Everything in the atlas

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

On an [SAP BTP ABAP environment](artifact:btp-abap-environment) system only the generated code is left: DDIC creation is not supported on ABAP Cloud, because classic DDIC object creation over REST is not available there. Create DDIC is also disabled where ADT is not installed in the same Eclipse, and Insert into Editor then works with any editor implementing `ITextEditor` instead of the ABAP one.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas separately excludes CAP wrappers around those APIs from its assessed scope. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement.

Not reachable Not reachable since 2026-10-20.

Functional boundary What it exposes is whatever somebody put in the configuration table, which moves the governance question inside the SAP system and out of the server — an advantage if that table is controlled and a hazard if it is not. The web management interface is a second surface to secure alongside the MCP one.

Written for Amazon Q Developer and Kiro, and the central deployment path is ECS Fargate — the further you are from AWS, the more of it is scaffolding you do not need. Python rather than the Node most of this group uses. Its README says the repository is no longer maintained and that the latest version of ABAP Accelerator is shared after registering with AWS for [Modernization Agents for SAP on AWS](https://github.com/aws-for-sap/Modernization-Agents-for-SAP-on-AWS).

Neither the package manifest nor the repository tree declares a licence.

In the Eclipse mode the server lives in a developer's IDE, binds to 127.0.0.1 and answers any request carrying an `Origin` header with HTTP 403, so a pipeline or a remote agent has nothing to reach; the standalone mode on the runtime of the ADT for VS Code extension is the documented route with no IDE open. A new connection starts in write mode, so the 11 write tools are live against a connected system until someone presses Toggle Read-Only. The dropins route for the two bundles is documented as untested.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

Reach is the reason to use it and the reason to be careful: reading cluster tables and spool output goes well past what a development tool is normally pointed at. Decide what an agent may reach before granting it, not after.

Universal mode trades discoverability for size: one generic tool is harder for a model to pick correctly than a named one, which is why it is not the default. On a small service, standard mode is the better answer.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

On ECC the S/4HANA `API_*` services that the three convenience readers default to do not exist, so each one has to be pointed at a Z service of your own or replaced by the RFC tools. `read_table` inherits `RFC_READ_TABLE`'s 512-byte row, so a wide table needs an explicit field list and some fields cannot be selected at all, and the bridge starts a Node process and a fresh logon per call, with no pooling. The audit log is one line per call that includes the call arguments, so every filter and WHERE clause sent to SAP is written to a file that then has to be handled as sensitive.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.