Everything in the atlas
Type
Domain
Origin
Signals
More: 3
Group by: Kind
Fake data generator for ABAP
No published releases; repository quiet for 53 months.
ABAP client for Firebase's Realtime Database REST API
No published releases; repository quiet for 95 months.
ABAP objects enabling ADT updates on systems older than 7.51
Quiet No published releases; repository quiet for 92 months.
Functional boundary A system that already handles the session has nothing to gain from it. The maintainer states that importing it there causes no issue and simply sets the flag twice.
ABAP transaction generating an MVC-style project from a template
No published releases; repository quiet for 48 months.
Git client written in ABAP that runs inside the system
Git server implemented in ABAP for abapGit clients
ABAP library for creating Graphviz graphs
No published releases; repository quiet for 72 months.
Cloud-compatible plugin for the abapify Fetch API polyfill
No published releases; repository quiet for 26 months.
Legacy-release Fetch API implementation for outbound HTTP in ABAP
Promise and async/await implementation for ABAP
No published releases; repository quiet for 36 months.
MCP connector for ECC and on-premise S/4HANA with a licensed SAP side
Commercial Its maker offers it commercially.
Functional boundary The MIT licence covers the connector only: connecting to SAP needs a licensed ABAPilot backend installed in your system, so this is a commercial decision wearing an open-source badge on one half. Its own published checks did not cover writes, activation, transports or authorisation boundaries.
Static analysis for ABAP source outside a system
Shows abaplint results inside abapGit
ABAP client surfacing abaplint checks in Code Inspector and ATC
Renders Mermaid diagrams inside an SAP GUI container
HTTP NTLM client for ABAP
Open-source rule pack for SAP Code Inspector and ATC
Framework for running ABAP work units in parallel tasks
Quiet No published releases; repository quiet for 57 months.
Functional boundary The maintainer states the current state has never been used in real-world scenarios: the demo reports in package ZAPS_DEMO and the unit tests are the only runs reported, and the release table marks SAP_BASIS 740 unclear, 754 as the release it was developed on, and 750 to 756 as expected to work.
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
Class-based wrapper around STRUST certificate management
Command-line ABAP pretty printer over ADT
No published releases; repository quiet for 45 months.
ABAP MCP server over ADT with a local journal that can undo writes
A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.
Shows a whole ABAP object as it stood at a past version
No published releases; repository quiet for 38 months.
SAP GUI transaction for one-click transports of copies
Refreshes the where-used list for objects in one package
SAP GUI tool for static analysis of ABAP call flow and code metrics
VS Code extension automating ActiveControl transport forms
Backend exposing ABAP Unit runs and coverage over REST and OData
Release and repository quiet for 37 months.
RFC-callable ABAP API for SAP data extraction for ADELE
No published releases; repository quiet for 73 months.
Usage, error and response-time monitor for abap2UI5
It sees [abap2UI5](artifact:abap2ui5-abap2ui5) only: the figures come from the framework's HTTP handler, its monitor hook and its draft table, so nothing outside abap2UI5 appears in them. The usage, error and performance tabs stay empty until the handler line is in place or the user exit sets `check_monitor_active`. Recording which employee used which application, when and how fast, is subject to works council co-determination in Germany (§ 87 (1) no. 6 BetrVG); user tracking is `HASH` by default, `NAME` stores user names, and the request recorder keeps the complete request and response of every roundtrip for two days by default.
ABAP navigation tasks and a grader for coding agents
ABAP classes sending push notifications to Mobile Services
No published releases; repository quiet for 54 months.
SAP AI Core APIs as MCP tools from one JSON config file
Configuration over an API you must already have entitled and provisioned; and the smallest of these repositories, so what it covers is what its config file happens to name.
Go MCP server that writes, activates and runs ABAP classes via ADT
Not reachable Not reachable since 2026-10-20.
Functional boundary `run_class` executes code in your system — that is the point and it is also the risk.
JSON parser and serialiser for ABAP with a node tree
ABAP class wrapping SALV to set column properties in one call
No published releases; repository quiet for 79 months.
Utility for update task database changes and internal tables in ABAP
MCP server over the ADT REST API for ABAP objects
Twenty-two agent skills shipped with arc-1
Every skill that touches ABAP needs [arc-1](artifact:arc-mcp-arc-1) itself connected to a real system; nothing else is universal. `modernize-ui5-app` and `convert-ui5-to-fiori-elements` specifically need [the UI5 MCP server](artifact:ui5-mcp-server) for TypeScript conversion guidance and the linter, `convert-ui5-to-fiori-elements` also needs [the Fiori MCP server](artifact:sap-ux-fiori-mcp-server) for its LROP scaffold, and `modernize-ui5-app` needs a browser MCP (Claude in Chrome or Claude's own Preview) for its final render-verification step, since an HTTP 200 alone does not catch a blank page. A skill file alone, without the servers a given skill needs, has nothing to act on.
arc-1 extension for reading and maintaining BOPF enhancements
Classic BOPF only: business objects of the ABAP Programming Model for SAP Fiori are not handled, and on [the BTP ABAP environment](artifact:btp-abap-environment) or S/4HANA Public Cloud classic BOPF enhancements do not exist. It is version 0.1.0, verified on S/4HANA 2025 (SAP_BASIS 816) on-premise only, and [arc-1](artifact:arc-mcp-arc-1) still marks the plugin API it is built on as experimental. ARC-1 loads no extensions on its multi-target routes and offers none of these tools in its `hyperfocused` tool mode.
Edition of ARC-1 that runs ADT calls through adt-ls
Single-tenant today, one technical user, with per-user principal propagation on the roadmap — so a shared deployment cannot yet act as the developer who asked. The sibling edition [ARC-1](artifact:arc-mcp-arc-1) speaks ADT directly if you would rather not depend on the language server.
MCP server drawing BTP solution diagrams on a draw.io canvas
Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.
Hub on SAP BTP putting several arc-1 instances behind one login
Archived The declared repository is archived.
Functional boundary With one SAP system the README says to point the client at that arc-1 directly. Version 1 exchanges tokens within a single subaccount, so backends spread across subaccounts are out; it keeps its session map in memory, so more than one instance needs sticky sessions or a shared store. It routes deterministically and runs no model, which is a different thing from an assistant that reasons across systems. The `/all` endpoint drops the per-connection isolation, and the maintainer's answer to that is a PROD backend set read-only at the SAP end rather than a tool surface that hides the writes.
VS Code bridge between arc-1 and ADT for VS Code
The diff holds only while the object is inactive, since after activation the previous version is gone and a watched journal directory is what the maintainer points to instead. It adds no write path of its own: the IDE writes through SAP's extension, and the README states arc-1 can stay on `SAP_ALLOW_WRITES=false`. DDIC metadata files are skipped, because SAP's own stub for them says they are not supported in ABAP development tools for VS Code.
Eclipse add-on enabling the ADT MCP server with read-only tools
It lives inside Eclipse and inherits everything that implies — the session is a developer's, not a pipeline's. And it is version-bound: ADT 3.60 or newer for 0.5.1, with 0.3.x the path for ADT 3.58 and 3.59.
Fluent assertion helper for ABAP Unit tests
Groups npm audit findings by root dependency, with failing thresholds
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
SAP GUI version explorer and code reviewer for transport requests
Web service client and connector layer for calling out of ABAP
Quiet No published releases; repository quiet for 28 months.
Functional boundary The maintainer records SSL as a known issue: an SAP Basis problem in older systems that depends on the remote certificate, so a system that cannot carry the remote certificate chain will not complete the call. It is published as free to use at your own risk, with no support statement behind it.
Babel transformer from modern ES or TypeScript to UI5 module syntax
Carries home-directory dotfiles from one BAS dev space to another
The exported file list is hard-coded, so a dev space whose setup lives in files the readme does not name is not carried across; the roadmap lists making the list flexible as open work. Nothing from the BAS profile is in the zip, so a developer who wants the colour scheme, the keymaps or the installed extensions uses the BAS profile export on its own.
Eclipse plugin bringing Claude into ABAP Development Tools
Converts ABAP code metrics into Code Charta's JSON format
No published releases; repository quiet for 63 months.
Inversion-of-control container for ABAP
No published releases; repository quiet for 62 months.
Exports and imports ABAP table content as zipped JSON
Helper methods over abap2xlsx for Excel, JSON and tables
Code scanner for Web Dynpro ABAP
No published releases; repository quiet for 28 months.
Enhancement extending ECC's code scanner to more object types
Cloud Foundry V3 API on SAP BTP as MCP tools
It administers a live Cloud Foundry landscape: `Apps`, `Organizations`, `Spaces`, `ServiceInstances` and `SecurityGroups` all carry create, update and delete alongside list and get. What a caller can reach is set by the role they hold, and the three templates in `xs-security.json` are MCPViewer for read, MCPEditor for read and write, and MCPAdmin for full administrative access.
BTP Core Services as MCP tools with in-chat dashboards
It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.
MCP server for SAP BTP and Cloud Foundry acting as the logged-in user
Exposes S/4HANA or ECC OData services as MCP tools
It puts create, update and delete on business entities behind natural language. Whatever the destination's principal may change, an agent may change — and "create a new customer" is a sentence, not a form somebody signed off.
Claude plugin writing BTP solution diagrams as .drawio files
MCP server for BW/4HANA modelling objects
Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.
BDD framework turning Given/When/Then into ABAP Unit steps
No published releases; repository quiet for 40 months.
MCP server with read tools over the SAP Cloud ALM APIs
Convention-based handler layer for CAP with draft lifecycle hooks
Annotation-driven geocoding, address correction and routing for CAP
Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.
CSV seed data generated from @Mockdata annotations with Faker
Quiet Release and repository quiet for 27 months.
Functional boundary Not a test-data factory. It writes files at build time to seed a database, so it does not build fixtures inside a unit test. The declared peer range stops at cds 7 — nothing says it fails on 9, but nothing says it was tried either.
MCP server generating tools from a CAP or OData V4 service's metadata
Policy enforcement and field masking for MCP-enabled CAP apps
Fills db/data with relationally consistent CSV from a .cds schema
Utility bundle for CAP handlers: builder, roles, validation, queries
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
User details and quickview links for createdBy and modifiedBy
npx tool adding worked example files to a CAP project
Last released April 2024.
MCP server scaffolding CAP and CDS checked by cds compile
Toolkit turning a CAP service into tools for agent frameworks
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
CAP caching plugin for query results and remote service responses
When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.
Data federation for CAP via delegation, caching and replication
Scheduled READ, MAP, WRITE pipelines between CAP services
Delta deployment and migrations for CAP database adapters
Archived The declared repository is archived.
Functional boundary The repository is archived, so nothing here will move again. Fine to keep where it already runs; anything new should start from what the current cds deploy leaves open rather than from this.
Captures CAP service errors, deduplicates them and mails alerts
Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.
Stores, browses and resends messages a CAP service receives
Kafka adapter exposing topics as a CDS messaging service
Sandbox launchpad for all SAPUI5 apps in a CAP workspace
MySQL and MariaDB database adapter for CAP
The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
Fills a CDS element from a database-backed number range
PostgreSQL adapter for SAP CDS from the SAP Mentors community
The declared repository is archived.
CDS build task compiling TypeScript sources during cds build
Decorator-based routing of CAP service handlers in TypeScript
Release and repository quiet for 46 months.
CAP plugin turning DELETE into a flag on annotated entities
It changes what DELETE means for every client of the annotated projection, so anything that must actually remove a row — an erasure request, a retention job — has to go around it.
Spreadsheet upload into a CDS entity, parsed on the server
Swagger UI for a CAP service's OpenAPI definition
Zod schemas as CAP validation middleware
Generator for ALV list reports from a CDS view's field definitions
CLI generating TypeScript interfaces from a CDS model
Destination resolution and axios calls from CAP configuration
Release and repository quiet for 46 months.
CDS plugin for OData change tracking in CAP applications
ABAP MCP server with ADT tools and five authentication strategies
Built and last touched in the same week of March 2026, so the maintenance reading is what it is — the authentication work is the reason to look, and a stalled repository is the reason to read it before depending on it.
SAP Cloud Integration OData APIs as MCP tools
A thin declaration over CPI's APIs: it reaches what those APIs expose and nothing else, and it inherits whatever the tenant's own authorisations allow.
Five ABAP workflows for Claude Code on existing MCP servers
Claude Code plugin adding Custom_* tools to arc-1
Not for S/4HANA Public Cloud or [the BTP ABAP environment](artifact:btp-abap-environment), where the README states there is no `SUBMIT`, NAST or SOAP-RFC; the floor elsewhere is SAP_BASIS 7.50, the `/sap/bc/soap/rfc` service active, and an SAP user with `S_RFC` on the kit's function group as well as the authorizations for the reports and the spool. Print output is NAST messages only, so S/4 Output Management through BRF+ or APOC is outside it, and editing covers SmartForms alone, with Adobe Forms and SAPscript previewable but not editable. A report that opens a popup, calls a screen or is a dialog transaction cannot be run at all.
Reports Clean Core ATC results per system as Level A to D KPIs
Polyfill for CL_ABAP_CODEPAGE under Clean Core
Theme, CSS and CSP settings of abap2UI5 pages kept in tables
`APP_TITLE` is not applied by the exit: the `title` field was removed from `z2ui5_if_ui5_exit=>ty_s_http_config` in abap2UI5 1.145.0, so an app that wants it as its browser tab title sets it while it runs. The live theme preview runs the frontend action `THEMING` / `setTheme` and needs UI5 1.118 or later; on an older release a saved theme applies with the next page load. The code is written for ABAP 7.50 and the README states there is no downported 7.02 version, no 702 branch and no workflow that builds one.
Finder for ABAP Dictionary objects
No published releases; repository quiet for 58 months.
Coroutine framework for ABAP with awaitable results
No published releases; repository quiet for 26 months.
Python MCP server fetching sales orders from SAP's business data graph
Go MCP server over Cloud Integration packages and integration flows
Design-time only: no message monitoring, no deployment, no runtime status. That is a different server in this same section, and the two do not overlap.
HTTP client for classic on-premise ABAP and ABAP Cloud
No published releases; repository quiet for 32 months.
Thirteen custom UI5 controls for abap2UI5 apps
Needs Standard ABAP 7.50 or higher, and an abap2UI5 whose frontend reserves the resourceRoot `z2ui5_cci`: a frontend predating that rename reserves `z2ui5ccc` and cannot resolve the controls. Frontend artefacts only one company needs, such as an in-house reuse library, a corporate icon font or company CSS, are what [abap2UI5-addons/custom-controls-customer](https://github.com/abap2UI5-addons/custom-controls-customer) is for, the same mechanism under the second reserved root `z2ui5_ccc`. ExportSpreadsheet needs SAPUI5: under OpenUI5 `sap.ui.export` is missing and the button renders disabled.
Custom Table Editor editing table rows in an editable ALV grid
Release and repository quiet for 80 months.
Fork of mcp-abap-abap-adt-api with 25 tools and session recovery
Freestyle SQL and `abap_run` mean an agent can read data and execute code, which is well past reading source. Neither is something to grant on a system where the distinction between development tooling and business data matters.
Debugger script generating a VALUE statement for a variable
No published releases; repository quiet for 57 months.
TypeScript decoder for MYSAPSSO2 logon tickets
Claude Code skills for BTP architecture diagrams in draw.io
The README tells you to fork before cloning, because Claude rewrites `references/` and `SKILL.md` in place as you use it, so a clone shared between people changes under all of them. Installing means `git` and `ln` on macOS or Linux and a symlink into `~/.claude/skills`. Fine positioning stays manual: the coordinates Claude writes can be rough apart from the centre coordinates of elements joined by a straight arrow and the containment relationships.
GitHub Copilot skill writing BTP solution diagrams as draw.io XML
ABAP helper class building HTML emails from templates
Quiet No published releases; repository quiet for 52 months.
Functional boundary On an SAP S/4HANA system the maintainer points elsewhere: the README calls this solution helpful for non-S/4 systems and names SAP's own e-mail templates with CDS views as what S/4 systems have instead.
Displays the variables of ABAP short dumps
No published releases; repository quiet for 69 months.
CAP plugin joining external entities with internal tables at query
The declared repository is on SAP's internal GitHub (github.tools.sap) and is not publicly reachable, so npm is the only place to read anything about it.
PowerShell wizard installing Eclipse with ADT and plugins
Windows only, with PowerShell 7 (`pwsh`) installed; the run needs access to `download.eclipse.org`, `tools.hana.ondemand.com`, `eclipse.devepos.com` and the update site of every plugin selected, from the machine it installs on. A plugin outside the catalog is installed only after someone adds its update site and feature group id to `catalog.json`.
ABAP class implementing the Either pattern
No published releases; repository quiet for 25 months.
Static check that each exported TypeScript function has a test
It reads TypeScript exports only; a project written in plain JavaScript has no exported functions for it to extract. A call to the function name in a test file counts as tested, and a call through property access such as `.foo(` does not.
ESLint rules flagging deprecated CAP configuration
Shim running an ABAP ICF handler behind an Express 4.x server
Generates local classes from FORM-based ABAP programs
No published releases; repository quiet for 67 months.
Uploads, downloads and imports ABAP transport requests as files
Adds a program's dependent objects to a transport request
Yeoman generator for Application Frontend config in UI5 libraries
It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.
Shows which feature branches reached which environment branch
A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.
Visual designer generating ABAP code for classic SAP GUI screens
No published releases; repository quiet for 93 months.
Regex naming rules for SAP HANA artifacts in a CAP project
Everything it checks is a name: a file name under `rootDir`, or an identifier a parser extracted from a file, so a convention that cannot be written as a regex over one name has no rule shape here. Content rules targeting `.hdbanalyticalprivilege` or `.hdbconstraint` return no results, which the README states as not yet implemented, so conventions centred on those two artifact types go unchecked.
MCP server for schema discovery and guarded SQL on SAP HANA
This is the database, not an application in front of it, so what an agent can read is whatever the connection user can read — the guardrails bound the shape of a query, not the sensitivity of what it returns. Grant the connection the rights you would grant a person.
Single-file Handlebars templating for ABAP 7.40 SP02 and up
Read-only SAP GUI report listing where HCM object data is stored
Forwards abap2UI5 roundtrips to another system over HTTP
Stateful apps do not work through it: an app calling `client->set_session_stateful( )` needs the ICF session of the system it runs on, and the consumer opens a new HTTP connection per request without forwarding the `sap-contextid` header that addresses that session. Request headers do not cross either, and a user exit on the source system sees the path of the node `/sap/bc/z2ui5_http_srv` rather than the consumer's. For ABAP Cloud there is only the `cloud` branch, which the README describes as an unmaintained prototype from 2025-11, consumer side only and with no CI.
Read-only MCP server over a local SAP Commerce Cloud's HAC
Not for production: the README states local and development instances only, and the server refuses a HAC URL whose host is not private unless `HAC_ALLOW_REMOTE=true` overrides that guard. Masking applies to `config_get` only, so `logs_tail` and `monitoring_info` output, thread dumps included, is unmasked and may carry sensitive data, and whatever a tool returns goes to the MCP client and its model. Certificate checks are disabled whenever `HAC_INSECURE_TLS=true` is set, which the README names as typical for local HAC.
MQTT 3.1.1 client implemented in ABAP
No published releases; repository quiet for 68 months.
Jest environment running UI5 unit tests in Node.js
MCP server for SAP GUI for Windows via the Scripting API
Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. Windows only. The HTTP transport is meant for team use but binds to localhost, and unattended multi-user operation is listed as not yet available — a limitation and also the safer default.
Puts a number from an abap2UI5 app on a Fiori launchpad tile
There is nothing here for ABAP for Cloud: the requirements name Standard ABAP releases only, and a CDS/SADL based OData service for `ABAP for Cloud` compatibility stands under Limitations & Todo.
Table and form layouts with saved variants for abap2UI5
The layout is rendered into an [abap2UI5](artifact:abap2ui5-abap2ui5) view and its events are passed on from the app's `main` method, so there is nothing here for a UI outside an abap2UI5 app. Shared layouts stay denied until a class implementing `z2ui5_if_layo_auth` exists in the system, so an installation whose key users are to maintain shared layouts has that class and its authorization object to write first.
MCP server for reading and writing ABAP object translations
LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.
ABAP client with one interface to chat-completion LLM APIs
The declared repository is archived.
Benchmark of LLM ABAP code generation against a real SAP system
Holds SAP locks across stateless abap2UI5 roundtrips
Where the release and programming model offer durable locks, as RAP draft handling does, the README states that those solve the problem at the kernel level and the lock manager is for where that is not an option. A running handler occupies one background work process for as long as any lock is held, and only generated `ENQUEUE_*` modules can be locked.
Policy-checked MCP server for ABAP development over ADT
Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.
MCP server publishing SAP functions as tools from config tables
Not reachable Not reachable since 2026-10-20.
Functional boundary What it exposes is whatever somebody put in the configuration table, which moves the governance question inside the SAP system and out of the server — an advantage if that table is controlled and a hazard if it is not. The web management interface is a second surface to secure alongside the MCP one.