Everything in the atlas

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The proxy URL is a widget property the browser calls, so the [EdgeFlow Proxy API](external:cogniac-edgeflow-proxy) has to be reachable from the SAP DM client itself, on a local network and over HTTPS: its own repository asks for a certificate the browser trusts and documents generating one for the Pi's LAN IP. NC logging needs an SFC selected in the work list: without one the request is rejected with an error message.

It reads TypeScript exports only; a project written in plain JavaScript has no exported functions for it to extract. A call to the function name in a test file counts as tested, and a call through property access such as `.foo(` does not.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

A requirement that needs code: the skill generates configuration and states that it says so instead of faking it. Dialog and container targets have no verified enter event, so a dashboard placed there loads only through its Refresh button. Production Processes are outside it — it wires PODs to them and does not design them.

Three of its five reference corpora are not shipped: without an api.sap.com key and session cookie, a tenant bearer token and a local SAPUI5 fetch, the REST, MDO and UI5 tools return a message naming the preparation step that is missing. The HTTP transport has no authentication until `MCP_AUTH_TOKEN` is set, so anything past localhost needs that or an authenticating reverse proxy. Packing the ZIP, uploading it through Manage POD 2.0 Extensions and placing the widget in the POD Designer stay manual steps outside the agent, and the SAPUI5 fetch defaults to the SDK's newest version, which the README says is not the version a tenant runs. Node.js 22 or newer.

Nothing here runs on its own: a plugin sample needs a Digital Manufacturing tenant to be uploaded into, and the integration samples need a Cloud Integration tenant plus an ERP system, or a mock server as the outbound example uses, before they do anything.

The declared repository is archived.