Everything in the atlas
Type
Domain: 2
Origin: Not from SAP
Signals
More
Group by: Capability
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
TypeScript library reaching ABAP service instances on Cloud Foundry
Generates signed JSON Web Tokens in ABAP
No published releases; repository quiet for 68 months.
No published releases; repository quiet for 58 months.
Checks passwords against Have I Been Pwned from ABAP
ABAP API for OAuth 2.0 authentication
No published releases; repository quiet for 97 months.
HTTP NTLM client for ABAP
OA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAP
No published releases; repository quiet for 27 months.
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
JWT authentication for CAP without xsuaa or xssec
Last released April 2022 at 0.0.2, and no repository is declared on the package.
TypeScript decoder for MYSAPSSO2 logon tickets
CAP services and a UI for trying role restrictions with mock users
Neither the package manifest nor the repository tree declares a licence.
UI5 app reading the signed-in user via launchpad and approuter
No license Neither the package manifest nor the repository tree declares a licence.
Functional boundary The repository publishes no licence, so reusing its code needs the author's permission.
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
Authenticating a CAP service against Azure AD B2C
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Maps Microsoft Entra ID groups and app roles onto cds.User roles
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
Authority check helper class used across SchwarzIT's USI reports
CAP services and a UI for trying role restrictions with mock users
Neither the package manifest nor the repository tree declares a licence.
MTA projects sharing a role collection across role templates
Neither the package manifest nor the repository tree declares a licence.
CAP bookshop wired to the Authorization Management Service
Neither the package manifest nor the repository tree declares a licence.
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
CAP Java authorization checks tried case by case
Neither the package manifest nor the repository tree declares a licence.
Class-based wrapper around STRUST certificate management
Updater for root CAs in SAP NetWeaver from Mozilla's certificate store
Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.
CDS plugin for OData change tracking in CAP applications
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
Blowfish cipher in ABAP, ECB and CBC modes
No published releases; repository quiet for 83 months.
AES and Rijndael encryption utilities for ABAP
Validation library for ABAP checking dates, emails and GUIDs
No published releases; repository quiet for 40 months.
Checks field values against domain fixed values and check tables
No published releases; repository quiet for 54 months.
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Custom messages and handler classes for CAP input validation
Zod schemas as CAP validation middleware
CAP plugin validating input against @Validator JSON Schema rules
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
Which CAP paths trigger @assert.target and which do not
Neither the package manifest nor the repository tree declares a licence.
Six CAP features in one package, from replication cache to rate limits
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
Rate-limit pattern for CAP Node.js applications
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
Seventeen agent skills for ABAP development
MCP server drawing BTP solution diagrams on a draw.io canvas
Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.
Claude plugin writing BTP solution diagrams as .drawio files
Claude Code skills for BTP architecture diagrams in draw.io
The README tells you to fork before cloning, because Claude rewrites `references/` and `SKILL.md` in place as you use it, so a clone shared between people changes under all of them. Installing means `git` and `ln` on macOS or Linux and a symlink into `~/.claude/skills`. Fine positioning stays manual: the coordinates Claude writes can be rough apart from the centre coordinates of elements joined by a straight arrow and the containment relationships.
GitHub Copilot skill writing BTP solution diagrams as draw.io XML
Claude Code plugin and skill drawing validated BTP diagrams
A diagram of anything other than an SAP, BTP or on-premise landscape: the skill is tuned to the Horizon style and its 71 templates. It drafts rather than finishes, and its README budgets 15 to 30 minutes of edits in draw.io per diagram. Without Python the validator does not run.
VS Code extension editing ABAP systems over ADT as a filesystem
ABAP report running custom SQL queries into an ALV grid
SAP GUI browser for tables, views, CDS views and joins
A system below ABAP 7.50: some of the classes it uses are only available from 7.50, and the maintainer states that downward compatibility to 7.40 in a single branch is currently not possible without resorting to dynamic programming.
Native macOS code editor for ABAP and CDS
It runs on macOS only. Hammer Core Services, the part installed into the SAP system, needs that system on ABAP Platform 2023 or newer with SAP_BASIS 758 or newer, and installing it needs a user who can create development objects and run background jobs in that system.
Read-only SAP GUI report listing where HCM object data is stored
Thirty classic transactions rebuilt as abap2UI5 apps
Not on ABAP Cloud: the system tables and the classic Workbench APIs the screens use are not released for the ABAP Cloud language version, and there is no 7.02 version below the 7.50 floor either. Not where the full original function is needed, since only the listed transactions exist and about 300 buttons and fields are shown disabled. The authorization checks are rebuilt rather than the originals, which is why the README asks that the screens be tried with a restricted user on a sandbox before the ICF service is opened to more people.
Table content browser in abap2UI5, for ABAP Cloud and on premise
Not as it stands on a system past development: it reads the contents of any table the user names without an authorisation check of its own, so access is bounded only by whatever restrictions exist on the underlying handler or service. The README asks for your own checks first, naming `AUTHORITY-CHECK` on `S_TABU_DIS`/`S_TABU_NAM`, and for a restriction on who may run the app. There is no 7.02 downport either, because the selection-screen dependency has no `702` branch.
Multi-window SAP GUI explorer for tables, views and CDS SQL views
Browser-based SQL console built on abap2UI5
It runs whatever SQL a user types without an authorisation check of its own, and the native path additionally uses ADBC, which bypasses ABAP authorisations and client separation; the README asks anyone running it beyond a development system to add authorisation checks and restrict who may start the app. The native console needs Standard ABAP, so on ABAP Cloud only the Open SQL console is available.
SE16 clone shipped as SAPlink files
Quiet No published releases; repository quiet for 136 months.
No license Neither the package manifest nor the repository tree declares a licence.
ADT extension for Eclipse and VS Code showing three SAP GUI tools
Open SQL editor for ABAP with ALV output
Yeoman generator for Application Frontend config in UI5 libraries
It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.
VS Code extension to serve, proxy, build and deploy UI5 projects
UI5 Tooling module deploying Fiori/UI5 apps to SAP systems
UI5 CLI middleware proxying the dev server through @sap/approuter
UI5 CLI middleware running a CDS server inside the UI5 dev server
UI5 Tooling middleware proxying destinations and neo-app.json routes
Quiet Release and repository quiet for 75 months.
Functional boundary It supports Basic Authentication only, so a backend that needs another method is not reachable through it.
Experimental UI5 middleware for hot module replacement
UI5 middleware syncing interactions across browsers over websocket
UI5 middleware serving a chosen welcome page at the root path
Live reload middleware for the UI5 dev server
UI5 middleware recording OData traffic as mock server datasets
It records what the app actually asked for, so an entity no recorded journey touched is not in the dataset and replay will not answer for it. Its own README asks for `fiori-tools-appreload` to be disabled while recording, because a reload loop is what happens otherwise.
UI5 dev server middleware adding an OpenID Connect login
UI5 middleware logging in with Playwright and reusing the session
UI5 server middleware proxying route prefixes to a backend
Release and repository quiet for 36 months.
UI5 middleware serving a locally built UI5 framework
UI5 middleware serving static resources from a path or npm package
Dev-server middleware proxying requests to a backend system
UI5 middleware including one UI5 application in another
UI5 middleware serving static resources from JAR files (WebJars)
WebSocket support for Express-based dev servers such as UI5's
UI5 Tooling v4 extension that registers other extensions
UI5 Tooling task writing the service name into the importer manifest
UI5 builder task cachebusting standalone UI5 applications
UI5 builder task preparing build output for the cachebuster
Release and repository quiet for 66 months.
UI5 build task warning when the app's UI5 version reaches EOCP
The version list comes from ui5.sap.com, so a build that cannot reach it has nothing to match the project's version against. It checks the version written in `ui5.yaml`; a framework version a deployed app loads from elsewhere is outside what it sees.
UI5 builder task appending copyright headers to source files
UI5 builder task generating d.ts type declarations
UI5 builder task flattening library output for SAP NetWeaver
UI5 builder task checking XML views for missing i18n texts
UI5 builder task minifying HTML, CSS and JSON files
UI5 builder task minifying XML views and fragments
UI5 builder task turning a UI5 app into a progressive web app
UI5 builder task transpiling ES6 to ES5 with Babel
Release and repository quiet for 50 months.
Build task packaging the UI5 build result as a zip archive
UI5 CLI extension compiling Less files into CSS
UI5 tooling extensions loading npm packages as UI5 modules
UI5 CLI extension for string replacement during the build
UI5 CLI extension transpiling code during the UI5 build
UI5 app carrying 18 UI5 CLI extensions in one configuration
UI5 app consuming the cds-bookshop server via ui5-middleware-cap
Two UI5 apps consuming one npm package in two ways
Neither the package manifest nor the repository tree declares a licence.
Ten exercises on the Fiori elements mock server middleware
Neither the package manifest nor the repository tree declares a licence.
Sample setup for developing a UI5 library
Custom UI5 control packaged as an npm package
pnpm workspace developing a UI5 app, library and plugin together
Neither the package manifest nor the repository tree declares a licence.
Showcase of consuming npm libraries from a TypeScript UI5 app
TypeScript UI5 app consuming custom UI5 CLI extensions together
TypeScript UI5 app consuming @ui5/webcomponents
TypeScript UI5 module consumed through ui5-tooling-modules
pnpm workspace running CAP, a local launchpad and two UI5 apps
Neither the package manifest nor the repository tree declares a licence.
ABAP client for calling and asserting on OData services
UI5 app for OData test requests and ABAP Push Channels
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
CAP project built and deployed to Cloud Foundry by GitHub Actions
Consumer side of a CAP Java parent pom promotion model with Renovate
Neither the package manifest nor the repository tree declares a licence.
Maven parent pom pinning cds-services-bom and Spring Boot for CAP Java
Neither the package manifest nor the repository tree declares a licence.
VS Code extension editing ABAP systems over ADT as a filesystem
In-browser ABAP editor beside the abap2UI5 app it builds
A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.
Command-line ABAP pretty printer over ADT
No published releases; repository quiet for 45 months.
Software-engineering metrics for an ABAP class or package
No published releases; repository quiet for 43 months.
Converts ABAP code metrics into Code Charta's JSON format
No published releases; repository quiet for 63 months.
Transport release check gated by GitHub pull request approval
Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.
SAP GUI code review tied to transport release
No published releases; repository quiet for 31 months.
Shows a whole ABAP object as it stood at a past version
No published releases; repository quiet for 38 months.
SAP GUI version explorer and code reviewer for transport requests
ADT extension for Eclipse and VS Code showing three SAP GUI tools
Node.js inspector tunnel over cf ssh to Cloud Foundry apps
File search in apps deployed to SAP BTP Cloud Foundry over cf ssh
Step-by-step state recorder for one JavaScript function in Node.js
SQL runner against the SAP HANA Cloud database bound to a CF app
Shell debugger for remote Node.js over the Chrome DevTools Protocol
HTTP trace hook streaming a running CF Node.js app's traffic
Endpoint discovery for CAP services deployed to Cloud Foundry
Static end-to-end tracer of one CAP operation across repositories
VS Code extension editing ABAP systems over ADT as a filesystem
ABAP debugger extension drawing objects as a Graphviz graph
No published releases; repository quiet for 97 months.
Debugger script exporting an object hierarchy as Graphviz
No published releases; repository quiet for 67 months.
ABAP MCP server over ADT with a local journal that can undo writes
A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.
Debugger script generating a VALUE statement for a variable
No published releases; repository quiet for 57 months.
Displays the variables of ABAP short dumps
No published releases; repository quiet for 69 months.
Static page drawing Graphviz graphs for the ABAP debugger extension
Attaches a debugger to a CAP app running on Cloud Foundry
SAP GUI debugger script recording steps so execution can run backwards
Inversion-of-control container for ABAP
No published releases; repository quiet for 62 months.
Not reachable since 2026-10-20.
MCP server for SAP GUI for Windows via the Scripting API
Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. Windows only. The HTTP transport is meant for team use but binds to localhost, and unattended multi-user operation is listed as not yet available — a limitation and also the safer default.
MCP server working SAP GUI by screen coordinates
Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. It has also not been touched since February 2025, which the maintenance reading states — the three later entries here are where the CI, the Web GUI and the testing framing went.
MCP server driving SAP GUI and Web GUI for end-to-end testing
Not reachable Not reachable since 2026-10-20.
Functional boundary Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. And a UI test is slower and more brittle than the layer below it: this is for what only the screen can answer.
SAP GUI automation MCP server built on RoboSAPiens
Neither the package manifest nor the repository tree declares a licence.
Chained-call builder for ABAP batch input transactions
