Everything in the atlas

Not in a project on CAP 7 or earlier: the package declares `@sap/cds` >=8 and `@sap/cds-compiler` >=5 as peer dependencies.

Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

Not a system to run a business application on: there is no business application in it, and what it implements of the language, the dictionary and Gateway is a stated subset of each. It is a clean-room reimplementation of the `/IWBEP/` interfaces that bundles no SAP source and no standard DDIC, so a service that reads standard objects has nothing to read, and `ANORMALIES.md` records every place the runtime differs from SAP before any workaround is written.

Neither the package manifest nor the repository tree declares a licence.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas applies that prohibition to CAP wrappers around those APIs. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement. In beta, with nine releases in the six weeks after the first, so pin it.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Not published to npm. Install from source.

Neither the package manifest nor the repository tree declares a licence.

Not reachable Not reachable since 2026-10-20.

Functional boundary The Level A–D grade merges SAP's two published files in the tool's own engine: it is an orientation rather than an ATC result and is left out of the signed audit pack, and the repository documents state by state where the grade is expected to differ from what the clean core ATC check reports. Nothing here runs ABAP Unit — on the RAP track that result is recorded from your own SAP system, and generated CAP tests run against mocks in an isolated runner rather than in a real SAP S/4HANA system. Tenants, organisation accounts, single sign-on, a self-hosted edition and write access through an API are deliberately not built, and one account has five analysis runs before a Gemini API key of its own is needed.

It answers about the object catalogue, not about your code: nothing here reads your system, so it will tell you a table is not released and not that you used it. That check is ATC's, and this is what makes ATC's answer actionable.

Neither the package manifest nor the repository tree declares a licence.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary Not a descriptor to deploy as it stands: the approuter's `sessionSecret` is written out in `mta.yaml`.

A library a VS Code extension calls, not something installed and run on its own; there is no documented standalone CLI. No public repository either, so what it does is read from its own README rather than checked against source.

Specific to MDK metadata projects — nothing here builds or deploys a CAP service or a plain Fiori app. Closed-source, under SAP's own developer licence rather than a public repository.

Last released June 2022 at 0.0.6, and no repository is declared on the package.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

The declared repository is on SAP's internal GitHub (github.tools.sap) and is not publicly reachable, so npm is the only place to read anything about it.