Everything in the atlas
Type
Domain: 2
Origin
Signals
More
Group by: Capability
CAP integration with the SAP Audit Log service
CAP Java plugin sending audit log events to SAP Audit Log service
CAP Java handler for SAP Audit Log service API version 2
Maven bill of materials pinning CAP Java module versions
SQL templates for HANA audit policies of an S/4HANA tenant
Ingests and retains compliance audit data from BTP
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
SAP's Node.js application router in front of business applications
CAP Node.js runtime
Token validation and security context for XSUAA and IAS
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
TypeScript library reaching ABAP service instances on Cloud Foundry
Generates signed JSON Web Tokens in ABAP
No published releases; repository quiet for 68 months.
No published releases; repository quiet for 58 months.
Checks passwords against Have I Been Pwned from ABAP
ABAP API for OAuth 2.0 authentication
No published releases; repository quiet for 97 months.
HTTP NTLM client for ABAP
OA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAP
No published releases; repository quiet for 27 months.
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
JWT authentication for CAP without xsuaa or xssec
Last released April 2022 at 0.0.2, and no repository is declared on the package.
SAP's on-premises agent linking SAP BTP to customer-network systems
Identity Authentication and Identity Provisioning as one tenant
OAuth2 token validation from XSUAA and SAP Cloud Identity Services
Former XSUAA JWT validation for CAP Java, removed in CAP Java 3.0
TypeScript decoder for MYSAPSSO2 logon tickets
OAuth 2.0 grant flows for applications and APIs in Neo regions
OAuth server issuing JWTs and holding scopes for BTP apps
Registration, login and consent for customer-facing sites
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
Compiler from AMS DCL policies to DCN for local runs and tests
Its own account of itself is local running and tests: the DCN it writes serves as input for running an application using AMS on the DCL bundle locally. It carries the SAP Developer License Agreement rather than an open-source licence, and the repository named in its package metadata is an internal SAP host, so the npm page is the only thing to read.
CAP Node.js runtime
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Maps Microsoft Entra ID groups and app roles onto cds.User roles
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
Maven bill of materials pinning CAP Java module versions
OAuth 2.0 grant flows for applications and APIs in Neo regions
OAuth server issuing JWTs and holding scopes for BTP apps
Authority check helper class used across SchwarzIT's USI reports
Class-based wrapper around STRUST certificate management
Serves BTP applications under the customer's own domain
Updater for root CAs in SAP NetWeaver from Mozilla's certificate store
Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.
Change history for annotated CAP entities
CDS plugin for OData change tracking in CAP applications
Change log of annotated entity fields for CAP Java
CAP integration with SAP Data Privacy Integration
CAP Node.js runtime
Registration, login and consent for customer-facing sites
APIs for retention, deletion and personal data reports
Retention rules triggering blocking, deletion and archiving
Service answering data subjects about their stored personal data
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
Blowfish cipher in ABAP, ECB and CBC modes
No published releases; repository quiet for 83 months.
Key and certificate repository in SAP BTP's Neo data centres
AES and Rijndael encryption utilities for ABAP
Provisioning jobs carrying users and groups between systems
CAP Node.js runtime
Validation library for ABAP checking dates, emails and GUIDs
No published releases; repository quiet for 40 months.
Checks field values against domain fixed values and check tables
No published releases; repository quiet for 54 months.
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Custom messages and handler classes for CAP input validation
Zod schemas as CAP validation middleware
Maven bill of materials pinning CAP Java module versions
CAP plugin validating input against @Validator JSON Schema rules
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
Scans uploaded files over REST with ClamAV
Six CAP features in one package, from replication cache to rate limits
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
API proxies with security and traffic policies and Developer Hub
Rate-limit pattern for CAP Node.js applications
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Vault for an application's passwords, keys and keyrings
Tracks vulnerabilities in open-source components of BTP apps
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
Seventeen agent skills for ABAP development
MCP server drawing BTP solution diagrams on a draw.io canvas
Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.
Claude plugin writing BTP solution diagrams as .drawio files
Claude Code skills for BTP architecture diagrams in draw.io
The README tells you to fork before cloning, because Claude rewrites `references/` and `SKILL.md` in place as you use it, so a clone shared between people changes under all of them. Installing means `git` and `ln` on macOS or Linux and a symlink into `~/.claude/skills`. Fine positioning stays manual: the coordinates Claude writes can be rough apart from the centre coordinates of elements joined by a straight arrow and the containment relationships.
GitHub Copilot skill writing BTP solution diagrams as draw.io XML
SAP's visual language and templates for BTP solution diagrams
Claude Code plugin and skill drawing validated BTP diagrams
A diagram of anything other than an SAP, BTP or on-premise landscape: the skill is tuned to the Horizon style and its 71 templates. It drafts rather than finishes, and its README budgets 15 to 30 minutes of edits in draw.io per diagram. Without Python the validator does not run.
SAP's Eclipse plugins for ABAP development over ADT
It is an Eclipse install. A development object that is not native-integrated in Eclipse opens in the SAP GUI that is installed locally with the client.
VS Code extension editing ABAP systems over ADT as a filesystem
ABAP report running custom SQL queries into an ALV grid
SAP GUI browser for tables, views, CDS views and joins
A system below ABAP 7.50: some of the classes it uses are only available from 7.50, and the maintainer states that downward compatibility to 7.40 in a single branch is currently not possible without resorting to dynamic programming.
Native macOS code editor for ABAP and CDS
It runs on macOS only. Hammer Core Services, the part installed into the SAP system, needs that system on ABAP Platform 2023 or newer with SAP_BASIS 758 or newer, and installing it needs a user who can create development objects and run background jobs in that system.
Read-only SAP GUI report listing where HCM object data is stored
Thirty classic transactions rebuilt as abap2UI5 apps
Not on ABAP Cloud: the system tables and the classic Workbench APIs the screens use are not released for the ABAP Cloud language version, and there is no 7.02 version below the 7.50 floor either. Not where the full original function is needed, since only the listed transactions exist and about 300 buttons and fields are shown disabled. The authorization checks are rebuilt rather than the originals, which is why the README asks that the screens be tried with a restricted user on a sandbox before the ICF service is opened to more people.
Table content browser in abap2UI5, for ABAP Cloud and on premise
Not as it stands on a system past development: it reads the contents of any table the user names without an authorisation check of its own, so access is bounded only by whatever restrictions exist on the underlying handler or service. The README asks for your own checks first, naming `AUTHORITY-CHECK` on `S_TABU_DIS`/`S_TABU_NAM`, and for a restriction on who may run the app. There is no 7.02 downport either, because the selection-screen dependency has no `702` branch.
Multi-window SAP GUI explorer for tables, views and CDS SQL views
Browser-based SQL console built on abap2UI5
It runs whatever SQL a user types without an authorisation check of its own, and the native path additionally uses ADBC, which bypasses ABAP authorisations and client separation; the README asks anyone running it beyond a development system to add authorisation checks and restrict who may start the app. The native console needs Standard ABAP, so on ABAP Cloud only the Open SQL console is available.
SE16 clone shipped as SAPlink files
Quiet No published releases; repository quiet for 136 months.
No license Neither the package manifest nor the repository tree declares a licence.
ADT extension for Eclipse and VS Code showing three SAP GUI tools
Open SQL editor for ABAP with ALV output
UI5 Tooling command line for project setup, dev server and build
Internal logger of the UI5 CLI
UI5 CLI middleware for Istanbul code coverage
Deprecated UI5 Tooling extensions for UI5 Web Components wrappers
The declared repository is archived.
Yeoman generator for Application Frontend config in UI5 libraries
It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.
VS Code extension to serve, proxy, build and deploy UI5 projects
UI5 Tooling module deploying Fiori/UI5 apps to SAP systems
UI5 CLI middleware proxying the dev server through @sap/approuter
UI5 CLI middleware running a CDS server inside the UI5 dev server
UI5 Tooling middleware proxying destinations and neo-app.json routes
Quiet Release and repository quiet for 75 months.
Functional boundary It supports Basic Authentication only, so a backend that needs another method is not reachable through it.
Experimental UI5 middleware for hot module replacement
UI5 middleware syncing interactions across browsers over websocket
UI5 middleware serving a chosen welcome page at the root path
Live reload middleware for the UI5 dev server
UI5 middleware recording OData traffic as mock server datasets
It records what the app actually asked for, so an entity no recorded journey touched is not in the dataset and replay will not answer for it. Its own README asks for `fiori-tools-appreload` to be disabled while recording, because a reload loop is what happens otherwise.
UI5 dev server middleware adding an OpenID Connect login
UI5 middleware logging in with Playwright and reusing the session
UI5 server middleware proxying route prefixes to a backend
Release and repository quiet for 36 months.
UI5 middleware serving a locally built UI5 framework
UI5 middleware serving static resources from a path or npm package
Dev-server middleware proxying requests to a backend system
UI5 middleware including one UI5 application in another
UI5 middleware serving static resources from JAR files (WebJars)
WebSocket support for Express-based dev servers such as UI5's
UI5 Tooling v4 extension that registers other extensions
UI5 Tooling task writing the service name into the importer manifest
UI5 builder task cachebusting standalone UI5 applications
UI5 builder task preparing build output for the cachebuster
Release and repository quiet for 66 months.
UI5 build task warning when the app's UI5 version reaches EOCP
The version list comes from ui5.sap.com, so a build that cannot reach it has nothing to match the project's version against. It checks the version written in `ui5.yaml`; a framework version a deployed app loads from elsewhere is outside what it sees.
UI5 builder task appending copyright headers to source files
UI5 builder task generating d.ts type declarations
UI5 builder task flattening library output for SAP NetWeaver
UI5 builder task checking XML views for missing i18n texts
UI5 builder task minifying HTML, CSS and JSON files
UI5 builder task minifying XML views and fragments
UI5 builder task turning a UI5 app into a progressive web app
UI5 builder task transpiling ES6 to ES5 with Babel
Release and repository quiet for 50 months.
Build task packaging the UI5 build result as a zip archive
UI5 CLI extension compiling Less files into CSS
UI5 tooling extensions loading npm packages as UI5 modules
UI5 CLI extension for string replacement during the build
UI5 CLI extension transpiling code during the UI5 build
ABAP client for calling and asserting on OData services
UI5 app for OData test requests and ABAP Push Channels
Command line client and development toolkit for CAP
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
GitHub Action setting up the Cloud Foundry CLI
Predefined CI/CD pipelines for SAP development projects
VS Code extension editing ABAP systems over ADT as a filesystem
In-browser ABAP editor beside the abap2UI5 app it builds
A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.
Command-line ABAP pretty printer over ADT
No published releases; repository quiet for 45 months.
Software-engineering metrics for an ABAP class or package
No published releases; repository quiet for 43 months.
Converts ABAP code metrics into Code Charta's JSON format
No published releases; repository quiet for 63 months.
Transport release check gated by GitHub pull request approval
Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.
SAP GUI code review tied to transport release
No published releases; repository quiet for 31 months.
Shows a whole ABAP object as it stood at a past version
No published releases; repository quiet for 38 months.
SAP GUI version explorer and code reviewer for transport requests
ADT extension for Eclipse and VS Code showing three SAP GUI tools