Everything in the atlas

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas applies that prohibition to CAP wrappers around those APIs. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement. In beta, with nine releases in the six weeks after the first, so pin it.

If document versions are required, [@cap-js/sdm](artifact:cap-js-sdm) excludes versioned repositories in its [documented restrictions](https://raw.githubusercontent.com/cap-js/sdm/ad13b61f21816ebead2d08264a74521cfb75846c/README.md).

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

No published releases; repository quiet for 52 months.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The README is one line and the package carries no licence field. Last released July 2023. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Release and repository quiet for 39 months.

The generated files are copied or deployed into the ABAP system by hand, the fourth step of its own usage list, so nothing keeps an activated service in step with the model it was generated from. Its peer dependency is `@sap/cds` ^9.8, so it does not install into a project on an earlier CAP release.

Not in a project on CAP 7 or earlier: the package declares `@sap/cds` >=8 and `@sap/cds-compiler` >=5 as peer dependencies.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

The declared repository is archived.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

On an [SAP BTP ABAP environment](artifact:btp-abap-environment) system only the generated code is left: DDIC creation is not supported on ABAP Cloud, because classic DDIC object creation over REST is not available there. Create DDIC is also disabled where ADT is not installed in the same Eclipse, and Insert into Editor then works with any editor implementing `ITextEditor` instead of the ABAP one.

Nothing to choose here and nothing to install: it is what an ABAP Cloud system gives you. It shares a name and a lineage with CAP's CDS but is a different language in a different runtime, and a model does not move between them.

No published releases; repository quiet for 49 months.

No published releases; repository quiet for 49 months.

No published releases; repository quiet for 32 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 54 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 43 months.

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

Server side only, and deliberately: the author states there is no realistic way to support the SSE streaming a client needs, so there are no notifications, no `listChanged`, no `subscribe` and no logging. It is also frozen — protocol versions up to 2025-11-25 and no further, with everything after that in a separate V2 SDK, so starting here today is starting on a closed branch.

Stateless by design: with no `Mcp-Session-Id` and no SSE, notifications of any kind, `resources/subscribe` and stream-close cancellation are excluded, which the author states are protocol-level impossibilities on stateless ICF rather than gaps to be filled later within this design. ABAP Cloud is not supported and not planned, the stated reason being SAP pushing its own MCP strategy and features in BTP; the first iteration targets 7.5x classic, with 7.02 to 7.4x served from a separate generated downport repository. No authorization object and no default auth check are delivered, so a user who may call the ICF node may call every `AREA`/`SERVER` registered under it until `check_authorization` is redefined.

No published releases; repository quiet for 26 months.

Not a way to run existing reports unchanged: a report is rewritten as a class, and `CALL SCREEN`, dynpro modules, batch input, `SUBMIT` and native SQL are refused by the converter rather than mapped. Not an SAP GUI in the browser either: the programming model is classic and the screens are UI5, and the README points at abap2UI5-addons/sapgui for SE16N or SM37. Output has gaps the README names — ALV cells show dates and times as the model carries them rather than in the user's format, print is a text file because ABAP Cloud has no spool, and value tables for F4 are read on premise only.

Only on SAP S/4HANA 2023 and 2025, on premise or private cloud: [SAP S/4HANA Cloud, Public Edition](external:sap-s4hana-cloud-public-edition) and the [SAP BTP ABAP environment](artifact:btp-abap-environment) are listed as coming soon, and a 2023 system has to leave out `ZABAP_PRC_EVENTS_SE_2025`, whose event-based side effects rely on APIs released with S/4HANA 2025. Not for a system that already carries a copy, because object names are global and two versions cannot live side by side, and not for a productive system by way of the `ZABAP_PRC_DEMO*` packages, which the README states are not intended for one and whose init classes delete and rebuild their own tables on every run. While the major version is 0 the public API is not stable: minor bumps carry breaking changes with no deprecation period, so productive use means pinning a tag and reading the CHANGELOG before every upgrade.

No published releases; repository quiet for 91 months.

No published releases; repository quiet for 47 months.

No published releases; repository quiet for 97 months.

No published releases; repository quiet for 81 months.

The frontend is optional: where abap2UI5 apps are reached through the framework's own HTTP service, nothing from here is installed. In S/4 Public Cloud that endpoint needs `S_DEVELOP` authorisation, which the installation guide states makes it unfit for production, and the separate frontend app with an extra tile is what it names for business users. The `cloud_new` and `standard_new` branches need an abap2UI5 newer than 1.146.0 on the system.

Not for views built from controls outside the portable profile: sap.ui.table, sap.f, sap.uxap, sap.ui.comp and z2ui5.cc custom controls render as a visible unsupported-control box and are listed in the diagnostics, and `CONTROL_BY_ID` and `BINDING_CALL` stay unsupported. Nine frontend actions the profile allows, `DOWNLOAD_B64_FILE` and `SYSTEM_LOGOUT` among them, are skipped and reported rather than run, and formatters other than the profile's `Formatter.Date*` render a placeholder.

The class has to be moved by hand: an abapGit pull of the exported ZIP, or a paste into ADT or SE24. The palette is held to the 121 controls of UI5 1.71, and a control inserted by its class name instead comes from whatever UI5 the canvas has loaded, with nothing checking it against 1.71 - *Checks* reports that. An app class that builds no view, or more than one, is refused.

Neither suite has been run against an ABAP system: the reference backends are the framework transpiled to Node and cap2UI5 on CAP, so what a check does on a real system is open. The portable profile is a subset of 61 controls, filled from a census of 247 core apps of which 64.8 % run unchanged, so an app outside it renders placeholders in the terminal and Adaptive Cards renderers.

The value-help and search-help popups read whichever DDIC check table the user selects without an authorisation check of their own, so the README asks for your own checks and a restriction on which tables may be browsed before they are used beyond a development system. The transport-request popup works only on-premise, and the search help does not yet run on the Cloud stack.

Not an end-user app: it reads from any table the user names and writes into tables of the Z/Y namespace, with no authorisation check of its own, so the README asks a project to add its own checks on `S_TABU_DIS`/`S_TABU_NAM` and to restrict who may run it before it is used beyond a development system. XLSX upload and download are not ready for ABAP Cloud yet, and of the upload apps only the JSON one writes the file's rows back to the database.

Not where the framework code itself has to change: `input/` and the three installable branches are overwritten by the workflows on every upstream push, and a framework change is a pull request to abap2UI5. Bug reports and feature requests also go to the abap2UI5 repository rather than this one.

Not the place to learn abap2UI5 itself: every package starts from a technology the system already provides, and the framework basics and the control gallery are the other two sample repositories, abap2UI5/samples and abap2UI5/samples-controls. Three packages are out of reach on ABAP Cloud, and `05` needs the 2021 release that carries RAP business events.

No published releases; repository quiet for 95 months.

Neither the package manifest nor the repository tree declares a licence.

No published releases; repository quiet for 26 months.

The declared repository is archived.

Neither the package manifest nor the repository tree declares a licence.