Everything in the atlas

It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.

The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.

No published releases; repository quiet for 68 months.

No published releases; repository quiet for 58 months.

No published releases; repository quiet for 97 months.

No published releases; repository quiet for 27 months.

Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.

Last released April 2022 at 0.0.2, and no repository is declared on the package.

Its own account of itself is local running and tests: the DCN it writes serves as input for running an application using AMS on the DCL bundle locally. It carries the SAP Developer License Agreement rather than an open-source licence, and the repository named in its package metadata is an internal SAP host, so the npm page is the only thing to read.

It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.

Quiet Release and repository quiet for 25 months.

Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.

Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.

Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.

No published releases; repository quiet for 83 months.

No published releases; repository quiet for 40 months.

No published releases; repository quiet for 54 months.

It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.

Quiet Release and repository quiet for 30 months.

Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

This is the legacy edition, for on-premise systems from SAP_BASIS 7.40. On ABAP Cloud, [the Cloud Edition](artifact:sap-code-pal-for-abap-cloud) is the one that runs.

No published releases; repository quiet for 67 months.

The tools are documented as meant for AI models and not a stable API, so anything built to parse `cds-mcp` output rather than to feed a model can break between releases. Its corpus is the CAP documentation, so Fiori elements, BTP service or ABAP questions are not in what `search_docs` indexes.

It answers from documentation and never opens your project, so it cannot tell you whether the component you are asking about is the one your application already uses. Node.js v20.17 or v22.9 and above; on Windows the command needs a `cmd /c` prefix.

Not reachable since 2026-10-20.

A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.

No published releases; repository quiet for 31 months.

Not reachable Not reachable since 2026-10-20.

Functional boundary The Level A–D grade merges SAP's two published files in the tool's own engine: it is an orientation rather than an ATC result and is left out of the signed audit pack, and the repository documents state by state where the grade is expected to differ from what the clean core ATC check reports. Nothing here runs ABAP Unit — on the RAP track that result is recorded from your own SAP system, and generated CAP tests run against mocks in an isolated runner rather than in a real SAP S/4HANA system. Tenants, organisation accounts, single sign-on, a self-hosted edition and write access through an API are deliberately not built, and one account has five analysis runs before a Gemini API key of its own is needed.

It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.

Neither the package manifest nor the repository tree declares a licence.

The maintainer states it is unofficial, not endorsed by SAP, and that it uses authenticated Hub web and catalogue endpoints and browser session cookies in ways SAP's terms of service, SAP account terms or an organisation's own policies may restrict. The same README asks the reader not to use it for production, broad distribution or shared access without explicit approval, and says that installing it grants no permission to automate SAP services.

Neither the package manifest nor the repository tree declares a licence.

It needs an S-user with SAP Support Portal access, so there is nothing to search without a support contract behind the login. The maintainer states it uses private SAP APIs behind authentication, asks the reader to check whether that use breaches SAP's terms of service, and disclaims both liability and any guarantee that it keeps working. MFA is handled only by typing the code into a visible browser, so a headless deployment cannot complete a login that demands one.

What it returns is planning material, not a commitment, and the monorepo labels the server's role "future/planned features (planning only)". The maintainer also states it is unofficial, not endorsed by SAP, and that it uses authenticated Road Map Explorer web endpoints and browser session cookies in ways SAP's terms of service or an organisation's policies may restrict, with production, broad distribution and shared access called out as needing explicit approval. An account that requires MFA has to be bootstrapped once through a visible browser.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary It reports what the change log says, not what your application uses, so it cannot tell you which of the listed changes touches your code. The repository carries no licence file, which leaves the code itself with no grant attached even though the hosted app is open to use.

Last released April 2024.

A sample that needs something the system provides is not here — the samples-stack repository holds the OData, RAP, WebSocket and launchpad demos, and samples-controls the rebuilds of the UI5 Demo Kit originals. Every class in `src/` keeps to controls and properties available since UI5 1.71 and not deprecated, apart from two clipboard samples marked `(UI5 1.119+)`, so a newer control is not demonstrated here. Numbers are handed out per repository and reused across the three, so `493` alone does not name a sample: `Z2UI5_CL_SMP_APP_493` is the Hello World here.

Not on ABAP Cloud: most of the libraries use APIs that are not released there, and the repository has no ABAP Cloud gate yet. Not beyond a development system without authorisation checks added first — the samples carry none of their own, the abap-fm-logger sample reads the log table `ZAFL_LOG` with whatever the logged calls received and returned, and the abap_fm_json sample calls function modules, limited to a hard-coded whitelist.

The 221 ports under `src/02` need a UI5 runtime newer than 1.71: they install and activate on any release, and on an older UI5 the newer control does not render. The `src/03` collection is hand-written for SAPUI5-only controls and needs a SAPUI5 bootstrap. There are no per-library branches, so pulling the whole repository is the one way in and the activation takes a few minutes.

Nothing here runs on its own: a plugin sample needs a Digital Manufacturing tenant to be uploaded into, and the integration samples need a Cloud Integration tenant plus an ERP system, or a mock server as the outbound example uses, before they do anything.