onedevatlasBeta
Browse the atlas
AllSAP SuccessFactorsCAPUI5ABAPBTP
MCP serverMCP servertypeExposes tools to a coding agent over MCP.See every one →What this type is →independently maintainedindependently maintainedoriginPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →

SF-MCP

Sixty-two purpose-built tools over SAP SuccessFactors' OData APIs — employee data, permissions, compliance reports and HR administration, asked for in plain language.

SuccessFactors' OData surface is large and building a query against it needs real product knowledge, so this replaces that with tools shaped around what somebody actually asks: who has a work anniversary this month, who holds which permission, what a compliance report says. The trade is deliberate and stated — sixty-two curated interfaces instead of one generic OData bridge, which is the opposite bet from the OData servers elsewhere in the corpus.

GitHub13 ★

Facts

Last pushLicenceMIT

Where it sits

Lives in
SAP SuccessFactors
Provides
Agent access to your systemsSAP SuccessFactorsAgent access to your systemscapabilityGiving an AI agent access to the business data, configuration or operations of systems you run through an MCP server. [Serving your application over MCP](capability:mcp-servers) exposes your own service contract; system access reaches the systems behind it, and one implementation may do both. Development assistance belongs to [agent access to your code](capability:agent-code-access).

Who is behind it

aiadiguru2025aiadiguru2025PersonMaintains this
In the atlas: maintains 1, contributes to 1@aiadiguru2025maintainerShakti BarathPersonContributes to this
In the atlas: contributes to 1@shaktibarath1 contributor

Before choosing this

Conditions

PracticalFunctional boundary

This is HR data — the most regulated business data most organisations hold — reached through a connection that sees whatever its principal sees. Employee records under natural-language query is a decision for whoever owns that data, not a configuration choice.

PolicySAP API Policy 4.2026a§ 1.1, 1.2, 2.2.2from Agent access to your systemsAn MCP server uses SAP APIs to supply tools, resources or data to an agent.
  • § 1.1 Published APIs. Published APIs are made available for the documented purposes identified by SAP, including integration, extensions and data exchange.
  • § 1.2 Non-Published APIs. Customer and third-party applications must not access non-published APIs except where documentation permits it or SAP otherwise authorizes it.
  • § 2.2.2 AI call sequences and data extraction. Outside SAP-endorsed architectures, data services or expressly identified pathways, the policy prohibits specified agentic API use and systematic or large-scale extraction.

MCP does not replace the API's documented-use boundary. Check that every endpoint is published for the intended use and whether the policy's AI-call or extraction provisions apply to the design.

SAP API Policy 4.2026a →

What it declares

Every artifact

Type
MCP server
Origin
Independently maintained

Connections2

Architecture

Download
Where SF-MCP runsSAP cloudBy its type: an MCP server is called by an MCP clientcallsdocumentedoutboundYour MCP client, actorYour MCP clientSF-MCP, moduleSF-MCPSAP SuccessFactors, SAP solutionSAP SuccessFactorsSAP solution
SAPnot SAP's, or the project's ownstated in the documentdocumented only

README

quoted from aiadiguru2025/sf-mcp under MIT, read
aiadiguru2025/sf-mcp/README.mdOn GitHub

SuccessFactors-MCP

SAP SuccessFactors Model Context Protocol Server

Installation · Quick Start · 62 Tools · Deployment · API Reference

Version Python License MCP

A production-grade Model Context Protocol server that connects Claude (or any MCP client) to SAP SuccessFactors via OData APIs. Query employee data, manage permissions, run compliance reports, and administer HR operations — all through natural language.

You: "Who on the Engineering team has a work anniversary this month?"

Claude: [calls get_anniversary_employees] Found 3 upcoming anniversaries...
         - Jane Smith (5 years - milestone!) - March 12
         - Bob Johnson (2 years) - March 18
         - Alice Chen (10 years - milestone!) - March 25

Why SF-MCP?

ChallengeSF-MCP Solution
SAP SuccessFactors APIs are complex and verbose62 purpose-built tools with clean interfaces
Building OData queries requires deep SF knowledgeNatural language — ask Claude in plain English
Security concerns with API accessPer-request auth, input validation, audit logging
Managing multiple SF instances21 data centers supported, cross-instance comparison
API rate limits and performanceConnection pooling, response caching, rate limiting

Tools

62 tools organized across 16 categories:

Configuration & Discovery (3 tools)
ToolDescription
get_configurationRetrieve OData metadata for any entity
list_entitiesDiscover all available OData entities
compare_configurationsCompare entity config between two instances
RBP Security (7 tools)
ToolDescription
get_rbp_rolesList all Role-Based Permission roles
get_role_permissionsGet permissions for specific roles
get_user_permissionsGet all permissions for a user
get_user_rolesGet roles assigned to a user
get_permission_metadataMap UI labels to permission types
check_user_permissionCheck if user has specific permission
get_dynamic_groupsList permission groups (dynamic groups)
Security & Audit (6 tools)
ToolDescription
get_role_historyView modification history for roles
get_role_assignment_historyView history of role assignments
get_login_audit_logLogin events — who logged in, when, from where
get_admin_audit_logAdmin-level config/data change history
get_sod_violationsDetect segregation-of-duty conflicts in RBP assignments
get_dormant_usersActive accounts with no recent login activity
Data Query (2 tools)
ToolDescription
query_odataFlexible OData queries with filtering, pagination
get_picklist_valuesGet dropdown/picklist options
Employee Lookup (4 tools)
ToolDescription
get_employee_profileComplete profile with job info, manager, optional compensation
search_employeesFind by name, department, location, or manager
get_employee_historyJob history — promotions, transfers, title changes
get_team_rosterManager's team with direct/indirect reports
Time Off (3 tools)
ToolDescription
get_time_off_balancesVacation, PTO, sick leave balances
get_upcoming_time_offTeam absence calendar for a date range
get_time_off_requestsPending/approved time-off requests
Hiring & Onboarding (3 tools)
ToolDescription
get_open_requisitionsJob requisitions with status and hiring manager
get_candidate_pipelineCandidates by stage for a requisition
get_new_hiresRecent/upcoming hires for onboarding
Compliance & Reporting (3 tools)
ToolDescription
get_terminationsTerminated employees for exit processing
get_employees_missing_dataIncomplete profiles for compliance audits
get_anniversary_employeesUpcoming work anniversaries for recognition
Performance & Compensation (5 tools)
ToolDescription
get_performance_review_statusReview form completion across the org
get_compensation_detailsPay breakdown with recurring/non-recurring components
get_compensation_historyFull compensation change history (not just latest)
get_compensation_review_statusComp planning worksheet completion by manager/department
get_salary_range_analysisCompa-ratio: pay vs. grade midpoint
Performance & Talent (4 tools)
ToolDescription
get_goal_summaryEmployee goals — category, weight, completion
get_development_plansDevelopment goals and learning activities
get_talent_flagsPotential, flight risk, impact of loss, key position
get_succession_nomineesTalent pool nominees for key positions
Position Management (3 tools)
ToolDescription
get_position_detailsPosition with incumbent, department, FTE
get_vacant_positionsOpen positions for headcount planning
get_org_chartOrg hierarchy from any position (up or down)
MDF Objects (3 tools)
ToolDescription
get_mdf_object_definitionsList custom MDF objects and their fields
query_mdf_objectQuery any MDF/generic object (cust_*)
get_foundation_objectsQuery foundation objects (departments, cost centers, etc.)
Workflow (2 tools)
ToolDescription
get_pending_approvalsPending workflow items for a user or globally
get_workflow_historyAudit trail of approval steps
Monitoring & Admin (6 tools)
ToolDescription
get_alert_notificationsSystem alerts and notifications
get_scheduled_job_statusScheduled job run status
get_integration_center_jobsIntegration Center job status
get_api_quota_statusRate limit usage per instance
get_cache_statusCache hit rates and entry counts
clear_cacheClear cached responses
Employee Central (5 tools)
ToolDescription
get_global_assignmentsInternational assignments — home/host details
get_employee_documentsDocuments attached to an employee's record
get_pay_component_groupsRecurring pay elements (allowances, bonuses)
get_work_permit_expiryWork permits/visas expiring soon
get_probation_end_datesEmployees approaching end of probation
Data Management (3 tools)
ToolDescription
bulk_export_employeesPaginated full export of active employees
get_picklist_usageWhich picklists are used on which entity fields
get_country_specific_fieldsField population rates for a given country

Installation

Prerequisites
  • Python 3.10+
  • uv package manager
  • SAP SuccessFactors account with API access
Setup
git clone https://github.com/aiadiguru2025/sf-mcp.git
cd sf-mcp
uv sync
Quick Start

Development mode (MCP Inspector):

uv run mcp dev main.py

Stdio mode (Claude Desktop):

uv run main.py

HTTP mode (Cloud Run / remote):

PORT=8080 uv run main.py

Claude Desktop Integration

Step 1 — Find the path to uv
# macOS / Linux
which uv

# Windows (PowerShell)
Get-Command uv | Select-Object -ExpandProperty Source
Step 2 — Edit your Claude Desktop config
OSConfig path
macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json

Add the sf-mcp server:

{
  "mcpServers": {
    "sf-mcp": {
      "command": "/path/to/uv",
      "args": ["--directory", "/path/to/sf-mcp", "run", "main.py"]
    }
  }
}
Step 3 — Restart Claude Desktop

The MCP tools icon (hammer) will appear in the input area with all 62 tools available.

Note: Credentials (auth_user_id and auth_password) are provided on each tool call — nothing is stored in the config.

Deployment

Google Cloud Run
# Build and deploy
export PROJECT_ID=your-gcp-project-id
gcloud builds submit --tag gcr.io/$PROJECT_ID/sf-mcp
gcloud run deploy sf-mcp \
  --image gcr.io/$PROJECT_ID/sf-mcp \
  --platform managed \
  --region us-central1

Then point Claude Desktop to the remote URL:

{
  "mcpServers": {
    "sf-mcp": {
      "url": "https://sf-mcp-xxxxx-uc.a.run.app/mcp"
    }
  }
}
Docker (local)
docker build -t sf-mcp .
docker run -p 8080:8080 sf-mcp
API Key Protection (optional)

Set MCP_API_KEY to require authentication on the HTTP endpoint:

MCP_API_KEY=your-secret-key PORT=8080 uv run main.py

Clients must then include X-API-Key: your-secret-key in requests.

Configuration

All tool parameters (data_center, environment, auth_user_id, auth_password) are provided per-request. Server-side environment variables are optional:

Rate Limiting
VariableDefaultDescription
SF_RATE_LIMIT100Max requests per window per instance
SF_RATE_LIMIT_WINDOW60Window duration in seconds
SF_RATE_LIMIT_WARN_THRESHOLD0.8Log warning at 80% usage
SF_RATE_LIMIT_RETRY_AFTER5Seconds to wait on 429 retry
SF_RATE_LIMIT_MAX_RETRIES3Max 429 retry attempts
Response Caching
VariableDefaultDescription
SF_CACHE_TTL_METADATA3600Metadata cache TTL (1 hour)
SF_CACHE_TTL_SERVICE_DOC3600Service doc cache TTL (1 hour)
SF_CACHE_TTL_PICKLIST1800Picklist cache TTL (30 min)
SF_CACHE_TTL_PERMISSIONS3600Permission cache TTL (1 hour)
SF_CACHE_TTL_DEFAULT0Default TTL (0 = disabled)
SF_CACHE_MAX_ENTRIES1000Max cache entries before eviction
Endpoint Protection
VariableDefaultDescription
MCP_API_KEY(none)API key for HTTP endpoint auth

Copy .env.example to .env to customize:

cp .env.example .env

Supported Data Centers

21 data centers across 6 continents with alias support:

Data CenterAliasLocationEnvironments
DC2DC57Netherlandspreview, production, sales_demo
DC4DC68Virginia, USpreview, production, sales_demo
DC8DC70Ashburn, Virginia, USpreview, production, sales_demo
DC10DC66Sydney, Australiapreview, production
DC12DC33Germanypreview, production
DC15DC30Shanghai, Chinapreview, production
DC17DC60Toronto, Canadapreview, production
DC19DC62Sao Paulo, Brazilpreview, production
DC22—Dubai, UAEpreview, production
DC23DC84Riyadh, Saudi Arabiapreview, production
DC40——sales_demo
DC41—Virginia, USpreview, production
DC44DC52Singaporepreview, production
DC47—Canada Centralpreview, production
DC50—Tokyo, Japanpreview, production
DC55—Frankfurt, Germanypreview, production
DC74—Zurich, Switzerlandpreview, production
DC80—Mumbai, Indiapreview, production
DC82—Riyadh, Saudi Arabiapreview, production

Architecture

sf-mcp/
├── main.py                     # Entry point (stdio + HTTP modes)
├── sf_mcp/
│   ├── server.py               # FastMCP instance
│   ├── config.py               # DC mappings, constants, env vars
│   ├── auth.py                 # Credential resolution, API key middleware
│   ├── client.py               # HTTP client (OData, metadata, service doc, pagination)
│   ├── cache.py                # TTL-based response cache with deep-copy safety
│   ├── rate_limiter.py         # Sliding-window rate limiter (per-instance)
│   ├── validation.py           # 10 input validators with registry pattern
│   ├── decorators.py           # sf_tool decorator (cross-cutting concerns)
│   ├── dependencies.py         # FastMCP DI for schema exclusion
│   ├── logging_config.py       # Cloud Logging JSON formatter, audit_log()
│   ├── xml_utils.py            # Safe XML parsing (defusedxml), SAP date parsing
│   └── tools/                  # 62 tools across 16 modules
│       ├── configuration.py    # get_configuration, compare_configurations, list_entities
│       ├── permissions.py      # 7 RBP security tools
│       ├── audit.py            # Role history, role assignment history
│       ├── query.py            # query_odata, get_picklist_values
│       ├── employee.py         # Profile, search, history, team roster
│       ├── time_off.py         # Balances, upcoming absences, requests
│       ├── recruiting.py       # Requisitions, pipeline, new hires
│       ├── compliance.py       # Terminations, missing data, anniversaries, reviews, comp
│       ├── position.py         # Position details, vacancies, org chart
│       ├── workflow.py         # Pending approvals, workflow history
│       ├── mdf.py              # MDF object definitions, queries, foundation objects
│       ├── monitoring.py       # Alerts, scheduled jobs, integration jobs
│       ├── admin.py            # Rate limit quota, cache status, cache clear
│       └── utils.py            # Shared utilities (display_name)
├── tests/                      # 110 tests
├── Dockerfile                  # Cloud Run container
├── .env.example                # Configuration template
└── pyproject.toml              # Project metadata, dependencies, linter config
Design Principles

Zero boilerplate — The sf_tool decorator handles request ID generation, timing, audit logging, input validation, credential checking, error handling, and $top clamping. Tool functions contain only business logic.

Secure by default — 10 input validators (regex allowlists), OData injection prevention, XXE-safe XML parsing (defusedxml), timing-safe API key comparison (hmac.compare_digest), and automatic credential masking in logs.

Production-ready — Connection pooling (requests.Session), mutation-safe response caching (deep-copy on put/get), sliding-window rate limiting with automatic 429 retry, and Cloud Logging-compatible JSON audit trail.

Schema-clean — Internal parameters (request_id, start_time, api_host) are hidden from the MCP tool schema via FastMCP's Dependency injection, keeping tool interfaces clean for LLM consumers.

Security

LayerMechanism
Input validation10 regex-based validators; OData filter blocklist checks raw + URL-decoded + double-decoded input
Injection preventionEntity paths, select,select, orderby, filter,filter, expand all validated; control characters rejected
AuthenticationPer-request credentials (never stored); timing-safe API key comparison via hmac.compare_digest
XML safetydefusedxml prevents XXE, entity expansion, and DTD attacks
Audit loggingEvery tool call logged with structured JSON; passwords automatically masked
Cache safetyDeep-copied on store and retrieval to prevent mutation bugs
Date handlingAll SAP timestamp parsing uses explicit UTC to prevent timezone inconsistencies

Testing

# Run all 110 tests
uv run pytest tests/ -v

# Run with coverage
uv run pytest tests/ --cov=sf_mcp

# Lint
uv run ruff check .

# Type check
uv run mypy sf_mcp/

Test coverage includes:

  • Config — DC mapping resolution, case insensitivity, aliases, error cases
  • Validation — All 10 validators with valid/invalid inputs, injection prevention
  • Client — Mocked HTTP responses (200, 401, 500, empty, connection error)
  • Rate limiter — Limit enforcement, sliding window, per-instance isolation, thread safety
  • Cache — Put/get, TTL expiry, category TTLs, invalidation, eviction, deep-copy safety
  • Pagination — Single/multi page, max_pages limit, error handling, $skip increments
  • Decorators — Value injection, validation errors, max_top clamping, exception handling

API Reference

Every tool accepts these common parameters:

ParameterTypeRequiredDescription
instancestringYesSuccessFactors company ID
data_centerstringYesSAP data center code (e.g., DC55, DC10)
environmentstringYespreview, production, or sales_demo
auth_user_idstringYesSuccessFactors user ID (without @instance)
auth_passwordstringYesSuccessFactors password
Configuration Tools
get_configuration

Retrieve OData metadata for a SuccessFactors entity.

ParameterTypeRequiredDescription
entitystringYesOData entity name (e.g., User, Position)
list_entities

Discover all available OData entities in an instance.

ParameterTypeRequiredDescription
categorystringNofoundation, employee, talent, platform, or all
compare_configurations

Compare entity config between two instances (e.g., dev vs prod).

ParameterTypeRequiredDescription
instance1stringYesFirst instance
instance2stringYesSecond instance
entitystringYesEntity to compare
data_center1stringYesData center for instance1
environment1stringYesEnvironment for instance1
data_center2stringYesData center for instance2
environment2stringYesEnvironment for instance2
RBP Security Tools
get_rbp_roles
ParameterTypeRequiredDescription
include_descriptionbooleanNoInclude role descriptions (default: false)
get_role_permissions
ParameterTypeRequiredDescription
role_idsstringYesSingle or comma-separated: 10 or 10,20,30
localestringNoLocale for labels (default: en-US)
get_user_permissions
ParameterTypeRequiredDescription
user_idsstringYesSingle or comma-separated: admin or admin,user2
localestringNoLocale for labels (default: en-US)
get_user_roles
ParameterTypeRequiredDescription
user_idstringYesUser ID to look up roles for
include_permissionsbooleanNoAlso fetch permissions per role (default: false)
get_permission_metadata
ParameterTypeRequiredDescription
localestringNoLocale for labels (default: en-US)
check_user_permission
ParameterTypeRequiredDescription
access_user_idstringYesUser whose permission to check
target_user_idstringYesTarget user of the permission
perm_typestringYesPermission type from metadata
perm_string_valuestringYesPermission string value
perm_long_valuestringNoPermission long value (default: -1L)
get_dynamic_groups
ParameterTypeRequiredDescription
group_typestringNoFilter by group type
Security & Audit Tools
get_role_history
ParameterTypeRequiredDescription
role_idstringNoFilter by role ID
role_namestringNoFilter by role name
from_datestringNoStart date (YYYY-MM-DD)
to_datestringNoEnd date (YYYY-MM-DD)
topintegerNoMax records (default: 100, max: 500)
get_role_assignment_history
ParameterTypeRequiredDescription
role_idstringNoFilter by role ID
user_idstringNoFilter by user ID
from_datestringNoStart date (YYYY-MM-DD)
to_datestringNoEnd date (YYYY-MM-DD)
topintegerNoMax records (default: 100, max: 500)

At least one of role_id or user_id is required.

get_login_audit_log
ParameterTypeRequiredDescription
user_idstringNoFilter to a single user's login history
from_datestringNoStart date (YYYY-MM-DD)
to_datestringNoEnd date (YYYY-MM-DD)
topintegerNoMax records (default: 100, max: 500)

Requires the instance's Audit Trail / Login Tracking feature to be provisioned.

get_admin_audit_log
ParameterTypeRequiredDescription
entity_namestringNoFilter by entity/object name (e.g., RBPRole, User)
changed_bystringNoFilter by the admin who made the change
from_datestringNoStart date (YYYY-MM-DD)
to_datestringNoEnd date (YYYY-MM-DD)
topintegerNoMax records (default: 100, max: 500)

Requires the instance's Audit Trail feature to be provisioned.

get_sod_violations
ParameterTypeRequiredDescription
user_idsstringYesEmployee user ID(s), comma-separated (max 20)
permission_pairsstringNoCustom conflict pairs: "PermA|PermB,PermC|PermD". Defaults to a built-in list of common RBP conflicts
get_dormant_users
ParameterTypeRequiredDescription
dormant_daysintegerNoFlag users with no login in this many days (default: 90)
departmentstringNoFilter by department
topintegerNoMax records (default: 100, max: 500)
Data Query Tools
query_odata
ParameterTypeRequiredDescription
entitystringYesEntity name or key: User or User('admin')
selectstringNoFields: userId,firstName,lastName
filterstringNoOData filter: status eq 'active'
expandstringNoNav properties: empInfo,jobInfoNav
topintegerNoMax records (default: 100, max: 1000)
skipintegerNoRecords to skip
orderbystringNoSort: lastName asc
paginatebooleanNoAuto-fetch all pages (default: false)
max_pagesintegerNoMax pages when paginating (default: 10, max: 50)
get_picklist_values
ParameterTypeRequiredDescription
picklist_idstringYesPicklist ID: ecJobFunction, nationality
localestringNoLocale for labels (default: en-US)
include_inactivebooleanNoInclude inactive values (default: false)
Employee Lookup Tools
get_employee_profile
ParameterTypeRequiredDescription
user_idstringYesEmployee user ID
include_compensationbooleanNoInclude compensation (default: false)
search_employees
ParameterTypeRequiredDescription
search_textstringNoPartial name search
departmentstringNoFilter by department
locationstringNoFilter by location
manager_idstringNoFilter to manager's reports
statusstringNoactive, inactive, or all (default: active)
topintegerNoMax results (default: 50, max: 200)
get_employee_history
ParameterTypeRequiredDescription
user_idstringYesEmployee user ID
include_compensation_changesbooleanNoInclude salary history (default: false)
get_team_roster
ParameterTypeRequiredDescription
manager_idstringYesManager's user ID
include_indirect_reportsbooleanNoInclude reports-of-reports (default: false)
topintegerNoMax direct reports (default: 100, max: 200)
Time Off Tools
get_time_off_balances
ParameterTypeRequiredDescription
user_idsstringYesComma-separated user IDs (max 50)
as_of_datestringNoBalance as of date (YYYY-MM-DD)
get_upcoming_time_off
ParameterTypeRequiredDescription
start_datestringYesRange start (YYYY-MM-DD)
end_datestringYesRange end (YYYY-MM-DD)
departmentstringNoFilter by department
manager_idstringNoFilter to manager's team
statusstringNoapproved, pending, or all (default: approved)
topintegerNoMax results (default: 200, max: 500)
get_time_off_requests
ParameterTypeRequiredDescription
user_idstringNoFilter to employee
statusstringNopending, approved, rejected, cancelled, or all (default: pending)
from_datestringNoSubmitted after date (YYYY-MM-DD)
topintegerNoMax results (default: 50, max: 200)
Hiring & Onboarding Tools
get_open_requisitions
ParameterTypeRequiredDescription
departmentstringNoFilter by department
hiring_manager_idstringNoFilter by hiring manager
locationstringNoFilter by location
statusstringNoopen, filled, closed, or all (default: open)
topintegerNoMax results (default: 100, max: 500)
get_candidate_pipeline
ParameterTypeRequiredDescription
requisition_idstringYesJob requisition ID
include_rejectedbooleanNoInclude rejected candidates (default: false)
topintegerNoMax results (default: 100, max: 500)
get_new_hires
ParameterTypeRequiredDescription
start_date_fromstringYesHires on/after date (YYYY-MM-DD)
start_date_tostringYesHires on/before date (YYYY-MM-DD)
departmentstringNoFilter by department
topintegerNoMax results (default: 100, max: 500)
Compliance & Reporting Tools
get_terminations
ParameterTypeRequiredDescription
from_datestringYesRange start (YYYY-MM-DD)
to_datestringYesRange end (YYYY-MM-DD)
departmentstringNoFilter by department
topintegerNoMax results (default: 100, max: 500)
get_employees_missing_data
ParameterTypeRequiredDescription
check_fieldsstringYesComma-separated: email, phone, address, emergency_contact
departmentstringNoFilter by department
topintegerNoMax results (default: 100, max: 500)
get_anniversary_employees
ParameterTypeRequiredDescription
from_datestringYesRange start (YYYY-MM-DD)
to_datestringYesRange end (YYYY-MM-DD)
milestone_years_onlybooleanNoOnly 1, 5, 10, 15, 20, 25+ years (default: false)
departmentstringNoFilter by department
topintegerNoMax results (default: 100, max: 500)
Performance & Compensation Tools
get_performance_review_status
ParameterTypeRequiredDescription
form_template_idstringNoFilter by form template
departmentstringNoFilter by department
manager_idstringNoFilter by manager
statusstringNonot_started, in_progress, completed, or "" for all
topintegerNoMax results (default: 100, max: 500)
get_compensation_details
ParameterTypeRequiredDescription
user_idsstringYesComma-separated user IDs (max 20)
effective_datestringNoCompensation as of date (YYYY-MM-DD)
get_compensation_history
ParameterTypeRequiredDescription
user_idstringYesThe employee's user ID
topintegerNoMax history records (default: 50, max: 200)
get_compensation_review_status
ParameterTypeRequiredDescription
form_template_idstringYesThe compensation worksheet's form template ID
departmentstringNoFilter by department
manager_idstringNoFilter by manager
statusstringNonot_started, in_progress, completed, or "" for all
topintegerNoMax results (default: 100, max: 500)
get_salary_range_analysis
ParameterTypeRequiredDescription
user_idsstringYesComma-separated user IDs (max 20)

Returns compa-ratio (current salary ÷ grade midpoint × 100) per employee.

Performance & Talent Tools
get_goal_summary
ParameterTypeRequiredDescription
user_idstringYesThe employee's user ID
statusstringNonot_started, in_progress, completed, or "" for all
topintegerNoMax results (default: 100, max: 200)
get_development_plans
ParameterTypeRequiredDescription
user_idstringYesThe employee's user ID
statusstringNonot_started, in_progress, completed, or "" for all
topintegerNoMax results (default: 100, max: 200)
get_talent_flags
ParameterTypeRequiredDescription
user_idsstringYesComma-separated user IDs (max 20)

Field availability depends on the instance's Succession Data Model configuration.

get_succession_nominees
ParameterTypeRequiredDescription
pool_idstringNoFilter to nominees for a specific talent pool
user_idstringNoFilter to pools an employee is nominated to
topintegerNoMax results (default: 100, max: 200)
Position Management Tools
get_position_details
ParameterTypeRequiredDescription
position_idstringYesPosition ID
get_vacant_positions
ParameterTypeRequiredDescription
departmentstringNoFilter by department
locationstringNoFilter by location
topintegerNoMax results (default: 100, max: 500)
get_org_chart
ParameterTypeRequiredDescription
position_idstringYesStarting position ID
directionstringNodown or up (default: down)
levelsintegerNoLevels to traverse (default: 2, max: 5)
MDF Object Tools
get_mdf_object_definitions
ParameterTypeRequiredDescription
object_namestringNoSpecific MDF object (e.g., cust_myObject). Empty = list all.
query_mdf_object
ParameterTypeRequiredDescription
object_namestringYesMDF object name (e.g., cust_myObject)
selectstringNoComma-separated fields
filterstringNoOData filter
topintegerNoMax results (default: 100, max: 500)
skipintegerNoPagination offset
orderbystringNoSort order
effective_datestringNoEffective date filter (YYYY-MM-DD)
get_foundation_objects
ParameterTypeRequiredDescription
object_typestringYescompany, department, division, location, cost_center, job_code, job_function, pay_grade, pay_group, business_unit, event_reason, legal_entity
filterstringNoAdditional OData filter
topintegerNoMax results (default: 100, max: 500)
include_inactivebooleanNoInclude end-dated records (default: false)
Workflow Tools
get_pending_approvals
ParameterTypeRequiredDescription
user_idstringNoFilter to specific approver
wf_request_idstringNoFilter to specific workflow request
topintegerNoMax results (default: 100, max: 500)
get_workflow_history
ParameterTypeRequiredDescription
wf_request_idstringYesWorkflow request ID
topintegerNoMax results (default: 100, max: 500)
Monitoring & Admin Tools
get_alert_notifications
ParameterTypeRequiredDescription
from_datestringNoStart date (YYYY-MM-DD)
to_datestringNoEnd date (YYYY-MM-DD)
topintegerNoMax results (default: 100, max: 500)
get_scheduled_job_status
ParameterTypeRequiredDescription
job_namestringNoFilter by job name
topintegerNoMax results (default: 50, max: 500)
get_integration_center_jobs
ParameterTypeRequiredDescription
job_namestringNoFilter by job name
statusstringNoFilter by status
topintegerNoMax results (default: 50, max: 500)
get_api_quota_status

Returns current rate limit usage for the specified instance.

get_cache_status

Returns cache hit rates, entry counts by category, and memory usage.

clear_cache
ParameterTypeRequiredDescription
target_instancestringNoClear specific instance. Empty = clear all.
Employee Central Tools
get_global_assignments
ParameterTypeRequiredDescription
user_idstringNoFilter to a single employee's assignment history
active_onlybooleanNoOnly currently active assignments (default: true)
topintegerNoMax results (default: 100, max: 200)
get_employee_documents
ParameterTypeRequiredDescription
user_idstringYesThe employee's user ID
document_typestringNoFilter by document type
topintegerNoMax results (default: 50, max: 100)
get_pay_component_groups
ParameterTypeRequiredDescription
user_idstringYesThe employee's user ID
effective_datestringNoComponents as of date (YYYY-MM-DD)
get_work_permit_expiry
ParameterTypeRequiredDescription
within_daysintegerNoFlag permits/visas expiring within N days (default: 90)
countrystringNoFilter by ISO country code
topintegerNoMax results (default: 100, max: 500)
get_probation_end_dates
ParameterTypeRequiredDescription
within_daysintegerNoFlag probation periods ending within N days (default: 30)
departmentstringNoFilter by department
topintegerNoMax results (default: 100, max: 500)
Data Management Tools
bulk_export_employees
ParameterTypeRequiredDescription
selectstringNoComma-separated fields. Defaults to a standard field set
departmentstringNoFilter by department
statusstringNoactive, inactive, or all (default: active)
topintegerNoRecords per page (default: 500, max: 1000)
max_pagesintegerNoMax pages to fetch (default: 10, max: 50)
get_picklist_usage
ParameterTypeRequiredDescription
entitiesstringNoComma-separated entity names to scan. Defaults to a common set
get_country_specific_fields
ParameterTypeRequiredDescription
entitystringYesOData entity to analyze (e.g., PerPersonal, PerNationalId)
countrystringYesISO country code to filter the sample
sample_sizeintegerNoRecords to sample for population rates (default: 50, max: 200)

Example Queries

Ask Claude in natural language:

QueryTool Used
"Show me all users in the Sales department"search_employees
"What permissions does jsmith have?"get_user_permissions
"Compare User config between dev and prod"compare_configurations
"Who's on vacation next week?"get_upcoming_time_off
"List all open job requisitions for Engineering"get_open_requisitions
"How much PTO does jdoe have left?"get_time_off_balances
"Show me all new hires starting in March"get_new_hires
"Who has a 10-year anniversary this month?"get_anniversary_employees
"What are the status of performance reviews for my team?"get_performance_review_status
"Show John's complete job history"get_employee_history
"What custom MDF objects exist in our instance?"get_mdf_object_definitions
"List all departments with their cost centers"get_foundation_objects
"Are there any pending workflow approvals?"get_pending_approvals
"Check the status of our integration jobs"get_integration_center_jobs

Common SuccessFactors Entities

CategoryEntities
EmployeeUser, EmpEmployment, EmpJob, PerPersonal, PerPhone, PerEmail
FoundationFOCompany, FODepartment, FOJobCode, FOLocation, FOPayGrade
PositionPosition, PositionEntity, PositionMatrixRelationship
TalentGoal, GoalPlan, PerformanceReview, Competency
RecruitingJobRequisition, Candidate, JobApplication

Use list_entities to discover all available entities in your instance.

Troubleshooting

Authentication Errors (HTTP 401)
  • Verify credential format: user ID without @instance
  • Confirm the password is correct
  • Ensure the API user has proper permissions in SuccessFactors Admin Center
Validation Errors

All inputs are validated to prevent injection attacks:

ParameterRules
instanceAlphanumeric, underscores, hyphens only
entityValid OData entity name pattern
filterNo blocked keywords ($batch, $metadata, <script>, etc.)
localeFormat like en-US or de
select / orderbyValid field name patterns
Server Disconnected (Claude Desktop)
  1. Verify uv path in config is correct: which uv
  2. Check logs: tail -f ~/Library/Logs/Claude/mcp*.log
  3. Test manually: uv run mcp dev main.py
  4. Ensure Python 3.10+ is installed: python3 --version
Rate Limit Errors
  • The server auto-retries HTTP 429 responses (up to 3 times)
  • Use get_api_quota_status to check current usage
  • Increase limits via SF_RATE_LIMIT environment variable
  • Cache responses with SF_CACHE_TTL_DEFAULT to reduce API calls

Dependencies

PackageVersionPurpose
fastmcp>=2.0.0Model Context Protocol SDK
requests>=2.31.0HTTP client with connection pooling
defusedxml>=0.7.0XXE-safe XML parsing
python-dotenv>=1.0.0Environment variable loading
uvicorn>=0.30.0ASGI server for HTTP transport

Dev dependencies: pytest, ruff, mypy

Contributing

Contributions are welcome! Please:

  1. Fork the repository
  2. Create a feature branch: git checkout -b feature/my-feature
  3. Run tests: uv run pytest tests/ -v
  4. Run linting: uv run ruff check .
  5. Commit your changes
  6. Open a Pull Request

Changelog

See CHANGELOG.md for release history.

License

This project is licensed under the MIT License — see the LICENSE file for details.

Built with FastMCP · Powered by Model Context Protocol

MIT, read

History

Latest

v0.3.2

Features 3, Changed 2, Fixes 5

Notes
Fixed
  • compare_configurations: Removed broken @sf_tool decorator; added inline validation for dual-instance parameters
  • search_employees / compliance: Wrapped OR clauses in parentheses so AND joins evaluate correctly in OData filters
  • get_role_assignment_history: Replaced invalid RBPBasicUserPermission entity with getUserPermissions + RBPRole two-step approach
  • get_anniversary_employees: Iterate all years in date range instead of only from_date.year, fixing cross-year-boundary queries
  • Decorator validation: Skip validation for empty string defaults to avoid false positives on optional parameters
Added
  • Connection pooling: requests.Session singleton for HTTP connection reuse across API calls
  • Cache mutation safety: Deep-copy on both cache put() and get() to prevent callers from corrupting cached data
  • MDF/foundation input validation: query_mdf_object validates object_name, filter, select, orderby, effective_date; get_foundation_objects validates filter
Changed
  • dependencies.py: Import Dependency from fastmcp.server.dependencies instead of docket.dependencies
  • _display_name: Extracted duplicated helper to shared sf_mcp/tools/utils.py, imported by 4 tool modules

  1. v0.3.1

    Changed 2, Fixes 4

    Notes
    Fixed
    • Timing-safe auth: API key comparison uses hmac.compare_digest to prevent timing-based side-channel attacks
    • OData filter hardening: Blocklist now checks raw, URL-decoded, and double-decoded input; rejects control characters
    • UTC-consistent dates: parse_hire_date uses explicit UTC timezone for all SAP timestamp parsing
    • GCP Secret Manager: Separated ImportError from runtime Exception; runtime errors now logged properly
    Changed
    • Updated tool count in documentation (32 → 43)
    • Version bump to 0.3.1

  2. v0.3.0

    Features 5, Changed 2

    Notes
    Added
    • Rate limiting: Sliding-window algorithm with per-instance tracking, configurable limits, automatic 429 retry
    • Response caching: Category-based TTLs (metadata 1h, picklists 30m, permissions 1h), SHA-256 cache keys
    • Automatic pagination: paginate=True on query_odata fetches all pages automatically
    • 3 admin tools: get_api_quota_status, get_cache_status, clear_cache
    • ruff linter and mypy type checker configuration
    Changed
    • Major refactoring with ruff code hygiene improvements
    • Expanded .gitignore for tool caches

  3. v0.2.0

    Features 5

    Notes
    Added
    • 3 monitoring tools: get_alert_notifications, get_scheduled_job_status, get_integration_center_jobs
    • 3 MDF tools: get_mdf_object_definitions, query_mdf_object, get_foundation_objects
    • 2 workflow tools: get_pending_approvals, get_workflow_history
    • 3 position tools: get_position_details, get_vacant_positions, get_org_chart
    • get_user_roles: Fixed to use getUserPermissions + RBPRole instead of invalid RBPBasicUserPermission

  4. v0.1.0

    Features 10

    Notes
    Added
    • Initial release with 32 tools across 10 categories
    • sf_tool decorator for cross-cutting concerns (logging, validation, error handling)
    • FastMCP Dependency injection for schema-clean tool interfaces
    • 21 SAP data center mappings with alias support
    • Per-request authentication (no stored credentials)
    • Input validation with 10 regex-based validators
    • XXE-safe XML parsing via defusedxml
    • Structured JSON audit logging with credential masking
    • Dockerfile for Cloud Run deployment
    • 110 pytest test cases
On GitHub

Details

Sources3
sap-ai-mcp-serversdiscovered herechecked
github.com/aiadiguru2025/sf-mcptree, pushes, contributors, CIchecked
README.mdquoted, and what the entry declareschecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
discovered viasap-ai-mcp-servers
first seen in the atlas
ecosystem and domainsuccessfactors, process-and-workflow
Contributors1
Shakti Barath

From the repository’s contributor list, .

History in the atlas4
  1. SAP SuccessFactors has a product door (docs/concepts/product-doors.md, ADR-0033). The entry was filed on BTP for want of one, as its creation note says; the product is not in SAP's BTP catalogue, only its Extensibility service is, and the catalogue is now the rule for that door. The connects edge to the product entered the same day, quoted from the README.
  2. The concern it answers is reaching into an SAP system from outside, split out of MCP servers on this day; the sentence on the edge is unchanged.
  3. Triaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README. Filed on the BTP door because there is no door for the SAP product it fronts and hard rule 9 allows one — the same strain recorded on the LeanIX entries.
  4. First seen.
For your agent
Ref
artifact:aiadiguru-sf-mcp
JSON
/artifacts/aiadiguru-sf-mcp.json
MCP
Connecting an agent