Everything in the atlas

It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.

It puts create, update and delete on business entities behind natural language. Whatever the destination's principal may change, an agent may change — and "create a new customer" is a sentence, not a form somebody signed off.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary There is no licence, so there is no grant to use or redistribute it. Everything else is secondary to that. Note too that its 'verified' claim means the skill text was checked against itself by an evaluation suite — not that the advice was run against a CAP version.

Not where the agent is reached over anything other than A2A: the README states the plugin does not speak anything other than A2A as @cap-js/agents serves it. Not where an upgrade has to be uneventful either — it pins @cap-js/agents to exactly 0.9.1, calls that package pre-1.0 and days old at the time of writing, and says this plugin inherits that instability and to expect breakage on upgrade.

Not published to npm. Install from source.

Local scaffolding only. Its own Out of Scope list names deployment to Cloud Foundry or Kyma, XSUAA and IAS configuration or any other BTP service binding, the SaaS Registry and subscription flow to real tenants, and automatic migration from the legacy `@sap/cds-mtx`. For the concepts rather than the scaffolding step, the README points at the `multitenancy` skill in [skillOverflow](artifact:dankromp-skilloverflow) by [Daniel Krompaß](actor:dankromp), which covers the MTX sidecar, `xs-security.json`, tenant lifecycle hooks and the deployment path and runs no commands at all.

A thin declaration over CPI's APIs: it reaches what those APIs expose and nothing else, and it inherits whatever the tenant's own authorisations allow.

Knowledge with no reach: without an MCP server connected it can tell an agent what to write and cannot let it read or run anything. The rules target the ABAP Cloud development model, so a classic on-premise codebase is not what they are written against.

Not for S/4HANA Public Cloud or [the BTP ABAP environment](artifact:btp-abap-environment), where the README states there is no `SUBMIT`, NAST or SOAP-RFC; the floor elsewhere is SAP_BASIS 7.50, the `/sap/bc/soap/rfc` service active, and an SAP user with `S_RFC` on the kit's function group as well as the authorizations for the reports and the spool. Print output is NAST messages only, so S/4 Output Management through BRF+ or APOC is outside it, and editing covers SmartForms alone, with Adobe Forms and SAPscript previewable but not editable. A report that opens a popup, calls a screen or is a dialog transaction cannot be run at all.

Freestyle SQL and `abap_run` mean an agent can read data and execute code, which is well past reading source. Neither is something to grant on a system where the distinction between development tooling and business data matters.

A compiled binary rather than an npm package, shipped prebuilt per platform and through pip and uvx. It collects anonymous usage telemetry by default, switched off with `--no-telemetry` or `DATAZOO_DISABLE_TELEMETRY=1`. And the BW reach is what distinguishes it — if the work is plain ABAP, that half is weight you are not using.

Two licences, by which package you install: the standalone server, `@mcp-abap-adt/core`, is AGPL-3.0-only, a licence to read before shipping anything built around it; the library, `@mcp-abap-adt/lib`, is Apache-2.0. The destination model also expects service keys sitting in a local directory, which is a secrets decision to make deliberately.

This is the database, not an application in front of it, so what an agent can read is whatever the connection user can read — the guardrails bound the shape of a query, not the sensitivity of what it returns. Grant the connection the rights you would grant a person.

Not for production: the README states local and development instances only, and the server refuses a HAC URL whose host is not private unless `HAC_ALLOW_REMOTE=true` overrides that guard. Masking applies to `config_get` only, so `logs_tail` and `monitoring_info` output, thread dumps included, is unmasked and may carry sensitive data, and whatever a tool returns goes to the MCP client and its model. Certificate checks are disabled whenever `HAC_INSECURE_TLS=true` is set, which the README names as typical for local HAC.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.

Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.

Its own README opens by calling the server experimental. It also writes: locking, editing and activating in a system an agent can reach is a permissions decision before it is a tooling one.

Every tool its README lists reads — Get and Search, nothing that writes. Locking, editing, activation and transports are the other server, [mcp-abap-abap-adt-api](artifact:mario-andreschak-mcp-abap-adt-api), and mixing the two is how you end up with two MCP servers pointed at one system.

Business Source License 1.1, which is source-available rather than open source: reading and evaluating are fine, and production use is restricted until the licence's change date. That is a procurement question, not a technical one, and it is the thing to settle first. Read-only also means read-only — no modelling, no loads.

It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.

There is nothing to clone here: "Access is provided through a registration page. Once registered, you will receive access to the GitHub repository containing the agents, deployment guides, and documentation", and that repository answers 404 to anyone who has not registered, so neither the agent code nor the deployment guides can be read before the form is filled in. AWS states the agents are published as an unsupported solution, with customers responsible for testing and securing the code before deploying in production, and that they are intended for non-production SAP environments rather than production systems. The documentation link in the README is still a placeholder.

It fronts APIs you already have; nothing here reads a system's source or model, and a config file is only as good as the entity sets somebody wrote into it. OData V2 is the query surface it names.

A requirement that needs code: the skill generates configuration and states that it says so instead of faking it. Dialog and container targets have no verified enter event, so a dashboard placed there loads only through its Refresh button. Production Processes are outside it — it wires PODs to them and does not design them.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

It answers about the object catalogue, not about your code: nothing here reads your system, so it will tell you a table is not released and not that you used it. That check is ATC's, and this is what makes ATC's answer actionable.

It says so itself, in bold, and the atlas repeats it: not legal advice and not a compliance decision. Only SAP, your contract, or SAP support can answer bindingly, and the skill routes legal, commercial and roadmap questions there rather than guessing at them. Treat the output as evidence gathered, not as a verdict.

It reaches a data warehouse, so what an agent can see is business data by definition — the SQL sanitisation and PII filtering in the server are there because of that, not instead of a decision about it. And the guidance is Datasphere-shaped: nothing here transfers to a HANA Cloud database used directly.

The maintainer states it is unofficial, not endorsed by SAP, and that it uses authenticated Hub web and catalogue endpoints and browser session cookies in ways SAP's terms of service, SAP account terms or an organisation's own policies may restrict. The same README asks the reader not to use it for production, broad distribution or shared access without explicit approval, and says that installing it grants no permission to automate SAP services.

Business Source License 1.1: source-available, with production use restricted until the change date — settle that before anything technical. And the governed execution path in v0.2 does act on data, which is a different grant from the discovery the v0.1 baseline offered.

It stops before the artifact: in the README's own words it does not generate or deploy complete iFlow artifacts, so building and shipping the integration flows themselves stays with a person and a tenant. Knowledge beside the work rather than a generator, and it reads nothing from a running tenant.

Not for a project below the 2211-jdk21.1 baseline: older releases and the JSP Accelerator are covered only as explicitly marked legacy material, so a JSP storefront or a pre-JDK-21 platform is outside what the guides are written against. Knowledge with reach only through one script — it can tell an agent what to write and, apart from `query-items.sh`, cannot let it read what a given system contains.

Three of its five reference corpora are not shipped: without an api.sap.com key and session cookie, a tenant bearer token and a local SAPUI5 fetch, the REST, MDO and UI5 tools return a message naming the preparation step that is missing. The HTTP transport has no authentication until `MCP_AUTH_TOKEN` is set, so anything past localhost needs that or an authenticating reverse proxy. Packing the ZIP, uploading it through Manage POD 2.0 Extensions and placing the widget in the POD Designer stay manual steps outside the agent, and the SAPUI5 fetch defaults to the SDK's newest version, which the README says is not the version a tenant runs. Node.js 22 or newer.

An early alpha release whose README says to pin the version and test recipes against non-production data first. HANA synchronisation is snapshot-only and does not reconcile deleted rows, so a document for a row deleted in the source stays in the index. A recipe's field allow-list does not decide what the service account may read: the README states that field allow-listing does not replace SAP authorization, and that the package infers no SAP module semantics, authorization scope or safe fields from table names. Only Business Partner has a built-in recipe, every other dataset needs a `KnowledgeRecipe` written for it, and [Qdrant](external:qdrant) local mode is stated to be for development and smaller indexes.

On ECC the S/4HANA `API_*` services that the three convenience readers default to do not exist, so each one has to be pointed at a Z service of your own or replaced by the RFC tools. `read_table` inherits `RFC_READ_TABLE`'s 512-byte row, so a wide table needs an explicit field list and some fields cannot be selected at all, and the bridge starts a Node process and a fresh logon per call, with no pooling. The audit log is one line per call that includes the call arguments, so every filter and WHERE clause sent to SAP is written to a file that then has to be handled as sensitive.

It needs an S-user with SAP Support Portal access, so there is nothing to search without a support contract behind the login. The maintainer states it uses private SAP APIs behind authentication, asks the reader to check whether that use breaches SAP's terms of service, and disclaims both liability and any guarantee that it keeps working. MFA is handled only by typing the code into a visible browser, so a headless deployment cannot complete a login that demands one.

What it returns is planning material, not a commitment, and the monorepo labels the server's role "future/planned features (planning only)". The maintainer also states it is unofficial, not endorsed by SAP, and that it uses authenticated Road Map Explorer web endpoints and browser session cookies in ways SAP's terms of service or an organisation's policies may restrict, with production, broad distribution and shared access called out as needing explicit approval. An account that requires MFA has to be bootstrapped once through a visible browser.

It works against a tenant, through the REST API, with credentials in the environment — so these skills act rather than advise, and the review skill is a check on generated content rather than a substitute for one. Nothing here is useful without an Automation Pilot tenant to point at.

Enterprise-architecture work, not development: this describes what your landscape records, never what your code does. And the skills assume the server — without [the LeanIX MCP server](artifact:sap-leanix-mcp-server) reachable against your instance, they are instructions with nothing to call.

Knowledge about theming, not a theme build: nothing here compiles a theme or deploys one, and it says nothing about a custom control's own parameters.

Neither the package manifest nor the repository tree declares a licence.

GPL-3.0, which is a licence to read before vendoring any of it into something you ship. Forty plugins is also a lot of always-available surface — the ledger is there because breadth and verification pull in opposite directions, and it does not resolve that so much as report it.

It is a plugin for one server — its own — so it is a stack rather than a component. And the guard is only as good as the profile labels: a production system registered as `DEV` is a production system with the safety off.

Two skills, narrowly scoped: nothing here scaffolds an application or answers what a component's API is — that is [@ui5/webcomponents-mcp-server](artifact:ui5-webcomponents-mcp-server), which reads the same library's documentation.

It is text processing, not an agent: there is no tool calling, no retrieval and no conversation. It needs SAP AI Core, and the backend half needs [@sap-ai-sdk/orchestration](artifact:sap-ai-sdk-orchestration) installed alongside it — an optional peer, so a frontend-only install stays lean.

Guidance, not access: these are instructions handed to an agent, and what the agent can then read of your project comes from [@ui5/mcp-server](artifact:ui5-mcp-server) or the editor. A modernisation workflow that runs autonomously across a codebase is also a thing to point at a branch rather than at main.

Reach is the reason to use it and the reason to be careful: reading cluster tables and spool output goes well past what a development tool is normally pointed at. Decide what an agent may reach before granting it, not after.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Every CDS service in both samples is marked `@requires: 'any'` and left publicly accessible, which the README says simplifies the testing and deployment process, and it asks for proper authentication mechanisms to be applied in their place.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.