Everything in the atlas

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

Event roundtrips and visual fidelity stay with a live run: the documentation leaves those to the project's MCP server and to [abap2UI5 for VS Code](artifact:abap2ui5-vscode-extension). A class that builds view parts in helper methods without the handle idiom cannot be statically reconstructed, and the render gate is then skipped with a notice while the property gate runs on what was reconstructed. A screenshot is not a preview of the app: nothing round-trips, no event reaches ABAP, and a table filled by a SELECT photographs empty unless a mock JSON file sits beside the source.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

What adt-ls cannot do headless the maintainer puts out of scope, so a consumer that needs an ADT call the language server does not expose is back to speaking ADT itself. The README states the current runtime compatibility as verified on macOS arm64, against adt-ls 1.1.2 as the minimum and `1.1.2.202608131517` as the version tested. An Eclipse installation does not supply that runtime: SAP versions the two separately, so the VS Code extension has to be installed even where nobody opens VS Code.

It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.

Neither the package manifest nor the repository tree declares a licence.

Node below 22, or [@sap/cds](artifact:sap-cds) below 9: the package declares the first in engines and the second as a peer dependency. Any mail path other than Microsoft Graph, until a provider is written for it: graph is the only kind that sends, and basic, the kind configured by default, is the base class such a provider extends.

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

A descendant rather than a distinct idea: if what you need is the ADT surface itself, its ancestors are entered here too and one of them may already be in your stack.

Not a way to edit Office formats: the author states that access to a file does not automatically provide native editing of Word documents, spreadsheets or PDFs, and suggests starting with text-based content such as instructions, templates and reports. Not a control point either: a prompt telling the agent to ask for confirmation or to leave a template alone needs enforceable application controls where that is a business requirement, and the host application stays responsible for the authenticated request context and tenant isolation.

Reach for the original unless you know why you are not. This is a republished copy rather than a fork with a direction of its own: the README points at cap-js/notifications for the details, and nothing here says what was changed or why.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

If your tool reads the open skill standard directly, install [capire/skills](artifact:capire-skills) and skip the wrapper.

The generated files are copied or deployed into the ABAP system by hand, the fourth step of its own usage list, so nothing keeps an activated service in step with the model it was generated from. Its peer dependency is `@sap/cds` ^9.8, so it does not install into a project on an earlier CAP release.

There is no repository and no README: what the eight commands do is only readable from the compiled dist that ships in the package. Three of them — npmrc, install, project — are written for "SimpleMDG" projects rather than for CAP generally, so the reusable part is bind-local, run-local and debug. Seven releases up to July 2026. Its binding step writes the resolved VCAP_SERVICES into default-env.json in the project, where [@sap/cds-dk](artifact:sap-cds-dk) keeps only the place the credentials can be fetched from, so a project using it needs that file kept out of version control.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

Lowercase HTML tags such as `<div>` typecheck but throw: the default renderer constructs UI5 controls, and the HTML-aware renderer plugin is described as planned. `withScope` restores the previous scope on a synchronous return only, so an `await` inside its callback leaks the scope on runtimes without `AsyncLocalStorage`. A view that has to stay adaptable through UI5 flexibility has no path here yet: the project's [Devtoberfest session](content:devtoberfest-2026-ui5-views-type-safe-tsx) states that flexibility support is not built in yet.

It shows the wiring and a converted view pair, not the runtime's API surface; the directives, the plugin SPI and the binding forms are demonstrated in [@ui5-community/jsx-runtime-showcase](artifact:ui5-community-jsx-runtime-showcase) instead.

Its views are not a template for application code: every showcase view overrides `getController()` to return itself so a sample stays readable in one file, and the gotchas page says not to ship that in production, where a view keeps a separate `*.controller.ts`. Routing from a sample, an `ODataModel` v2 or v4, `sap.ui.mdc.Table`, forms and custom control authoring in TSX are absent by decision and documented as deferred.

No public repository is declared on the package, so the README is the documentation.

Written for Amazon Q Developer and Kiro, and the central deployment path is ECS Fargate — the further you are from AWS, the more of it is scaffolding you do not need. Python rather than the Node most of this group uses. Its README says the repository is no longer maintained and that the latest version of ABAP Accelerator is shared after registering with AWS for [Modernization Agents for SAP on AWS](https://github.com/aws-for-sap/Modernization-Agents-for-SAP-on-AWS).

On an [SAP BTP ABAP environment](artifact:btp-abap-environment) system only the generated code is left: DDIC creation is not supported on ABAP Cloud, because classic DDIC object creation over REST is not available there. Create DDIC is also disabled where ADT is not installed in the same Eclipse, and Insert into Editor then works with any editor implementing `ITextEditor` instead of the ABAP one.

On a system below ABAP 7.51, or one without a connected HANA database, the client-based mode does not run, and the server-based mode is only available where the abap-code-search-tools backend is installed in the system.

On a system where the abap-search-tools backend is not installed: the plugin lists it as a precondition, and the beta update site expects that backend's dev branch in particular.

Input arrives only as JSON, or as plain XML if the ABAP built-in transformation is switched on, whatever the output format is set to. Cross-site calls are limited to JSONP: the maintainer lists CORS support as planned.

Not a tool a developer runs: it is a library to build one with, and it ships no editor, command line or interface of its own. Its sample connects with a plain HTTP URL, a user and a password, so a system that does not expose the adt ICF service that way is out of reach.

A Python 3.10+ CLI, installed with pipx rather than through any SAP-provided package manager. Its own README lists what it does not do yet: where-used, syntax check and unit test runs — for those it says to reach for [ADT/Eclipse](external:eclipse) or an MCP server. First release, v0.1.0, and no standalone LICENSE file in the repository — the MIT grant is in the README and in pyproject.toml's project metadata rather than its own file.

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

Server side only, and deliberately: the author states there is no realistic way to support the SSE streaming a client needs, so there are no notifications, no `listChanged`, no `subscribe` and no logging. It is also frozen — protocol versions up to 2025-11-25 and no further, with everything after that in a separate V2 SDK, so starting here today is starting on a closed branch.

Stateless by design: with no `Mcp-Session-Id` and no SSE, notifications of any kind, `resources/subscribe` and stream-close cancellation are excluded, which the author states are protocol-level impossibilities on stateless ICF rather than gaps to be filled later within this design. ABAP Cloud is not supported and not planned, the stated reason being SAP pushing its own MCP strategy and features in BTP; the first iteration targets 7.5x classic, with 7.02 to 7.4x served from a separate generated downport repository. No authorization object and no default auth check are delivered, so a user who may call the ICF node may call every `AREA`/`SERVER` registered under it until `check_authorization` is redefined.

Not a way to run existing reports unchanged: a report is rewritten as a class, and `CALL SCREEN`, dynpro modules, batch input, `SUBMIT` and native SQL are refused by the converter rather than mapped. Not an SAP GUI in the browser either: the programming model is classic and the screens are UI5, and the README points at abap2UI5-addons/sapgui for SE16N or SM37. Output has gaps the README names — ALV cells show dates and times as the model carries them rather than in the user's format, print is a text file because ABAP Cloud has no spool, and value tables for F4 are read on premise only.

A system below ABAP 7.50: some of the classes it uses are only available from 7.50, and the maintainer states that downward compatibility to 7.40 in a single branch is currently not possible without resorting to dynamic programming.

Not a substitute for testing in a system: the README states that any class calling the database, classic BAPIs or HTTP is shimmed out and stays an on-stack ATC and ABAP Unit concern, and that an off-stack green is CI-grade provenance rather than an in-system pass. It also assumes a particular shape of project. The ABAP has to be abapGit-serialised into a Git repository, Node.js 22 or later has to be available locally and in CI, and the CI has to be GitHub Actions.

Anything below SAP S/4HANA 2023 FPS03 (ABAP 7.58), and any system not running the ABAP Cloud development model: those two are the prerequisites the README names, and it states that the framework targets ABAP Cloud exclusively.

Only on SAP S/4HANA 2023 and 2025, on premise or private cloud: [SAP S/4HANA Cloud, Public Edition](external:sap-s4hana-cloud-public-edition) and the [SAP BTP ABAP environment](artifact:btp-abap-environment) are listed as coming soon, and a 2023 system has to leave out `ZABAP_PRC_EVENTS_SE_2025`, whose event-based side effects rely on APIs released with S/4HANA 2025. Not for a system that already carries a copy, because object names are global and two versions cannot live side by side, and not for a productive system by way of the `ZABAP_PRC_DEMO*` packages, which the README states are not intended for one and whose init classes delete and rebuild their own tables on every run. While the major version is 0 the public API is not stable: minor bumps carry breaking changes with no deprecation period, so productive use means pinning a tag and reading the CHANGELOG before every upgrade.

Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.