Everything in the atlas
Type
Domain: 3
Origin
Signals
Content
More
Group by: Kind
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
Six CAP features in one package, from replication cache to rate limits
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
Exposes a CAP service as OData V2
WebSocket and Socket.IO adapter for CDS services
Exports AsyncAPI documents for a CAP service's events
CAP integration with the SAP Audit Log service
Change history for annotated CAP entities
CAP integration with SAP Data Privacy Integration
GraphQL protocol adapter generated from the CDS model
Exposes CAP services as MCP servers for AI agents
SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas applies that prohibition to CAP wrappers around those APIs. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement. In beta, with nine releases in the six weeks after the first, so pin it.
MCP server for CAP development: model and docs search
The tools are documented as meant for AI models and not a stable API, so anything built to parse `cds-mcp` output rather than to feed a model can break between releases. Its corpus is the CAP documentation, so Fiori elements, BTP service or ABAP questions are not in what `search_docs` indexes.
Generates OpenAPI documents from a CDS service
Generates Open Resource Discovery documents from a CAP model
Generates an MCP server from annotated CDS entities and actions
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
MCP server inside a CAP application with model and query tools
CAP plugin letting the REST adapter accept XML payloads
CAP plugin serving the Cardano blockchain as OData V4
MCP server exposing the ODATANO Cardano-to-OData bridge as tools
The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
CAP plugin indexing the Midnight blockchain, exposed as OData V4
MCP server exposing the NIGHTGATE Midnight attestation layer
Compiler from a CDS service to SEGW model and data provider classes
The generated files are copied or deployed into the ABAP system by hand, the fourth step of its own usage list, so nothing keeps an activated service in step with the model it was generated from. Its peer dependency is `@sap/cds` ^9.8, so it does not install into a project on an earlier CAP release.
Fiori documentation indexed as embeddings
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
Compiler from AMS DCL policies to DCN for local runs and tests
Its own account of itself is local running and tests: the DCN it writes serves as input for running an application using AMS on the DCL bundle locally. It carries the SAP Developer License Agreement rather than an open-source licence, and the repository named in its package metadata is an internal SAP host, so the npm page is the only thing to read.
SAP's Node.js application router in front of business applications
CAP Node.js runtime
CDS plugin adding embedded analytics to CAP for SAP Analytics Cloud
Not in a project on CAP 7 or earlier: the package declares `@sap/cds` >=8 and `@sap/cds-compiler` >=5 as peer dependencies.
Token validation and security context for XSUAA and IAS
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
MCP server answering plain-English questions against a CDS schema
MCP server answering questions on UI5 Web Components
It answers from documentation and never opens your project, so it cannot tell you whether the component you are asking about is the one your application already uses. Node.js v20.17 or v22.9 and above; on Windows the command needs a `cmd /c` prefix.
Eclipse plug-in turning JSON or XML into ABAP types and DDIC objects
On an [SAP BTP ABAP environment](artifact:btp-abap-environment) system only the generated code is left: DDIC creation is not supported on ABAP Cloud, because classic DDIC object creation over REST is not available there. Create DDIC is also disabled where ADT is not installed in the same Eclipse, and Insert into Editor then works with any editor implementing `ITextEditor` instead of the ABAP one.
Configurable CSV reader and writer for ABAP
JSON renderer and parser for ABAP with camelCase conversion
JSON encoder and decoder for ABAP, modelled on Go's encoding/json
No published releases; repository quiet for 49 months.
Swagger UI for SAP NetWeaver Gateway services
No published releases; repository quiet for 49 months.
ABAP classes for calling Azure services from SAP processes
Open-source Z* version of /UI2/CL_JSON for ABAP to JSON
TypeScript library reaching ABAP service instances on Cloud Foundry
Generates signed JSON Web Tokens in ABAP
No published releases; repository quiet for 68 months.
ABAP-native MCP endpoint that drives opted-in abap2UI5 apps
Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.
MCP server SDK written in ABAP
Server side only, and deliberately: the author states there is no realistic way to support the SSE streaming a client needs, so there are no notifications, no `listChanged`, no `subscribe` and no logging. It is also frozen — protocol versions up to 2025-11-25 and no further, with everything after that in a separate V2 SDK, so starting here today is starting on a closed branch.
Stateless ABAP MCP server SDK for the 2026-07-28 protocol draft
Stateless by design: with no `Mcp-Session-Id` and no SSE, notifications of any kind, `resources/subscribe` and stream-close cancellation are excluded, which the author states are protocol-level impossibilities on stateless ICF rather than gaps to be filled later within this design. ABAP Cloud is not supported and not planned, the stated reason being SAP pushing its own MCP strategy and features in BTP; the first iteration targets 7.5x classic, with 7.02 to 7.4x served from a separate generated downport repository. No authorization object and no default auth check are delivered, so a user who may call the ICF node may call every `AREA`/`SERVER` registered under it until `check_authorization` is redefined.
No published releases; repository quiet for 58 months.
Validation library for ABAP checking dates, emails and GUIDs
No published releases; repository quiet for 40 months.
Node.js command writing PDF documentation for an ABAP package
Not reachable since 2026-10-20.
Generates ABAP client classes and server stubs from OpenAPI
Framework for multi-step ABAP processes with monitoring
Only on SAP S/4HANA 2023 and 2025, on premise or private cloud: [SAP S/4HANA Cloud, Public Edition](external:sap-s4hana-cloud-public-edition) and the [SAP BTP ABAP environment](artifact:btp-abap-environment) are listed as coming soon, and a 2023 system has to leave out `ZABAP_PRC_EVENTS_SE_2025`, whose event-based side effects rely on APIs released with S/4HANA 2025. Not for a system that already carries a copy, because object names are global and two versions cannot live side by side, and not for a productive system by way of the `ZABAP_PRC_DEMO*` packages, which the README states are not intended for one and whose init classes delete and rebuild their own tables on every run. While the major version is 0 the public API is not stable: minor bumps carry breaking changes with no deprecation period, so productive use means pinning a tag and reading the CHANGELOG before every upgrade.
Protocol Buffers (proto2) implementation in ABAP
Checks passwords against Have I Been Pwned from ABAP
ABAP report that runs Salesforce SOQL queries and exports results
No published releases; repository quiet for 91 months.
Exposes ABAP class methods as REST services with Swagger UI
No published releases; repository quiet for 47 months.
ABAP API for Google Apps, with upload to Google Docs
No published releases; repository quiet for 97 months.
ABAP framework wrapping the Google Sheets API for SAP S/4HANA
No published releases; repository quiet for 81 months.
ABAP API for OAuth 2.0 authentication
No published releases; repository quiet for 97 months.
In-browser ABAP editor beside the abap2UI5 app it builds
A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.
129 abap2UI5 sample apps, one ABAP class each
A sample that needs something the system provides is not here — the samples-stack repository holds the OData, RAP, WebSocket and launchpad demos, and samples-controls the rebuilds of the UI5 Demo Kit originals. Every class in `src/` keeps to controls and properties available since UI5 1.71 and not deprecated, apart from two clipboard samples marked `(UI5 1.119+)`, so a newer control is not demonstrated here. Numbers are handed out per repository and reused across the three, so `493` alone does not name a sample: `Z2UI5_CL_SMP_APP_493` is the Hello World here.
Eleven abap2UI5 apps, one per open-source ABAP library
Not on ABAP Cloud: most of the libraries use APIs that are not released there, and the repository has no ABAP Cloud gate yet. Not beyond a development system without authorisation checks added first — the samples carry none of their own, the abap-fm-logger sample reads the log table `ZAFL_LOG` with whatever the logged calls received and returned, and the abap_fm_json sample calls function modules, limited to a hard-coded whitelist.
UI5 Demo Kit samples rebuilt as abap2UI5 apps
The 221 ports under `src/02` need a UI5 runtime newer than 1.71: they install and activate on any release, and on an older UI5 the newer control does not render. The `src/03` collection is hand-written for SAPUI5-only controls and needs a SAPUI5 bootstrap. There are no per-library branches, so pulling the whole repository is the one way in and the activation takes a few minutes.
No published releases; repository quiet for 31 months.
Checks field values against domain fixed values and check tables
No published releases; repository quiet for 54 months.
ABAP client for Firebase's Realtime Database REST API
No published releases; repository quiet for 95 months.
Fetch API-style HTTP polyfill for cloud and classic ABAP
Neither the package manifest nor the repository tree declares a licence.
Cloud-compatible plugin for the abapify Fetch API polyfill
No published releases; repository quiet for 26 months.
Legacy-release Fetch API implementation for outbound HTTP in ABAP
HTTP NTLM client for ABAP
OA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAP
No published releases; repository quiet for 27 months.
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
Class-based wrapper around STRUST certificate management
JSON parser and serialiser for ABAP with a node tree
API proxies with security and traffic policies and Developer Hub
Tracks vulnerabilities in open-source components of BTP apps
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
Web service client and connector layer for calling out of ABAP
Quiet No published releases; repository quiet for 28 months.
Functional boundary The maintainer records SSL as a known issue: an SAP Basis problem in older systems that depends on the remote certificate, so a system that cannot carry the remote certificate chain will not complete the call. It is published as free to use at your own risk, with no support statement behind it.
MCP server for SAP BTP and Cloud Foundry acting as the logged-in user
MCP server generated from a CDS model, forked from @gavdi/cap-mcp
Not published to npm. Install from source.
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
npx tool adding worked example files to a CAP project
Last released April 2024.
Custom messages and handler classes for CAP input validation
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
JWT authentication for CAP without xsuaa or xssec
Last released April 2022 at 0.0.2, and no repository is declared on the package.
Maps Microsoft Entra ID groups and app roles onto cds.User roles
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
Captures CAP service errors, deduplicates them and mails alerts
Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.
cds add plugin adding the incidents-app model to a project
Rate-limit pattern for CAP Node.js applications
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Swagger UI for a CAP service's OpenAPI definition
Zod schemas as CAP validation middleware
CDS plugin for OData change tracking in CAP applications
Open, versioned style guide for ABAP
Hosted workspace redrawing custom ABAP as BPMN and grading it
Not reachable Not reachable since 2026-10-20.
Functional boundary The Level A–D grade merges SAP's two published files in the tool's own engine: it is an orientation rather than an ATC result and is left out of the signed audit pack, and the repository documents state by state where the grade is expected to differ from what the clean core ATC check reports. Nothing here runs ABAP Unit — on the RAP track that result is recorded from your own SAP system, and generated CAP tests run against mocks in an isolated runner rather than in a real SAP S/4HANA system. Tenants, organisation accounts, single sign-on, a self-hosted edition and write access through an API are deliberately not built, and one account has five analysis runs before a Gemini API key of its own is needed.
SAP's on-premises agent linking SAP BTP to customer-network systems
Identity Authentication and Identity Provisioning as one tenant
ATC and Code Inspector checks for Clean ABAP
This is the legacy edition, for on-premise systems from SAP_BASIS 7.40. On ABAP Cloud, [the Cloud Edition](artifact:sap-code-pal-for-abap-cloud) is the one that runs.
Clean ABAP check set for ABAP Cloud
MCP adapter turning a CAP Java service into an MCP server
SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas separately excludes CAP wrappers around those APIs from its assessed scope. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement.
OData V2 protocol adapter built into the CAP Java runtime
OData V4 protocol adapter for CAP Java Application Services
CAP Java plugin sending audit log events to SAP Audit Log service
CAP Java handler for SAP Audit Log service API version 2
Change log of annotated entity fields for CAP Java
OAuth2 token validation from XSUAA and SAP Cloud Identity Services
Generates Open Resource Discovery documents from a CAP Java model
Former XSUAA JWT validation for CAP Java, removed in CAP Java 3.0
Maven bill of materials pinning CAP Java module versions
HTTP client for classic on-premise ABAP and ABAP Cloud
No published releases; repository quiet for 32 months.
TypeScript decoder for MYSAPSSO2 logon tickets
ABAP class implementing the Either pattern
No published releases; repository quiet for 25 months.
Generates local classes from FORM-based ABAP programs
No published releases; repository quiet for 67 months.
Blowfish cipher in ABAP, ECB and CBC modes
No published releases; repository quiet for 83 months.
Generator of ABAP type definitions from JSON structures
Puts a number from an abap2UI5 app on a Fiori launchpad tile
There is nothing here for ABAP for Cloud: the requirements name Standard ABAP releases only, and a CDS/SADL based OData service for `ABAP for Cloud` compatibility stands under Limitations & Todo.
MCP server publishing SAP functions as tools from config tables
Not reachable Not reachable since 2026-10-20.
Functional boundary What it exposes is whatever somebody put in the configuration table, which moves the governance question inside the SAP system and out of the server — an advantage if that table is controlled and a hazard if it is not. The web management interface is a second surface to secure alongside the MCP one.
MCP server searching seventeen SAP documentation repositories
It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.
OAuth 2.0 grant flows for applications and APIs in Neo regions
Builds OData batch request payloads from an uploaded $metadata file
Marked BETA on its own page.
ABAP framework for OData services with one class per entity
OData and Gateway shims serving SEGW-style services on Node.js
Local ABAP server serving /IWBEP/ OData v2 without an SAP system
Not a system to run a business application on: there is no business application in it, and what it implements of the language, the dictionary and Gateway is a stated subset of each. It is a clean-room reimplementation of the `/IWBEP/` interfaces that bundles no SAP source and no standard DDIC, so a service that reads standard objects has nothing to read, and `ANORMALIES.md` records every place the runtime differs from SAP before any workaround is written.
Template pairing a FastAPI service with ABAP reports that call it
Result pattern for ABAP instead of exceptions for expected failures
SQL templates for HANA audit policies of an S/4HANA tenant
Ingests and retains compliance audit data from BTP
OAuth server issuing JWTs and holding scopes for BTP apps
Provisioning jobs carrying users and groups between systems
Vault for an application's passwords, keys and keyrings
Serves BTP applications under the customer's own domain
Registration, login and consent for customer-facing sites
APIs for retention, deletion and personal data reports
Retention rules triggering blocking, deletion and archiving
HL7 FHIR implementation for storing and exchanging health data
Key and certificate repository in SAP BTP's Neo data centres
Scans uploaded files over REST with ClamAV
Service answering data subjects about their stored personal data
MCP server with semantic search over SAP AI Core documentation
Neither the package manifest nor the repository tree declares a licence.
Read-only MCP server over the SAP Business Accelerator Hub
The maintainer states it is unofficial, not endorsed by SAP, and that it uses authenticated Hub web and catalogue endpoints and browser session cookies in ways SAP's terms of service, SAP account terms or an organisation's own policies may restrict. The same README asks the reader not to use it for production, broad distribution or shared access without explicit approval, and says that installing it grants no permission to automate SAP services.
MCP server with semantic search over SAP BTP documentation
Neither the package manifest nor the repository tree declares a licence.
CAP plugin validating input against @Validator JSON Schema rules
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
MCP server searching and fetching SAP Notes and KBAs
It needs an S-user with SAP Support Portal access, so there is nothing to search without a support contract behind the login. The maintainer states it uses private SAP APIs behind authentication, asks the reader to check whether that use breaches SAP's terms of service, and disclaims both liability and any guarantee that it keeps working. MFA is handled only by typing the code into a visible browser, so a headless deployment cannot complete a login that demands one.
MCP server over SAP Road Map Explorer
What it returns is planning material, not a commitment, and the monorepo labels the server's role "future/planned features (planning only)". The maintainer also states it is unofficial, not endorsed by SAP, and that it uses authenticated Road Map Explorer web endpoints and browser session cookies in ways SAP's terms of service or an organisation's policies may restrict, with production, broad distribution and shared access called out as needing explicit approval. An account that requires MFA has to be bootstrapped once through a visible browser.
Samples for the six extension types of SAP Digital Manufacturing
Nothing here runs on its own: a plugin sample needs a Digital Manufacturing tenant to be uploaded into, and the integration samples need a Cloud Integration tenant plus an ERP system, or a mock server as the outbound example uses, before they do anything.
Authority check helper class used across SchwarzIT's USI reports
Shared root exception class and text getter for USI developments
Parser of TAB-delimited text into ABAP internal tables and back
ABAP add-on serving business data and transactions as MCP tools
Its maker offers it commercially.
AES and Rijndael encryption utilities for ABAP
Raises an ABAP exception from a text or the last system message
Release and repository quiet for 26 months.
Hosted app listing changes between SAPUI5 or OpenUI5 versions
No license Neither the package manifest nor the repository tree declares a licence.
Functional boundary It reports what the change log says, not what your application uses, so it cannot tell you which of the listed changes touches your code. The repository carries no licence file, which leaves the code itself with no grant attached even though the hosted app is open to use.
VS Code side bar view of the SAPUI5 and OpenUI5 API reference
