Everything in the atlas

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas separately excludes CAP wrappers around those APIs from its assessed scope. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement.

Not reachable Not reachable since 2026-10-20.

Functional boundary What it exposes is whatever somebody put in the configuration table, which moves the governance question inside the SAP system and out of the server — an advantage if that table is controlled and a hazard if it is not. The web management interface is a second surface to secure alongside the MCP one.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

Reach is the reason to use it and the reason to be careful: reading cluster tables and spool output goes well past what a development tool is normally pointed at. Decide what an agent may reach before granting it, not after.

Universal mode trades discoverability for size: one generic tool is harder for a model to pick correctly than a named one, which is why it is not the default. On a small service, standard mode is the better answer.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

On ECC the S/4HANA `API_*` services that the three convenience readers default to do not exist, so each one has to be pointed at a Z service of your own or replaced by the RFC tools. `read_table` inherits `RFC_READ_TABLE`'s 512-byte row, so a wide table needs an explicit field list and some fields cannot be selected at all, and the bridge starts a Node process and a fresh logon per call, with no pooling. The audit log is one line per call that includes the call arguments, so every filter and WHERE clause sent to SAP is written to a file that then has to be handled as sensitive.

Real SAP calls need the proprietary [SAP NetWeaver RFC SDK](external:sap-nw-rfc-sdk) and the `pyrfc==3.3.1` release the README calls archived and yanked, on Python 3.11, so without those only the demo backend answers. Not over HTTP as it stands: credentials are read from the environment for stdio, and the README says not to expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting. Multi-tenant auth and RBAC beyond the one server-wide policy, rate limiting, metrics and tracing, and deployment packaging are listed as not built. The result limits protect the client and not the system, since the README states they cannot reduce work already performed inside SAP, and the MCP tool annotations that describe read and write risk are advisory metadata rather than an authorisation boundary, so the service account's `S_RFC` and table authorisations are still what decides.

Driving the GUI reaches whatever a user can reach, which is business data and not a development surface. Decide what an agent may do in a session before granting one, not after. Windows only. The HTTP transport is meant for team use but binds to localhost, and unattended multi-user operation is listed as not yet available — a limitation and also the safer default.