Everything in the atlas

The README states that UI5X is in early development and that APIs may change before version 1.0. Styling covers the `sap_horizon` and `sap_fiori_3` families with their dark and high-contrast variants; any other theme falls back to the base theme.

SAP's own guidance is narrower than the service's reach: it names standalone, single-tenant applications that do not connect to other applications as the fit, and says to stay on [the HTML5 Application Repository](artifact:btp-html5-application-repository) and the application router where those meet your needs better. Four hard limits decide it before taste does — 300 requests per second per subaccount, ten retained versions per application, 100 MB per application and 400 MB for the deployment archive.

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

Needs Standard ABAP 7.50 or higher, and an abap2UI5 whose frontend reserves the resourceRoot `z2ui5_cci`: a frontend predating that rename reserves `z2ui5ccc` and cannot resolve the controls. Frontend artefacts only one company needs, such as an in-house reuse library, a corporate icon font or company CSS, are what [abap2UI5-addons/custom-controls-customer](https://github.com/abap2UI5-addons/custom-controls-customer) is for, the same mechanism under the second reserved root `z2ui5_ccc`. ExportSpreadsheet needs SAPUI5: under OpenUI5 `sap.ui.export` is missing and the button renders disabled.

The README states that UI5X is in early development and that APIs may change before version 1.0. Styling covers the `sap_horizon` and `sap_fiori_3` families with their dark and high-contrast variants; any other theme falls back to the base theme.

The maintainer marks this under active development; public APIs, annotation names and OData contracts may still change.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

Not the whole addon in ABAP Cloud: the DDIC annotation service is not released there, so the annotations come through XCO instead, a database table is read-only, the DDL source is not read, and the cloud path was written without a cloud system to run it on. Not for a plain internal table, since it renders from CDS annotations; the README points at `z2ui5_cl_ui5_view_builder` for that case. As of 2026-10 the maintainer states that none of it has been clicked through in an SAP system: the RAP write path and the reading of metadata extensions were written from documentation and pass the three offline gates only.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

Not behind a managed approuter: SAP Build Work Zone does not expose the `/$companion/**` routes, so Companion never reaches CAP, and the README names managed approuter and Work Zone as out of scope for v1. Not where help has to be authored in a browser, since the editor, the producer and writes are absent and content lives in files the plugin compiles.

For a deployed application's UI. The README adds it with `npm add cds-plugin-ui5 -D`, a development dependency of the CDS server, and states nothing about a build or a deployment.

There is nothing here for ABAP for Cloud: the requirements name Standard ABAP releases only, and a CDS/SADL based OData service for `ABAP for Cloud` compatibility stands under Limitations & Todo.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.

Texts that must not leave the organisation: the file is uploaded to the site to be translated, and neither the tool's page nor the site's data protection notice says where it is processed or how long it is kept.

2 of 8 plans deprecated.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The proxy URL is a widget property the browser calls, so the [EdgeFlow Proxy API](external:cogniac-edgeflow-proxy) has to be reachable from the SAP DM client itself, on a local network and over HTTPS: its own repository asks for a certificate the browser trusts and documents generating one for the Pi's LAN IP. NC logging needs an SFC selected in the work list: without one the request is rejected with an error message.

Three of its five reference corpora are not shipped: without an api.sap.com key and session cookie, a tenant bearer token and a local SAPUI5 fetch, the REST, MDO and UI5 tools return a message naming the preparation step that is missing. The HTTP transport has no authentication until `MCP_AUTH_TOKEN` is set, so anything past localhost needs that or an authenticating reverse proxy. Packing the ZIP, uploading it through Manage POD 2.0 Extensions and placing the widget in the POD Designer stay manual steps outside the agent, and the SAPUI5 fetch defaults to the SDK's newest version, which the README says is not the version a tenant runs. Node.js 22 or newer.

On the UI5 path what comes back is an XML view or fragment with the data already substituted, streamed as the entity's media content, rather than an HTML page — the README calls this pre-rendering, and only the Vue path produces markup. The view kept under `srv/` has its UI5 bindings replaced by Handlebars expressions, so it is a second copy of the view, separate from the one the application ships. Version 1.0.8 declares `@sap/cds` `>=8` as its peer dependency, which puts a project on CAP 7 outside its stated range.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.