Everything in the atlas

Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.

Not an end-user app: it reads from any table the user names and writes into tables of the Z/Y namespace, with no authorisation check of its own, so the README asks a project to add its own checks on `S_TABU_DIS`/`S_TABU_NAM` and to restrict who may run it before it is used beyond a development system. XLSX upload and download are not ready for ABAP Cloud yet, and of the upload apps only the JSON one writes the file's rows back to the database.

It sees [abap2UI5](artifact:abap2ui5-abap2ui5) only: the figures come from the framework's HTTP handler, its monitor hook and its draft table, so nothing outside abap2UI5 appears in them. The usage, error and performance tabs stay empty until the handler line is in place or the user exit sets `check_monitor_active`. Recording which employee used which application, when and how fast, is subject to works council co-determination in Germany (§ 87 (1) no. 6 BetrVG); user tracking is `HASH` by default, `NAME` stores user names, and the request recorder keeps the complete request and response of every roundtrip for two days by default.

`APP_TITLE` is not applied by the exit: the `title` field was removed from `z2ui5_if_ui5_exit=>ty_s_http_config` in abap2UI5 1.145.0, so an app that wants it as its browser tab title sets it while it runs. The live theme preview runs the frontend action `THEMING` / `setTheme` and needs UI5 1.118 or later; on an older release a saved theme applies with the next page load. The code is written for ABAP 7.50 and the README states there is no downported 7.02 version, no 702 branch and no workflow that builds one.

Stateful apps do not work through it: an app calling `client->set_session_stateful( )` needs the ICF session of the system it runs on, and the consumer opens a new HTTP connection per request without forwarding the `sap-contextid` header that addresses that session. Request headers do not cross either, and a user exit on the source system sees the path of the node `/sap/bc/z2ui5_http_srv` rather than the consumer's. For ABAP Cloud there is only the `cloud` branch, which the README describes as an unmaintained prototype from 2025-11, consumer side only and with no CI.

There is nothing to clone here: "Access is provided through a registration page. Once registered, you will receive access to the GitHub repository containing the agents, deployment guides, and documentation", and that repository answers 404 to anyone who has not registered, so neither the agent code nor the deployment guides can be read before the form is filled in. AWS states the agents are published as an unsupported solution, with customers responsible for testing and securing the code before deploying in production, and that they are intended for non-production SAP environments rather than production systems. The documentation link in the README is still a placeholder.

Not a system to run a business application on: there is no business application in it, and what it implements of the language, the dictionary and Gateway is a stated subset of each. It is a clean-room reimplementation of the `/IWBEP/` interfaces that bundles no SAP source and no standard DDIC, so a service that reads standard objects has nothing to read, and `ANORMALIES.md` records every place the runtime differs from SAP before any workaround is written.

For an app that calls `client->set_session_stateful( )`, which needs the ICF session of the system it runs on; apps keeping their state in the draft table, the abap2UI5 default, work unchanged. For an app that reads a request header through the user exit on the source system, because the consumer forwards method, body, path, query string and status, not headers.

Not on ABAP Cloud: the system tables and the classic Workbench APIs the screens use are not released for the ABAP Cloud language version, and there is no 7.02 version below the 7.50 floor either. Not where the full original function is needed, since only the listed transactions exist and about 300 buttons and fields are shown disabled. The authorization checks are rebuilt rather than the originals, which is why the README asks that the screens be tried with a restricted user on a sandbox before the ICF service is opened to more people.

Not as it stands on a system past development: it reads the contents of any table the user names without an authorisation check of its own, so access is bounded only by whatever restrictions exist on the underlying handler or service. The README asks for your own checks first, naming `AUTHORITY-CHECK` on `S_TABU_DIS`/`S_TABU_NAM`, and for a restriction on who may run the app. There is no 7.02 downport either, because the selection-screen dependency has no `702` branch.

It runs whatever SQL a user types without an authorisation check of its own, and the native path additionally uses ADBC, which bypasses ABAP authorisations and client separation; the README asks anyone running it beyond a development system to add authorisation checks and restrict who may start the app. The native console needs Standard ABAP, so on ABAP Cloud only the Open SQL console is available.

The app writes to whatever table is passed in the URL parameter `table` and carries no authorisation check of its own, so past a development system it needs authorisation checks added and a restriction on who may run it.

The generated files are copied or deployed into the ABAP system by hand, the fourth step of its own usage list, so nothing keeps an activated service in step with the model it was generated from. Its peer dependency is `@sap/cds` ^9.8, so it does not install into a project on an earlier CAP release.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.

Reach for the original unless you know why you are not. This is a republished copy rather than a fork with a direction of its own: the README points at cap-js/notifications for the details, and nothing here says what was changed or why.

For a deployed application's UI. The README adds it with `npm add cds-plugin-ui5 -D`, a development dependency of the CDS server, and states nothing about a build or a deployment.

Event roundtrips and visual fidelity stay with a live run: the documentation leaves those to the project's MCP server and to [abap2UI5 for VS Code](artifact:abap2ui5-vscode-extension). A class that builds view parts in helper methods without the handle idiom cannot be statically reconstructed, and the render gate is then skipped with a notice while the property gate runs on what was reconstructed. A screenshot is not a preview of the app: nothing round-trips, no event reaches ABAP, and a table filled by a SELECT photographs empty unless a mock JSON file sits beside the source.

There is no repository and no README: what the eight commands do is only readable from the compiled dist that ships in the package. Three of them — npmrc, install, project — are written for "SimpleMDG" projects rather than for CAP generally, so the reusable part is bind-local, run-local and debug. Seven releases up to July 2026. Its binding step writes the resolved VCAP_SERVICES into default-env.json in the project, where [@sap/cds-dk](artifact:sap-cds-dk) keeps only the place the credentials can be fetched from, so a project using it needs that file kept out of version control.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

Windows only, with PowerShell 7 (`pwsh`) installed; the run needs access to `download.eclipse.org`, `tools.hana.ondemand.com`, `eclipse.devepos.com` and the update site of every plugin selected, from the machine it installs on. A plugin outside the catalog is installed only after someone adds its update site and feature group id to `catalog.json`.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

Its README calls it early-stage — the core workflows run end-to-end against real systems and packaging, documentation and polish are stated as still evolving. A Rust binary rather than an npm install, so the platform build matters.

The embedded preview needs a system that accepts basic auth: the documentation states that pure SSO or SAML without a basic-auth fallback is not supported, and points at `external` mode, which opens the app in the normal browser with the existing SAP session. On the web only the language half runs; the preview with its proxy, traffic log and screenshot, Ctrl+F3 activation, the render gate, the workspace-wide check and the MCP servers are desktop-only. The agent app tools send nothing until `abap2ui5.agent.enableAppTools` is switched on in User settings, because an event they fire runs as the configured user and changes data on the system for real.

An Eclipse installation older than the 2026-03 release, or a Java below 21, cannot take it: both are listed prerequisites, and 2026-03 is named as the oldest release the current ADT installs on. The tenant, region, client ID and client secret are entered per installation in Eclipse preferences, so each developer configures the Cloud ALM connection in their own IDE.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

A descendant rather than a distinct idea: if what you need is the ADT surface itself, its ancestors are entered here too and one of them may already be in your stack.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Written for Amazon Q Developer and Kiro, and the central deployment path is ECS Fargate — the further you are from AWS, the more of it is scaffolding you do not need. Python rather than the Node most of this group uses. Its README says the repository is no longer maintained and that the latest version of ABAP Accelerator is shared after registering with AWS for [Modernization Agents for SAP on AWS](https://github.com/aws-for-sap/Modernization-Agents-for-SAP-on-AWS).

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.

Classic BOPF only: business objects of the ABAP Programming Model for SAP Fiori are not handled, and on [the BTP ABAP environment](artifact:btp-abap-environment) or S/4HANA Public Cloud classic BOPF enhancements do not exist. It is version 0.1.0, verified on S/4HANA 2025 (SAP_BASIS 816) on-premise only, and [arc-1](artifact:arc-mcp-arc-1) still marks the plugin API it is built on as experimental. ARC-1 loads no extensions on its multi-target routes and offers none of these tools in its `hyperfocused` tool mode.

Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.

Archived The declared repository is archived.

Functional boundary With one SAP system the README says to point the client at that arc-1 directly. Version 1 exchanges tokens within a single subaccount, so backends spread across subaccounts are out; it keeps its session map in memory, so more than one instance needs sticky sessions or a shared store. It routes deterministically and runs no model, which is a different thing from an assistant that reasons across systems. The `/all` endpoint drops the per-connection isolation, and the maintainer's answer to that is a PROD backend set read-only at the SAP end rather than a tool surface that hides the writes.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

Freestyle SQL and `abap_run` mean an agent can read data and execute code, which is well past reading source. Neither is something to grant on a system where the distinction between development tooling and business data matters.

A compiled binary rather than an npm package, shipped prebuilt per platform and through pip and uvx. It collects anonymous usage telemetry by default, switched off with `--no-telemetry` or `DATAZOO_DISABLE_TELEMETRY=1`. And the BW reach is what distinguishes it — if the work is plain ABAP, that half is weight you are not using.

Two licences, by which package you install: the standalone server, `@mcp-abap-adt/core`, is AGPL-3.0-only, a licence to read before shipping anything built around it; the library, `@mcp-abap-adt/lib`, is Apache-2.0. The destination model also expects service keys sitting in a local directory, which is a secrets decision to make deliberately.

This is the database, not an application in front of it, so what an agent can read is whatever the connection user can read — the guardrails bound the shape of a query, not the sensitivity of what it returns. Grant the connection the rights you would grant a person.

Not for production: the README states local and development instances only, and the server refuses a HAC URL whose host is not private unless `HAC_ALLOW_REMOTE=true` overrides that guard. Masking applies to `config_get` only, so `logs_tail` and `monitoring_info` output, thread dumps included, is unmasked and may carry sensitive data, and whatever a tool returns goes to the MCP client and its model. Certificate checks are disabled whenever `HAC_INSECURE_TLS=true` is set, which the README names as typical for local HAC.

Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. Windows only. The HTTP transport is meant for team use but binds to localhost, and unattended multi-user operation is listed as not yet available — a limitation and also the safer default.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.

Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.