Everything in the atlas

Neither the package manifest nor the repository tree declares a licence.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

The tools are documented as meant for AI models and not a stable API, so anything built to parse `cds-mcp` output rather than to feed a model can break between releases. Its corpus is the CAP documentation, so Fiori elements, BTP service or ABAP questions are not in what `search_docs` indexes.

It answers from documentation and never opens your project, so it cannot tell you whether the component you are asking about is the one your application already uses. Node.js v20.17 or v22.9 and above; on Windows the command needs a `cmd /c` prefix.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.

It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.

The maintainer states it is unofficial, not endorsed by SAP, and that it uses authenticated Hub web and catalogue endpoints and browser session cookies in ways SAP's terms of service, SAP account terms or an organisation's own policies may restrict. The same README asks the reader not to use it for production, broad distribution or shared access without explicit approval, and says that installing it grants no permission to automate SAP services.

Three of its five reference corpora are not shipped: without an api.sap.com key and session cookie, a tenant bearer token and a local SAPUI5 fetch, the REST, MDO and UI5 tools return a message naming the preparation step that is missing. The HTTP transport has no authentication until `MCP_AUTH_TOKEN` is set, so anything past localhost needs that or an authenticating reverse proxy. Packing the ZIP, uploading it through Manage POD 2.0 Extensions and placing the widget in the POD Designer stay manual steps outside the agent, and the SAPUI5 fetch defaults to the SDK's newest version, which the README says is not the version a tenant runs. Node.js 22 or newer.

It needs an S-user with SAP Support Portal access, so there is nothing to search without a support contract behind the login. The maintainer states it uses private SAP APIs behind authentication, asks the reader to check whether that use breaches SAP's terms of service, and disclaims both liability and any guarantee that it keeps working. MFA is handled only by typing the code into a visible browser, so a headless deployment cannot complete a login that demands one.

What it returns is planning material, not a commitment, and the monorepo labels the server's role "future/planned features (planning only)". The maintainer also states it is unofficial, not endorsed by SAP, and that it uses authenticated Road Map Explorer web endpoints and browser session cookies in ways SAP's terms of service or an organisation's policies may restrict, with production, broad distribution and shared access called out as needing explicit approval. An account that requires MFA has to be bootstrapped once through a visible browser.

It calls the OpenAI API directly with a key in the environment. It was written in early 2023 and last touched in May 2023, which is before SAP AI Core and the CAP LLM plugins existed — so read it for the shape of the application, not for how a CAP service should reach a model today.

Not reachable Not reachable since 2026-10-20.

Functional boundary The Level A–D grade merges SAP's two published files in the tool's own engine: it is an orientation rather than an ATC result and is left out of the signed audit pack, and the repository documents state by state where the grade is expected to differ from what the clean core ATC check reports. Nothing here runs ABAP Unit — on the RAP track that result is recorded from your own SAP system, and generated CAP tests run against mocks in an isolated runner rather than in a real SAP S/4HANA system. Tenants, organisation accounts, single sign-on, a self-hosted edition and write access through an API are deliberately not built, and one account has five analysis runs before a Gemini API key of its own is needed.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary Not a descriptor to deploy as it stands: the approuter's `sessionSecret` is written out in `mta.yaml`.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

The declared repository is archived.

Not reachable since 2026-10-20.

The class has to be moved by hand: an abapGit pull of the exported ZIP, or a paste into ADT or SE24. The palette is held to the 121 controls of UI5 1.71, and a control inserted by its class name instead comes from whatever UI5 the canvas has loaded, with nothing checking it against 1.71 - *Checks* reports that. An app class that builds no view, or more than one, is refused.

A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.

This is the legacy edition, for on-premise systems from SAP_BASIS 7.40. On ABAP Cloud, [the Cloud Edition](artifact:sap-code-pal-for-abap-cloud) is the one that runs.

Release and repository quiet for 29 months.

Release and repository quiet for 39 months.

Texts that must not leave the organisation: the file is uploaded to the site to be translated, and neither the tool's page nor the site's data protection notice says where it is processed or how long it is kept.

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

No published releases; repository quiet for 52 months.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

No published releases; repository quiet for 32 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 54 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 43 months.

Not a way to run existing reports unchanged: a report is rewritten as a class, and `CALL SCREEN`, dynpro modules, batch input, `SUBMIT` and native SQL are refused by the converter rather than mapped. Not an SAP GUI in the browser either: the programming model is classic and the screens are UI5, and the README points at abap2UI5-addons/sapgui for SE16N or SM37. Output has gaps the README names — ALV cells show dates and times as the model carries them rather than in the user's format, print is a text file because ABAP Cloud has no spool, and value tables for F4 are read on premise only.

The frontend is optional: where abap2UI5 apps are reached through the framework's own HTTP service, nothing from here is installed. In S/4 Public Cloud that endpoint needs `S_DEVELOP` authorisation, which the installation guide states makes it unfit for production, and the separate frontend app with an extra tile is what it names for business users. The `cloud_new` and `standard_new` branches need an abap2UI5 newer than 1.146.0 on the system.

Not for views built from controls outside the portable profile: sap.ui.table, sap.f, sap.uxap, sap.ui.comp and z2ui5.cc custom controls render as a visible unsupported-control box and are listed in the diagnostics, and `CONTROL_BY_ID` and `BINDING_CALL` stay unsupported. Nine frontend actions the profile allows, `DOWNLOAD_B64_FILE` and `SYSTEM_LOGOUT` among them, are skipped and reported rather than run, and formatters other than the profile's `Formatter.Date*` render a placeholder.

Neither suite has been run against an ABAP system: the reference backends are the framework transpiled to Node and cap2UI5 on CAP, so what a check does on a real system is open. The portable profile is a subset of 61 controls, filled from a census of 247 core apps of which 64.8 % run unchanged, so an app outside it renders placeholders in the terminal and Adaptive Cards renderers.

The value-help and search-help popups read whichever DDIC check table the user selects without an authorisation check of their own, so the README asks for your own checks and a restriction on which tables may be browsed before they are used beyond a development system. The transport-request popup works only on-premise, and the search help does not yet run on the Cloud stack.

Not where the framework code itself has to change: `input/` and the three installable branches are overwritten by the workflows on every upstream push, and a framework change is a pull request to abap2UI5. Bug reports and feature requests also go to the abap2UI5 repository rather than this one.

Not the place to learn abap2UI5 itself: every package starts from a technology the system already provides, and the framework basics and the control gallery are the other two sample repositories, abap2UI5/samples and abap2UI5/samples-controls. Three packages are out of reach on ABAP Cloud, and `05` needs the 2021 release that carries RAP business events.

No published releases; repository quiet for 79 months.

The maintainer marks this under active development; public APIs, annotation names and OData contracts may still change.

Not behind a managed approuter: SAP Build Work Zone does not expose the `/$companion/**` routes, so Companion never reaches CAP, and the README names managed approuter and Work Zone as out of scope for v1. Not where help has to be authored in a browser, since the editor, the producer and writes are absent and content lives in files the plugin compiles.

For a deployed application's UI. The README adds it with `npm add cds-plugin-ui5 -D`, a development dependency of the CDS server, and states nothing about a build or a deployment.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The proxy URL is a widget property the browser calls, so the [EdgeFlow Proxy API](external:cogniac-edgeflow-proxy) has to be reachable from the SAP DM client itself, on a local network and over HTTPS: its own repository asks for a certificate the browser trusts and documents generating one for the Pi's LAN IP. NC logging needs an SFC selected in the work list: without one the request is rejected with an error message.

Needs Standard ABAP 7.50 or higher, and an abap2UI5 whose frontend reserves the resourceRoot `z2ui5_cci`: a frontend predating that rename reserves `z2ui5ccc` and cannot resolve the controls. Frontend artefacts only one company needs, such as an in-house reuse library, a corporate icon font or company CSS, are what [abap2UI5-addons/custom-controls-customer](https://github.com/abap2UI5-addons/custom-controls-customer) is for, the same mechanism under the second reserved root `z2ui5_ccc`. ExportSpreadsheet needs SAPUI5: under OpenUI5 `sap.ui.export` is missing and the button renders disabled.

The declared repository is archived.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The subaccount destination's url names the us10 trial's repository runtime, so another region or subaccount needs it rewritten before the descriptor deploys.