Everything in the atlas

No published releases; repository quiet for 26 months.

No published releases; repository quiet for 48 months.

Quiet Release and repository quiet for 27 months.

Functional boundary Not a test-data factory. It writes files at build time to seed a database, so it does not build fixtures inside a unit test. The declared peer range stops at cds 7 — nothing says it fails on 9, but nothing says it was tried either.

No published releases; repository quiet for 57 months.

No published releases; repository quiet for 67 months.

It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.

No published releases; repository quiet for 93 months.

On a system below ABAP 7.51, or one without a connected HANA database, the client-based mode does not run, and the server-based mode is only available where the abap-code-search-tools backend is installed in the system.

On a system where the abap-search-tools backend is not installed: the plugin lists it as a precondition, and the beta update site expects that backend's dev branch in particular.

Quiet No published releases; repository quiet for 27 months.

Functional boundary It binds to the .abap and .ABAP file extensions inside Visual Studio Code, so it does nothing for ABAP opened in another editor, or for source read from a system over ADT instead of from a file on disk.

The embedded preview needs a system that accepts basic auth: the documentation states that pure SSO or SAML without a basic-auth fallback is not supported, and points at `external` mode, which opens the app in the normal browser with the existing SAP session. On the web only the language half runs; the preview with its proxy, traffic log and screenshot, Ctrl+F3 activation, the render gate, the workspace-wide check and the MCP servers are desktop-only. The agent app tools send nothing until `abap2ui5.agent.enableAppTools` is switched on in User settings, because an event they fire runs as the configured user and changes data on the system for real.

The exported file list is hard-coded, so a dev space whose setup lives in files the readme does not name is not carried across; the roadmap lists making the list flexible as open work. Nothing from the BAS profile is in the zip, so a developer who wants the colour scheme, the keymaps or the installed extensions uses the BAS profile export on its own.

It declares a VS Code engine and binds to the .tabl.ddic file extension, so it does nothing for a table definition opened in another editor, or read from a system rather than from a file on disk.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

A descendant rather than a distinct idea: if what you need is the ADT surface itself, its ancestors are entered here too and one of them may already be in your stack.

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

Server side only, and deliberately: the author states there is no realistic way to support the SSE streaming a client needs, so there are no notifications, no `listChanged`, no `subscribe` and no logging. It is also frozen — protocol versions up to 2025-11-25 and no further, with everything after that in a separate V2 SDK, so starting here today is starting on a closed branch.

Stateless by design: with no `Mcp-Session-Id` and no SSE, notifications of any kind, `resources/subscribe` and stream-close cancellation are excluded, which the author states are protocol-level impossibilities on stateless ICF rather than gaps to be filled later within this design. ABAP Cloud is not supported and not planned, the stated reason being SAP pushing its own MCP strategy and features in BTP; the first iteration targets 7.5x classic, with 7.02 to 7.4x served from a separate generated downport repository. No authorization object and no default auth check are delivered, so a user who may call the ICF node may call every `AREA`/`SERVER` registered under it until `check_authorization` is redefined.

Commercial Its maker offers it commercially.

Functional boundary The MIT licence covers the connector only: connecting to SAP needs a licensed ABAPilot backend installed in your system, so this is a commercial decision wearing an open-source badge on one half. Its own published checks did not cover writes, activation, transports or authorisation boundaries.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.

Configuration over an API you must already have entitled and provisioned; and the smallest of these repositories, so what it covers is what its config file happens to name.

Not reachable Not reachable since 2026-10-20.

Functional boundary `run_class` executes code in your system — that is the point and it is also the risk.

Classic BOPF only: business objects of the ABAP Programming Model for SAP Fiori are not handled, and on [the BTP ABAP environment](artifact:btp-abap-environment) or S/4HANA Public Cloud classic BOPF enhancements do not exist. It is version 0.1.0, verified on S/4HANA 2025 (SAP_BASIS 816) on-premise only, and [arc-1](artifact:arc-mcp-arc-1) still marks the plugin API it is built on as experimental. ARC-1 loads no extensions on its multi-target routes and offers none of these tools in its `hyperfocused` tool mode.

Single-tenant today, one technical user, with per-user principal propagation on the roadmap — so a shared deployment cannot yet act as the developer who asked. The sibling edition [ARC-1](artifact:arc-mcp-arc-1) speaks ADT directly if you would rather not depend on the language server.

Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.

Archived The declared repository is archived.

Functional boundary With one SAP system the README says to point the client at that arc-1 directly. Version 1 exchanges tokens within a single subaccount, so backends spread across subaccounts are out; it keeps its session map in memory, so more than one instance needs sticky sessions or a shared store. It routes deterministically and runs no model, which is a different thing from an assistant that reasons across systems. The `/all` endpoint drops the per-connection isolation, and the maintainer's answer to that is a PROD backend set read-only at the SAP end rather than a tool surface that hides the writes.

It lives inside Eclipse and inherits everything that implies — the session is a developer's, not a pipeline's. And it is version-bound: ADT 3.60 or newer for 0.5.1, with 0.3.x the path for ADT 3.58 and 3.59.

It administers a live Cloud Foundry landscape: `Apps`, `Organizations`, `Spaces`, `ServiceInstances` and `SecurityGroups` all carry create, update and delete alongside list and get. What a caller can reach is set by the role they hold, and the three templates in `xs-security.json` are MCPViewer for read, MCPEditor for read and write, and MCPAdmin for full administrative access.

It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.

It puts create, update and delete on business entities behind natural language. Whatever the destination's principal may change, an agent may change — and "create a new customer" is a sentence, not a form somebody signed off.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

Built and last touched in the same week of March 2026, so the maintenance reading is what it is — the authentication work is the reason to look, and a stalled repository is the reason to read it before depending on it.

A thin declaration over CPI's APIs: it reaches what those APIs expose and nothing else, and it inherits whatever the tenant's own authorisations allow.

Design-time only: no message monitoring, no deployment, no runtime status. That is a different server in this same section, and the two do not overlap.

Freestyle SQL and `abap_run` mean an agent can read data and execute code, which is well past reading source. Neither is something to grant on a system where the distinction between development tooling and business data matters.

This is the database, not an application in front of it, so what an agent can read is whatever the connection user can read — the guardrails bound the shape of a query, not the sensitivity of what it returns. Grant the connection the rights you would grant a person.

Not for production: the README states local and development instances only, and the server refuses a HAC URL whose host is not private unless `HAC_ALLOW_REMOTE=true` overrides that guard. Masking applies to `config_get` only, so `logs_tail` and `monitoring_info` output, thread dumps included, is unmasked and may carry sensitive data, and whatever a tool returns goes to the MCP client and its model. Certificate checks are disabled whenever `HAC_INSECURE_TLS=true` is set, which the README names as typical for local HAC.

Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. Windows only. The HTTP transport is meant for team use but binds to localhost, and unattended multi-user operation is listed as not yet available — a limitation and also the safer default.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.

Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.

Not reachable Not reachable since 2026-10-20.

Functional boundary What it exposes is whatever somebody put in the configuration table, which moves the governance question inside the SAP system and out of the server — an advantage if that table is controlled and a hazard if it is not. The web management interface is a second surface to secure alongside the MCP one.

Its own README opens by calling the server experimental. It also writes: locking, editing and activating in a system an agent can reach is a permissions decision before it is a tooling one.

Every tool its README lists reads — Get and Search, nothing that writes. Locking, editing, activation and transports are the other server, [mcp-abap-abap-adt-api](artifact:mario-andreschak-mcp-abap-adt-api), and mixing the two is how you end up with two MCP servers pointed at one system.

It deploys and undeploys, and it enumerates credentials, keystores and OAuth2 configurations. Listing security material is a read, and it is still a read of the thing that protects everything else the tenant talks to.

Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. It has also not been touched since February 2025, which the maintenance reading states — the three later entries here are where the CI, the Web GUI and the testing framing went.

OData v2 only, and untouched since August 2025 — the same author's [Go port](artifact:oisee-odata-mcp-go) is where v4 support and the tool-explosion work went.

Universal mode trades discoverability for size: one generic tool is harder for a model to pick correctly than a named one, which is why it is not the default. On a small service, standard mode is the better answer.

It fronts APIs you already have; nothing here reads a system's source or model, and a config file is only as good as the entity sets somebody wrote into it. OData V2 is the query surface it names.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

It answers about the object catalogue, not about your code: nothing here reads your system, so it will tell you a table is not released and not that you used it. That check is ATC's, and this is what makes ATC's answer actionable.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

Three of its five reference corpora are not shipped: without an api.sap.com key and session cookie, a tenant bearer token and a local SAPUI5 fetch, the REST, MDO and UI5 tools return a message naming the preparation step that is missing. The HTTP transport has no authentication until `MCP_AUTH_TOKEN` is set, so anything past localhost needs that or an authenticating reverse proxy. Packing the ZIP, uploading it through Manage POD 2.0 Extensions and placing the widget in the POD Designer stay manual steps outside the agent, and the SAPUI5 fetch defaults to the SDK's newest version, which the README says is not the version a tenant runs. Node.js 22 or newer.

On ECC the S/4HANA `API_*` services that the three convenience readers default to do not exist, so each one has to be pointed at a Z service of your own or replaced by the RFC tools. `read_table` inherits `RFC_READ_TABLE`'s 512-byte row, so a wide table needs an explicit field list and some fields cannot be selected at all, and the bridge starts a Node process and a fresh logon per call, with no pooling. The audit log is one line per call that includes the call arguments, so every filter and WHERE clause sent to SAP is written to a file that then has to be handled as sensitive.

Inspection only, and it takes a host, a user and a password from the environment rather than a managed credential. PI and PO are also on their own end-of-maintenance path, which is the context any investment here sits in.

Not reachable Not reachable since 2026-10-20.

Functional boundary Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. And a UI test is slower and more brittle than the layer below it: this is for what only the screen can answer.

This is HR data — the most regulated business data most organisations hold — reached through a connection that sees whatever its principal sees. Employee records under natural-language query is a decision for whoever owns that data, not a configuration choice.

Reach is the reason to use it and the reason to be careful: reading cluster tables and spool output goes well past what a development tool is normally pointed at. Decide what an agent may reach before granting it, not after.

Read-only in practice, and the documentation is Korean; the tool names are English but the guidance around them is not.

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.

Not a way to edit Office formats: the author states that access to a file does not automatically provide native editing of Word documents, spreadsheets or PDFs, and suggests starting with text-based content such as instructions, templates and reports. Not a control point either: a prompt telling the agent to ask for confirmation or to leave a template alone needs enforceable application controls where that is a business requirement, and the host application stays responsible for the authenticated request context and tenant isolation.

Quiet Release and repository quiet for 57 months.

Functional boundary The package declares `@sap/cds` ^4.5.2 among its dependencies and pins `@sap-cloud-sdk/core` at 1.37.1, so a project on CAP 5 or later is outside the range it states.

Quiet No published releases; repository quiet for 41 months.

Functional boundary Not in a production environment yet: the maintainer puts abaK in beta, says its API can still change and more tests are needed, and asks that a non-beta release be waited for.

No published releases; repository quiet for 49 months.

No published releases; repository quiet for 32 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 28 months.

No published releases; repository quiet for 54 months.

No published releases; repository quiet for 68 months.

No published releases; repository quiet for 28 months.

Not a tool a developer runs: it is a library to build one with, and it ships no editor, command line or interface of its own. Its sample connects with a plain HTTP URL, a user and a password, so a system that does not expose the adt ICF service that way is out of reach.

No published releases; repository quiet for 58 months.