Everything in the atlas
Type
Domain
Origin: Independent
Signals
More
Group by: Domain
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
TypeScript library reaching ABAP service instances on Cloud Foundry
Generates signed JSON Web Tokens in ABAP
No published releases; repository quiet for 68 months.
No published releases; repository quiet for 58 months.
Validation library for ABAP checking dates, emails and GUIDs
No published releases; repository quiet for 40 months.
Checks passwords against Have I Been Pwned from ABAP
ABAP API for OAuth 2.0 authentication
No published releases; repository quiet for 97 months.
Checks field values against domain fixed values and check tables
No published releases; repository quiet for 54 months.
HTTP NTLM client for ABAP
OA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAP
No published releases; repository quiet for 27 months.
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
Class-based wrapper around STRUST certificate management
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
Custom messages and handler classes for CAP input validation
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
JWT authentication for CAP without xsuaa or xssec
Last released April 2022 at 0.0.2, and no repository is declared on the package.
Maps Microsoft Entra ID groups and app roles onto cds.User roles
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
Zod schemas as CAP validation middleware
CDS plugin for OData change tracking in CAP applications
TypeScript decoder for MYSAPSSO2 logon tickets
Blowfish cipher in ABAP, ECB and CBC modes
No published releases; repository quiet for 83 months.
CAP plugin validating input against @Validator JSON Schema rules
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
Read-only security analysis MCP server for SAP audits and SoD review
Read-only does not mean low-stakes: a complete picture of who can do what in an SAP system is exactly what an attacker would want, and the ready-made endpoint is the vendor's rather than yours — the README also documents running the server yourself. The authentication is careful; the question of what leaves your landscape is still yours.
Authority check helper class used across SchwarzIT's USI reports
AES and Rijndael encryption utilities for ABAP
Updater for root CAs in SAP NetWeaver from Mozilla's certificate store
Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.
Which CAP paths trigger @assert.target and which do not
Neither the package manifest nor the repository tree declares a licence.
CAP services and a UI for trying role restrictions with mock users
Neither the package manifest nor the repository tree declares a licence.
CAP bookshop wired to the Authorization Management Service
Neither the package manifest nor the repository tree declares a licence.
UI5 app reading the signed-in user via launchpad and approuter
No license Neither the package manifest nor the repository tree declares a licence.
Functional boundary The repository publishes no licence, so reusing its code needs the author's permission.
CAP and Fiori app showing BTP Application Vulnerability Report data
Neither the package manifest nor the repository tree declares a licence.
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
Authenticating a CAP service against Azure AD B2C
CAP Java authorization checks tried case by case
Neither the package manifest nor the repository tree declares a licence.
Tool completing a CAP project's deployment configuration
Tied to a specific training repository and last released August 2023. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
CAP plugin wrapping the SAP Forms service by Adobe on BTP
CAP plugin controlling CDS logger and OpenTelemetry log verbosity
Log fetcher and parser for one Cloud Foundry app
Read-only query tool for metrics in SAP Cloud Logging
Read-only query tool for OpenTelemetry spans in SAP Cloud Logging
Merged log tail of every started app in a Cloud Foundry space
Library for managing ABAP constants from registered sources
Quiet No published releases; repository quiet for 41 months.
Functional boundary Not in a production environment yet: the maintainer puts abaK in beta, says its API can still change and more tests are needed, and asks that a non-beta release be waited for.
Object-oriented wrapper around the Business Application Log
Chainable logger for ABAP Cloud around CL_BALI_LOG
Framework for runtime parameters, ranges and value mappings in ABAP
Feature toggle for ABAP read via is_active on view ZFEAT_TOGGLE
Fluentd client in ABAP for sending log lines to a collector
No published releases; repository quiet for 96 months.
Logger storing RFC function module call parameters as JSON
Generic customizing table and reader for ad hoc ABAP parameters
ABAP logging library with one interface across output targets
No published releases; repository quiet for 36 months.
Exports Business Application Log entries to Graylog or Loki
No published releases; repository quiet for 41 months.
Logging library for ABAP over the Application Log
Message logger for ABAP Cloud that saves to the Application Log
Exposes ABAP stack metrics to a monitoring tool
The declared repository is archived.
OTLP serialisation of traces, metrics and logs in ABAP
Framework activating custom ABAP enhancements through a Fiori app
Anything below SAP S/4HANA 2023 FPS03 (ABAP 7.58), and any system not running the ABAP Cloud development model: those two are the prerequisites the README names, and it states that the framework targets ABAP Cloud exclusively.
Prometheus client for ABAP, installed with abapGit
No published releases; repository quiet for 39 months.
Injectable wrapper for SY fields and date functions in ABAP Cloud
Helper class for reading TVARVC parameters and select-options
No published releases; repository quiet for 33 months.
Promise and async/await implementation for ABAP
No published releases; repository quiet for 36 months.
Framework for running ABAP work units in parallel tasks
Quiet No published releases; repository quiet for 57 months.
Functional boundary The maintainer states the current state has never been used in real-world scenarios: the demo reports in package ZAPS_DEMO and the unit tests are the only runs reported, and the release table marks SAP_BASIS 740 unclear, 754 as the release it was developed on, and 750 to 756 as expected to work.
SAP GUI transaction for one-click transports of copies
VS Code extension automating ActiveControl transport forms
ABAP application options as a structure with a generated editor
UI5 app and CAP service copying role collections between subaccounts
Quiet No published releases; repository quiet for 54 months.
No license Neither the package manifest nor the repository tree declares a licence.
MCP server for SAP BTP and Cloud Foundry acting as the logged-in user
Policy enforcement and field masking for MCP-enabled CAP apps
UI5 frontend performance and error capture for CAP
Feature-toggle pattern for CAP CDS
Last released June 2022 at 0.0.6, and no repository is declared on the package.
Rate-limit pattern for CAP Node.js applications
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Reports Clean Core ATC results per system as Level A to D KPIs
Hosted workspace redrawing custom ABAP as BPMN and grading it
Not reachable Not reachable since 2026-10-20.
Functional boundary The Level A–D grade merges SAP's two published files in the tool's own engine: it is an orientation rather than an ATC result and is left out of the signed audit pack, and the repository documents state by state where the grade is expected to differ from what the clean core ATC check reports. Nothing here runs ABAP Unit — on the RAP track that result is recorded from your own SAP system, and generated CAP tests run against mocks in an isolated runner rather than in a real SAP S/4HANA system. Tenants, organisation accounts, single sign-on, a self-hosted edition and write access through an API are deliberately not built, and one account has five analysis runs before a Gemini API key of its own is needed.
MCP server querying installations via the SAP Cloud ALM ITSM API
Neither the package manifest nor the repository tree declares a licence.
Polyfill for CL_ABAP_CODEPAGE under Clean Core
Coroutine framework for ABAP with awaitable results
No published releases; repository quiet for 26 months.
Feature toggle framework for ABAP with a UI5 GUI
Quiet No published releases; repository quiet for 101 months.
Functional boundary Not where a toggle is meant to be switched on in a production system: the maintainer warns that features should never be enabled in a production system.
Uploads, downloads and imports ABAP transport requests as files
Adds a program's dependent objects to a transport request
MCP tools over SAP Focused Run's Landscape Management Database
It reads the landscape inventory, not the systems in it — nothing here reaches a running application, and nothing here changes anything. A landscape description is also commercially sensitive in its own right: versions and hosts are what a targeting exercise starts from.
OpenTelemetry support for the CDS Node.js runtime
Local MCP server on support status from an SAP PAM export
Tool mapping BEx queries to the transport requests carrying them
Release and repository quiet for 50 months.
No published releases; repository quiet for 74 months.
Browser app checking SAP product support status from a PAM export
Runbook skills for Basis operations at the OS and database layer
The commands it writes stop production systems, delete data and import transports, which is why execution is deliberately somebody else's decision. BTP and cloud operations are explicitly out of scope and planned as a separate plugin.
Object-oriented wrapper around SAP's Application Log (SLG1)
Release and repository quiet for 36 months.
Report listing user-exits, BAdIs and enhancement spots of a program
Parallel task library for ABAP over the SPTA framework
Report creating transports of copies without a new version
No published releases; repository quiet for 42 months.
Threading library for ABAP modelled on Java's Thread and Runnable
No published releases; repository quiet for 37 months.
MTA projects sharing a role collection across role templates
Neither the package manifest nor the repository tree declares a licence.
Approuter session held in a bound Redis cache instance
No license Neither the package manifest nor the repository tree declares a licence.
Functional boundary Not a descriptor to deploy as it stands: the approuter's `sessionSecret` is written out in `mta.yaml`.
MTA deploying CAP, HDI container and a Fiori elements app
Multitenant CAP application using cds-mtxs
Neither the package manifest nor the repository tree declares a licence.
Parser for ABAP CDS DDL source with a typed AST
Compares a CAP project's CSV data with its database rows
TypeScript SDK over SAP's headless adt-ls language server
What adt-ls cannot do headless the maintainer puts out of scope, so a consumer that needs an ADT call the language server does not expose is back to speaking ADT itself. The README states the current runtime compatibility as verified on macOS arm64, against adt-ls 1.1.2 as the minimum and `1.1.2.202608131517` as the version tested. An Eclipse installation does not supply that runtime: SAP versions the two separately, so the VS Code extension has to be installed even where nobody opens VS Code.
Interactive generator for CAP event handler files
Placeholder package under a CAP annotations name, no annotations
The manifest calls it a dummy library exposing custom CDS annotations, but the published contents are a one-line README, a single exported barrier() whose body is throw Error("not yet implemented"), and no .cds file at all — there is nothing to import and nothing to annotate with. No repository, one release, May 2025.
ESLint plugin with one consultancy's rules for CDS files
Neither the package manifest nor the repository tree declares a licence.
Shared ESLint configuration for SAPUI5 and CAP projects
CLI translating UI5 i18n.properties files with OpenAI
Decorator-driven handler registration for CAP in TypeScript
Typed BaseRepository over CAP entities
Interactive project installer for CAP Node.js
CLI starting several CAP services and an AppRouter locally together
CLI of CAP development tools for Cloud Foundry workflows
There is no repository and no README: what the eight commands do is only readable from the compiled dist that ships in the package. Three of them — npmrc, install, project — are written for "SimpleMDG" projects rather than for CAP generally, so the reusable part is bind-local, run-local and debug. Seven releases up to July 2026. Its binding step writes the resolved VCAP_SERVICES into default-env.json in the project, where [@sap/cds-dk](artifact:sap-cds-dk) keeps only the place the credentials can be fetched from, so a project using it needs that file kept out of version control.
Runner for Bruno collections against XSUAA-protected CF apps
Node.js inspector tunnel over cf ssh to Cloud Foundry apps
File search in apps deployed to SAP BTP Cloud Foundry over cf ssh
Step-by-step state recorder for one JavaScript function in Node.js
SQL runner against the SAP HANA Cloud database bound to a CF app
Shell debugger for remote Node.js over the Chrome DevTools Protocol
HTTP trace hook streaming a running CF Node.js app's traffic
Endpoint discovery for CAP services deployed to Cloud Foundry
Cloud Foundry topology cache for the other @saptools packages
Workspace-wide CSN cache for querying CAP entities and columns
Static end-to-end tracer of one CAP operation across repositories
SQLTools connection from a Cloud Foundry app's HANA binding
Rule-based checker for SAPUI5 and OpenUI5 projects
Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.
Eclipse plug-in turning JSON or XML into ABAP types and DDIC objects
On an [SAP BTP ABAP environment](artifact:btp-abap-environment) system only the generated code is left: DDIC creation is not supported on ABAP Cloud, because classic DDIC object creation over REST is not available there. Create DDIC is also disabled where ADT is not installed in the same Eclipse, and Insert into Editor then works with any editor implementing `ITextEditor` instead of the ABAP one.
Eclipse plugin showing the call hierarchy of ABAP members
Eclipse plugin searching ABAP sources from the search dialog
On a system below ABAP 7.51, or one without a connected HANA database, the client-based mode does not run, and the server-based mode is only available where the abap-code-search-tools backend is installed in the system.
VS Code extension editing ABAP systems over ADT as a filesystem
Eclipse plugin for ABAP object search and CDS view analysis
On a system where the abap-search-tools backend is not installed: the plugin lists it as a precondition, and the beta update site expects that backend's dev branch in particular.
Converts classic Open SQL SELECTs to released CDS entities
In beta by its own page's account, where conversion bugs may occur and not all functions and variants are supported yet. The shapes named as not yet supported are sub selects, FOR ALL ENTRIES, functions such as count and sum, and the IN operator with a value list, so a statement built on one of those is outside what the converter sets out to do.
VS Code syntax highlighting for .abap files
Quiet No published releases; repository quiet for 27 months.
Functional boundary It binds to the .abap and .ABAP file extensions inside Visual Studio Code, so it does nothing for ABAP opened in another editor, or for source read from a system over ADT instead of from a file on disk.
Eclipse plugin for tagging ABAP repository objects
ABAP report running custom SQL queries into an ALV grid
Replays stored database snapshots in ABAP unit tests
No published releases; repository quiet for 28 months.
ABAP debugger extension drawing objects as a Graphviz graph
No published releases; repository quiet for 97 months.
Scripts running the ABAP Developer Edition in Docker
No published releases; repository quiet for 83 months.
JS/TS client for the ADT resources of an ABAP system
Not a tool a developer runs: it is a library to build one with, and it ships no editor, command line or interface of its own. Its sample connects with a plain HTTP URL, a user and a password, so a system that does not expose the adt ICF service that way is out of reach.
CLI that pulls and pushes ABAP packages as local files over ADT
A Python 3.10+ CLI, installed with pipx rather than through any SAP-provided package manager. Its own README lists what it does not do yet: where-used, syntax check and unit test runs — for those it says to reach for [ADT/Eclipse](external:eclipse) or an MCP server. First release, v0.1.0, and no standalone LICENSE file in the repository — the MIT grant is in the README and in pyproject.toml's project metadata rather than its own file.
ADT backend for the ABAP Call Hierarchy Eclipse plugin
In-system ABAP source search by string or regular expression
SAP GUI browser for tables, views, CDS views and joins
A system below ABAP 7.50: some of the classes it uses are only available from 7.50, and the maintainer states that downward compatibility to 7.40 in a single branch is currently not possible without resorting to dynamic programming.
Node.js command writing PDF documentation for an ABAP package
Not reachable since 2026-10-20.
Software-engineering metrics for an ABAP class or package
No published releases; repository quiet for 43 months.
Debugger script exporting an object hierarchy as Graphviz
No published releases; repository quiet for 67 months.
ABAP client for calling and asserting on OData services
ADT backend for the ABAP Search and Analysis Tools plugin
BDD/TDD assertion library for ABAP Unit, styled after Chai.js
ADT backend for the ABAP Tags Eclipse plugin
GitHub-hosted test data container for ABAP Cloud