Everything in the atlas

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

The embedded preview needs a system that accepts basic auth: the documentation states that pure SSO or SAML without a basic-auth fallback is not supported, and points at `external` mode, which opens the app in the normal browser with the existing SAP session. On the web only the language half runs; the preview with its proxy, traffic log and screenshot, Ctrl+F3 activation, the render gate, the workspace-wide check and the MCP servers are desktop-only. The agent app tools send nothing until `abap2ui5.agent.enableAppTools` is switched on in User settings, because an event they fire runs as the configured user and changes data on the system for real.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.

Configuration over an API you must already have entitled and provisioned; and the smallest of these repositories, so what it covers is what its config file happens to name.

It administers a live Cloud Foundry landscape: `Apps`, `Organizations`, `Spaces`, `ServiceInstances` and `SecurityGroups` all carry create, update and delete alongside list and get. What a caller can reach is set by the role they hold, and the three templates in `xs-security.json` are MCPViewer for read, MCPEditor for read and write, and MCPAdmin for full administrative access.

It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.

It puts create, update and delete on business entities behind natural language. Whatever the destination's principal may change, an agent may change — and "create a new customer" is a sentence, not a form somebody signed off.

A thin declaration over CPI's APIs: it reaches what those APIs expose and nothing else, and it inherits whatever the tenant's own authorisations allow.

Design-time only: no message monitoring, no deployment, no runtime status. That is a different server in this same section, and the two do not overlap.

This is the database, not an application in front of it, so what an agent can read is whatever the connection user can read — the guardrails bound the shape of a query, not the sensitivity of what it returns. Grant the connection the rights you would grant a person.

Not for production: the README states local and development instances only, and the server refuses a HAC URL whose host is not private unless `HAC_ALLOW_REMOTE=true` overrides that guard. Masking applies to `config_get` only, so `logs_tail` and `monitoring_info` output, thread dumps included, is unmasked and may carry sensitive data, and whatever a tool returns goes to the MCP client and its model. Certificate checks are disabled whenever `HAC_INSECURE_TLS=true` is set, which the README names as typical for local HAC.

It deploys and undeploys, and it enumerates credentials, keystores and OAuth2 configurations. Listing security material is a read, and it is still a read of the thing that protects everything else the tenant talks to.

Business Source License 1.1, which is source-available rather than open source: reading and evaluating are fine, and production use is restricted until the licence's change date. That is a procurement question, not a technical one, and it is the thing to settle first. Read-only also means read-only — no modelling, no loads.

OData v2 only, and untouched since August 2025 — the same author's [Go port](artifact:oisee-odata-mcp-go) is where v4 support and the tool-explosion work went.

Universal mode trades discoverability for size: one generic tool is harder for a model to pick correctly than a named one, which is why it is not the default. On a small service, standard mode is the better answer.

It fronts APIs you already have; nothing here reads a system's source or model, and a config file is only as good as the entity sets somebody wrote into it. OData V2 is the query surface it names.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

Business Source License 1.1: source-available, with production use restricted until the change date — settle that before anything technical. And the governed execution path in v0.2 does act on data, which is a different grant from the discovery the v0.1 baseline offered.

On ECC the S/4HANA `API_*` services that the three convenience readers default to do not exist, so each one has to be pointed at a Z service of your own or replaced by the RFC tools. `read_table` inherits `RFC_READ_TABLE`'s 512-byte row, so a wide table needs an explicit field list and some fields cannot be selected at all, and the bridge starts a Node process and a fresh logon per call, with no pooling. The audit log is one line per call that includes the call arguments, so every filter and WHERE clause sent to SAP is written to a file that then has to be handled as sensitive.

Inspection only, and it takes a host, a user and a password from the environment rather than a managed credential. PI and PO are also on their own end-of-maintenance path, which is the context any investment here sits in.

This is HR data — the most regulated business data most organisations hold — reached through a connection that sees whatever its principal sees. Employee records under natural-language query is a decision for whoever owns that data, not a configuration choice.

If your tool reads the open skill standard directly, install [capire/skills](artifact:capire-skills) and skip the wrapper.

The embedded preview needs a system that accepts basic auth: the documentation states that pure SSO or SAML without a basic-auth fallback is not supported, and points at `external` mode, which opens the app in the normal browser with the existing SAP session. On the web only the language half runs; the preview with its proxy, traffic log and screenshot, Ctrl+F3 activation, the render gate, the workspace-wide check and the MCP servers are desktop-only. The agent app tools send nothing until `abap2ui5.agent.enableAppTools` is switched on in User settings, because an event they fire runs as the configured user and changes data on the system for real.

Every skill that touches ABAP needs [arc-1](artifact:arc-mcp-arc-1) itself connected to a real system; nothing else is universal. `modernize-ui5-app` and `convert-ui5-to-fiori-elements` specifically need [the UI5 MCP server](artifact:ui5-mcp-server) for TypeScript conversion guidance and the linter, `convert-ui5-to-fiori-elements` also needs [the Fiori MCP server](artifact:sap-ux-fiori-mcp-server) for its LROP scaffold, and `modernize-ui5-app` needs a browser MCP (Claude in Chrome or Claude's own Preview) for its final render-verification step, since an HTTP 200 alone does not catch a blank page. A skill file alone, without the servers a given skill needs, has nothing to act on.

Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.

Not for S/4HANA Public Cloud or [the BTP ABAP environment](artifact:btp-abap-environment), where the README states there is no `SUBMIT`, NAST or SOAP-RFC; the floor elsewhere is SAP_BASIS 7.50, the `/sap/bc/soap/rfc` service active, and an SAP user with `S_RFC` on the kit's function group as well as the authorizations for the reports and the spool. Print output is NAST messages only, so S/4 Output Management through BRF+ or APOC is outside it, and editing covers SmartForms alone, with Adobe Forms and SAPscript previewable but not editable. A report that opens a popup, calls a screen or is a dialog transaction cannot be run at all.

The README tells you to fork before cloning, because Claude rewrites `references/` and `SKILL.md` in place as you use it, so a clone shared between people changes under all of them. Installing means `git` and `ln` on macOS or Linux and a symlink into `~/.claude/skills`. Fine positioning stays manual: the coordinates Claude writes can be rough apart from the centre coordinates of elements joined by a straight arrow and the containment relationships.

A requirement that needs code: the skill generates configuration and states that it says so instead of faking it. Dialog and container targets have no verified enter event, so a dashboard placed there loads only through its Refresh button. Production Processes are outside it — it wires PODs to them and does not design them.

It reaches a data warehouse, so what an agent can see is business data by definition — the SQL sanitisation and PII filtering in the server are there because of that, not instead of a decision about it. And the guidance is Datasphere-shaped: nothing here transfers to a HANA Cloud database used directly.

A diagram of anything other than an SAP, BTP or on-premise landscape: the skill is tuned to the Horizon style and its 71 templates. It drafts rather than finishes, and its README budgets 15 to 30 minutes of edits in draw.io per diagram. Without Python the validator does not run.

The commands it writes stop production systems, delete data and import transports, which is why execution is deliberately somebody else's decision. BTP and cloud operations are explicitly out of scope and planned as a separate plugin.

It stops before the artifact: in the README's own words it does not generate or deploy complete iFlow artifacts, so building and shipping the integration flows themselves stays with a person and a tenant. Knowledge beside the work rather than a generator, and it reads nothing from a running tenant.

Not for a project below the 2211-jdk21.1 baseline: older releases and the JSP Accelerator are covered only as explicitly marked legacy material, so a JSP storefront or a pre-JDK-21 platform is outside what the guides are written against. Knowledge with reach only through one script — it can tell an agent what to write and, apart from `query-items.sh`, cannot let it read what a given system contains.

Three of its five reference corpora are not shipped: without an api.sap.com key and session cookie, a tenant bearer token and a local SAPUI5 fetch, the REST, MDO and UI5 tools return a message naming the preparation step that is missing. The HTTP transport has no authentication until `MCP_AUTH_TOKEN` is set, so anything past localhost needs that or an authenticating reverse proxy. Packing the ZIP, uploading it through Manage POD 2.0 Extensions and placing the widget in the POD Designer stay manual steps outside the agent, and the SAPUI5 fetch defaults to the SDK's newest version, which the README says is not the version a tenant runs. Node.js 22 or newer.

Its README calls it early-stage — the core workflows run end-to-end against real systems and packaging, documentation and polish are stated as still evolving. A Rust binary rather than an npm install, so the platform build matters.

It is a plugin for one server — its own — so it is a stack rather than a component. And the guard is only as good as the profile labels: a production system registered as `DEV` is a production system with the safety off.

Not a way to edit Office formats: the author states that access to a file does not automatically provide native editing of Word documents, spreadsheets or PDFs, and suggests starting with text-based content such as instructions, templates and reports. Not a control point either: a prompt telling the agent to ask for confirmation or to leave a template alone needs enforceable application controls where that is a business requirement, and the host application stays responsible for the authenticated request context and tenant isolation.

No published releases; repository quiet for 28 months.

Stateful apps cannot be operated: a stateful session lives in one HTTP request and an MCP call is one request, so `app_start` refuses them. The repository carries no release yet and states the addon has not been run in production use, the 7.02 downport is lint-only with no 7.02 system having run it, and the ABAP Cloud HTTP service setup is written down but still to verify on your own system.

The declared repository is archived.

No published releases; repository quiet for 29 months.

An early alpha release whose README says to pin the version and test recipes against non-production data first. HANA synchronisation is snapshot-only and does not reconcile deleted rows, so a document for a row deleted in the source stays in the index. A recipe's field allow-list does not decide what the service account may read: the README states that field allow-listing does not replace SAP authorization, and that the package infers no SAP module semantics, authorization scope or safe fields from table names. Only Business Partner has a built-in recipe, every other dataset needs a `KnowledgeRecipe` written for it, and [Qdrant](external:qdrant) local mode is stated to be for development and smaller indexes.

Archived The declared repository is archived.

Functional boundary With one SAP system the README says to point the client at that arc-1 directly. Version 1 exchanges tokens within a single subaccount, so backends spread across subaccounts are out; it keeps its session map in memory, so more than one instance needs sticky sessions or a shared store. It routes deterministically and runs no model, which is a different thing from an assistant that reasons across systems. The `/all` endpoint drops the per-connection isolation, and the maintainer's answer to that is a PROD backend set read-only at the SAP end rather than a tool surface that hides the writes.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

Development and sandbox systems only: the README warns against pointing it at production. Transport release is never executed, since the tool exists to show the policy stopping it, and separation of duties is checked against the `identity.approvers` list in the policy file rather than against SAP authorisations, so it holds as far as that file does and no further. The write path has been tested with ABAP classes and other object types may need adjustments, there is deliberately no tool that creates or deletes an object, and one server instance serves one SAP system.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

It says so itself, in bold, and the atlas repeats it: not legal advice and not a compliance decision. Only SAP, your contract, or SAP support can answer bindingly, and the skill routes legal, commercial and roadmap questions there rather than guessing at them. Treat the output as evidence gathered, not as a verdict.

It is a plugin for one server — its own — so it is a stack rather than a component. And the guard is only as good as the profile labels: a production system registered as `DEV` is a production system with the safety off.

It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.

No published releases; repository quiet for 68 months.

No published releases; repository quiet for 58 months.

Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.

It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.

Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.

Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.

No published releases; repository quiet for 40 months.

No published releases; repository quiet for 54 months.

It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.

Quiet Release and repository quiet for 30 months.

Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

Not a way to run existing reports unchanged: a report is rewritten as a class, and `CALL SCREEN`, dynpro modules, batch input, `SUBMIT` and native SQL are refused by the converter rather than mapped. Not an SAP GUI in the browser either: the programming model is classic and the screens are UI5, and the README points at abap2UI5-addons/sapgui for SE16N or SM37. Output has gaps the README names — ALV cells show dates and times as the model carries them rather than in the user's format, print is a text file because ABAP Cloud has no spool, and value tables for F4 are read on premise only.

There is nothing to clone here: "Access is provided through a registration page. Once registered, you will receive access to the GitHub repository containing the agents, deployment guides, and documentation", and that repository answers 404 to anyone who has not registered, so neither the agent code nor the deployment guides can be read before the form is filled in. AWS states the agents are published as an unsupported solution, with customers responsible for testing and securing the code before deploying in production, and that they are intended for non-production SAP environments rather than production systems. The documentation link in the README is still a placeholder.

It answers about the object catalogue, not about your code: nothing here reads your system, so it will tell you a table is not released and not that you used it. That check is ATC's, and this is what makes ATC's answer actionable.

It administers a real account through Core Services, so what it can change is what the caller can change. And the UI half depends on hosts that render mcp-ui or MCP Apps resources; elsewhere those five tools return markup nobody displays.

A Python 3.10+ CLI, installed with pipx rather than through any SAP-provided package manager. Its own README lists what it does not do yet: where-used, syntax check and unit test runs — for those it says to reach for [ADT/Eclipse](external:eclipse) or an MCP server. First release, v0.1.0, and no standalone LICENSE file in the repository — the MIT grant is in the README and in pyproject.toml's project metadata rather than its own file.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

No published releases; repository quiet for 42 months.

Quiet No published releases; repository quiet for 41 months.

Functional boundary Not in a production environment yet: the maintainer puts abaK in beta, says its API can still change and more tests are needed, and asks that a non-beta release be waited for.

No published releases; repository quiet for 33 months.

`APP_TITLE` is not applied by the exit: the `title` field was removed from `z2ui5_if_ui5_exit=>ty_s_http_config` in abap2UI5 1.145.0, so an app that wants it as its browser tab title sets it while it runs. The live theme preview runs the frontend action `THEMING` / `setTheme` and needs UI5 1.118 or later; on an older release a saved theme applies with the next page load. The code is written for ABAP 7.50 and the README states there is no downported 7.02 version, no 702 branch and no workflow that builds one.

Anything below SAP S/4HANA 2023 FPS03 (ABAP 7.58), and any system not running the ABAP Cloud development model: those two are the prerequisites the README names, and it states that the framework targets ABAP Cloud exclusively.