it lacks is listed as candidates in the curation note.
- explains → agent-tooling, mcp-servers, tool-governance, authenticationThe agent identity page describes SAP Cloud Identity Services as the identity hub for human and agent identities, with authentication, provisioning and authorization for agents as a class of actors, which is this concern for agents.
- Entered the atlasDiscovered via SAP Architecture Center.
For your agent
- Ref
content:ac-agentic-ai-and-ai-agents- JSON
- /content/ac-agentic-ai-and-ai-agents.json
- MCP
- Connecting an agent