Everything in the atlas
Type
Domain: 2
Origin
Signals
More: 2
Group by: Capability
CAP integration with the SAP Audit Log service
CAP Java plugin sending audit log events to SAP Audit Log service
CAP Java handler for SAP Audit Log service API version 2
Maven bill of materials pinning CAP Java module versions
SQL templates for HANA audit policies of an S/4HANA tenant
Ingests and retains compliance audit data from BTP
OWASP Top 10 workshop exploiting and fixing flaws in a CAP Node.js app
TechEd 2022 session on SAP BTP security recommendations
Hands-on applying SAP BTP security recommendations to a trial account
TechEd 2025 workshop on OWASP Top 10 risks in CAP applications
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
SAP's Node.js application router in front of business applications
CAP Node.js runtime
Token validation and security context for XSUAA and IAS
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
TypeScript library reaching ABAP service instances on Cloud Foundry
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
JWT authentication for CAP without xsuaa or xssec
Last released April 2022 at 0.0.2, and no repository is declared on the package.
SAP's on-premises agent linking SAP BTP to customer-network systems
Identity Authentication and Identity Provisioning as one tenant
OAuth2 token validation from XSUAA and SAP Cloud Identity Services
Former XSUAA JWT validation for CAP Java, removed in CAP Java 3.0
OAuth 2.0 grant flows for applications and APIs in Neo regions
OAuth server issuing JWTs and holding scopes for BTP apps
Registration, login and consent for customer-facing sites
CAP services and a UI for trying role restrictions with mock users
Neither the package manifest nor the repository tree declares a licence.
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
Authenticating a CAP service against Azure AD B2C
TechEd 2022 session on SAP BTP security recommendations
Hands-on applying SAP BTP security recommendations to a trial account
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
Compiler from AMS DCL policies to DCN for local runs and tests
Its own account of itself is local running and tests: the DCN it writes serves as input for running an application using AMS on the DCL bundle locally. It carries the SAP Developer License Agreement rather than an open-source licence, and the repository named in its package metadata is an internal SAP host, so the npm page is the only thing to read.
CAP Node.js runtime
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Maps Microsoft Entra ID groups and app roles onto cds.User roles
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
Maven bill of materials pinning CAP Java module versions
OAuth 2.0 grant flows for applications and APIs in Neo regions
OAuth server issuing JWTs and holding scopes for BTP apps
CAP services and a UI for trying role restrictions with mock users
Neither the package manifest nor the repository tree declares a licence.
MTA projects sharing a role collection across role templates
Neither the package manifest nor the repository tree declares a licence.
CAP bookshop wired to the Authorization Management Service
Neither the package manifest nor the repository tree declares a licence.
CAP microservice on XSUAA managing users and authorizations
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
CAP Java authorization checks tried case by case
Neither the package manifest nor the repository tree declares a licence.
Java apps showing policy-based authorization with AMS on SAP BTP
Node.js apps showing policy-based authorization with AMS on SAP BTP
OWASP Top 10 workshop exploiting and fixing flaws in a CAP Node.js app
CAP-based PWA for EV drivers proxying SAP E-Mobility OData APIs
Hands-on applying SAP BTP security recommendations to a trial account
TechEd 2025 workshop on OWASP Top 10 risks in CAP applications
Serves BTP applications under the customer's own domain
Change history for annotated CAP entities
CDS plugin for OData change tracking in CAP applications
Change log of annotated entity fields for CAP Java
CAP integration with SAP Data Privacy Integration
CAP Node.js runtime
Registration, login and consent for customer-facing sites
APIs for retention, deletion and personal data reports
Retention rules triggering blocking, deletion and archiving
Service answering data subjects about their stored personal data
Key and certificate repository in SAP BTP's Neo data centres
Provisioning jobs carrying users and groups between systems
Postman collections for the SAP Analytics Cloud SCIM API
Postman collection for the SAP Concur User Provisioning Service APIs
Identity Provisioning jobs syncing SAP Concur users for Joule
Hands-on integrating Cloud Identity Services with Microsoft Entra
CAP Node.js runtime
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
Custom messages and handler classes for CAP input validation
Zod schemas as CAP validation middleware
Maven bill of materials pinning CAP Java module versions
CAP plugin validating input against @Validator JSON Schema rules
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
Which CAP paths trigger @assert.target and which do not
Neither the package manifest nor the repository tree declares a licence.
Scans uploaded files over REST with ClamAV
Six CAP features in one package, from replication cache to rate limits
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
API proxies with security and traffic policies and Developer Hub
Rate-limit pattern for CAP Node.js applications
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Vault for an application's passwords, keys and keyrings
Tracks vulnerabilities in open-source components of BTP apps
MCP server for CAP development: model and docs search
The tools are documented as meant for AI models and not a stable API, so anything built to parse `cds-mcp` output rather than to feed a model can break between releases. Its corpus is the CAP documentation, so Fiori elements, BTP service or ABAP questions are not in what `search_docs` indexes.
Fiori documentation indexed as embeddings
MCP server searching seventeen SAP documentation repositories
It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.
MCP server with semantic search over SAP AI Core documentation
Neither the package manifest nor the repository tree declares a licence.
Read-only MCP server over the SAP Business Accelerator Hub
The maintainer states it is unofficial, not endorsed by SAP, and that it uses authenticated Hub web and catalogue endpoints and browser session cookies in ways SAP's terms of service, SAP account terms or an organisation's own policies may restrict. The same README asks the reader not to use it for production, broad distribution or shared access without explicit approval, and says that installing it grants no permission to automate SAP services.
MCP server with semantic search over SAP BTP documentation
Neither the package manifest nor the repository tree declares a licence.
MCP server searching and fetching SAP Notes and KBAs
It needs an S-user with SAP Support Portal access, so there is nothing to search without a support contract behind the login. The maintainer states it uses private SAP APIs behind authentication, asks the reader to check whether that use breaches SAP's terms of service, and disclaims both liability and any guarantee that it keeps working. MFA is handled only by typing the code into a visible browser, so a headless deployment cannot complete a login that demands one.
MCP server over SAP Road Map Explorer
What it returns is planning material, not a commitment, and the monorepo labels the server's role "future/planned features (planning only)". The maintainer also states it is unofficial, not endorsed by SAP, and that it uses authenticated Road Map Explorer web endpoints and browser session cookies in ways SAP's terms of service or an organisation's policies may restrict, with production, broad distribution and shared access called out as needing explicit approval. An account that requires MFA has to be bootstrapped once through a visible browser.
Machine-readable catalogue of SAP BTP pay-as-you-go services
Sources of capire, the CAP documentation
npx tool adding worked example files to a CAP project
Last released April 2024.
cds add plugin adding the incidents-app model to a project
Simple CDS bookshop model used across CAP explanations
Neither the package manifest nor the repository tree declares a licence.
Java implementation of the capire/bookshop getting-started sample
Java implementation of the capire/bookstore composite app
CAP sample drawing a material BOM as a UI5 network graph
Neither the package manifest nor the repository tree declares a licence.
Chat app on CAP and SAPUI5 against the OpenAI API
It calls the OpenAI API directly with a key in the environment. It was written in early 2023 and last touched in May 2023, which is before SAP AI Core and the CAP LLM plugins existed — so read it for the shape of the application, not for how a CAP service should reach a model today.
CAP's getting-started bookshop sample
Composite CAP app from separately deployed services
Incident Management reference application for CAP
SHINE demo application for learning SAP HANA XS Advanced
CAP reference app for lightweight local inventory management
Incident Management CAP app for the SAP BTP Developer's Guide
Financial Risk Analyzer built by an agent grounded in SAP MCP servers
Travel-booking reference app on CAP Node.js and Java backends
Bookshop app demonstrating the CAP Java SDK end to end
CAP-based PWA for EV drivers proxying SAP E-Mobility OData APIs
Event registration app showing OData V4 draft with UI5 and CAP
CAP reference app validating Ariba supplier registration data
CAP reference application for tail spend management
Todo app with CAP and SAPUI5 in TypeScript over OData V4
Neither the package manifest nor the repository tree declares a licence.
CAP travel-booking app built on xflights master data
CAP Java travel-booking app built on xflights-java master data