SAP Fiori MCP Server
OFFICIAL SERVERGenerate and modify SAP Fiori elements apps for CAP and OData projects from a coding assistant
Reads, edits, checks and activates ABAP code on SAP systems through the ADT REST API
By arc-mcp TypeScript Local · stdio Developer tools
56 popularity score ★ 253 ↓ 2.7k/wk
Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.
It needs SAP_URL, SAP_USER, SAP_PASSWORD. Replace each <NAME> with your value.
claude mcp add arc-1 -e SAP_URL=<SAP_URL> -e SAP_USER=<SAP_USER> -e SAP_PASSWORD=<SAP_PASSWORD> -- npx -y arc-1@latest{
"mcpServers": {
"arc-1": {
"command": "npx",
"args": [
"-y",
"arc-1@latest"
],
"env": {
"SAP_URL": "<SAP_URL>",
"SAP_USER": "<SAP_USER>",
"SAP_PASSWORD": "<SAP_PASSWORD>"
}
}
}
}{
"mcpServers": {
"arc-1": {
"command": "npx",
"args": [
"-y",
"arc-1@latest"
],
"env": {
"SAP_URL": "<SAP_URL>",
"SAP_USER": "<SAP_USER>",
"SAP_PASSWORD": "<SAP_PASSWORD>"
}
}
}
}{
"servers": {
"arc-1": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"arc-1@latest"
],
"env": {
"SAP_URL": "<SAP_URL>",
"SAP_USER": "<SAP_USER>",
"SAP_PASSWORD": "<SAP_PASSWORD>"
}
}
}
}[mcp_servers.arc-1]
command = "npx"
args = ["-y", "arc-1@latest"]
[mcp_servers.arc-1.env]
SAP_URL = "<SAP_URL>"
SAP_USER = "<SAP_USER>"
SAP_PASSWORD = "<SAP_PASSWORD>"gemini mcp add --scope user -e SAP_URL=<SAP_URL> -e SAP_USER=<SAP_USER> -e SAP_PASSWORD=<SAP_PASSWORD> arc-1 npx -- -y arc-1@latest| Set together: connection | |
|---|---|
SAP_URL |
Required: Base URL of the SAP system's ADT endpoint, with scheme and port, e.g. https://host:44300. |
SAP_USER |
Required: SAP user name for basic authentication (cookie, BTP service-key or destination auth are alternatives). |
SAP_PASSWORD secret |
Required: Password for SAP_USER. |
SAP_CLIENT |
Optional: SAP logon client. |
SAP_LANGUAGE |
Optional: Logon language. |
| Set together: writes | |
SAP_ALLOW_WRITES |
Optional: Master switch for creating, changing, activating and deleting objects. |
SAP_ALLOWED_PACKAGES |
Optional: Comma-separated packages writes may touch, with wildcards; * allows all. |
SAP_ALLOW_TRANSPORT_WRITES |
Optional: Allows creating and releasing transports; also needs SAP_ALLOW_WRITES. |
SAP_ALLOW_GIT_WRITES |
Optional: Allows abapGit/gCTS changes; also needs SAP_ALLOW_WRITES. |
| Set together: data access | |
SAP_ALLOW_DATA_PREVIEW |
Optional: Enables table contents in SAPRead and saved SAPscript texts and SLG1 logs in SAPQuery. |
SAP_ALLOW_FREE_SQL |
Optional: Enables the sql action of SAPQuery for ad-hoc ABAP SQL. |
ARC1_TOOL_MODE |
Optional: standard (12 tools) or hyperfocused (one tool for small context windows). |
ARC-1 is an MCP server for ABAP development on SAP systems. It talks to the system's ABAP Development Tools (ADT) REST endpoint, the same interface Eclipse ADT uses, so an assistant can read source and DDIC objects, search the repository, follow definitions and where-used lists, run syntax checks, ABAP Unit and ATC, lint code, and, once allowed, create, change and activate objects, handle CTS transports and run abapGit or gCTS operations. It works with on-premise systems and with SAP BTP ABAP Environment, probes the system at startup and drops object types the target does not support.
Instead of hundreds of narrow tools it groups the work into 12 tools that take an action or type argument. A hyperfocused mode (ARC1_TOOL_MODE=hyperfocused) folds everything into one tool for clients with little context room. Most of it stays off until an operator flips the SAP_ALLOW_* switches. In version 1.9.0 the registry (src/handlers/tools.ts and query-tool.ts) leaves SAPWrite and SAPActivate out unless SAP_ALLOW_WRITES is true, and shows SAPGit only when a gCTS or abapGit backend is detected. SAPQuery appears once either SAP_ALLOW_FREE_SQL or SAP_ALLOW_DATA_PREVIEW is on. Free SQL gives it the sql action. Data preview adds reading saved SAPscript long texts and SLG1 application logs, but the code offers those two actions on on-premise systems only, and drops the log action whenever SAP_BLOCKED_DATA_SOURCES is set. A default install therefore sees a read-only subset of the 12.
It runs locally over stdio for one developer, or as a long-lived HTTP server (Docker image or BTP Cloud Foundry app) for a team, with API-key, OIDC or XSUAA sign-in in front and optional per-user SAP identity through principal propagation. On BTP an experimental multi-target mode serves several SAP systems from one deployment, and writes there are limited to pinned principal-propagation targets that each need their own destination and IAM opt-in.
| Runtime | Node.js 22.19+ |
|---|---|
| Runs on | macOS, Windows, Linux |
| SAP ABAP system (on-premise or BTP ABAP Environment) | Enterprise planAn SAP user with ADT authorizations on a system whose ADT endpoint you can reach; a development or sandbox system is advised |
The npx command needs Node.js 22.19 or newer (engines in package.json). The SAP system's ADT HTTP(S) endpoint must be reachable from where it runs. Where only RFC or SAProuter reaches the system, a separate ADT-to-RFC bridge is needed. The Docker image starts an HTTP server on port 8080 rather than stdio and refuses to start without API-key, OIDC or XSUAA auth unless ARC1_ALLOW_HTTP_NO_AUTH=true is set.
Read-only by default: writes, transport and Git changes, table preview and free SQL each need their own SAP_ALLOW_* switch, and writes stay in package $TMP unless SAP_ALLOWED_PACKAGES widens them. That allowlist covers writes only; reads follow the SAP user's authorizations. With data access on, SAPQuery.maxRows is clamped to 10,000 and data-preview bodies to 2 MiB per call by default. Boolean flags need a value (--allow-writes true). Its makers say ADT use of this kind is a grey area under SAP's API Policy: usable at your own risk, worth raising with SAP before production. Multi-target BTP mode and the data-source blocklist are experimental.
Suits ABAP developers and SAP teams who want an assistant working against a real development system with guardrails an admin controls: read-only start, package allowlists, per-action deny lists, audit logging and per-user SAP identity on BTP. A single developer can run it with npx and basic credentials, and a team can host it once on BTP or Docker behind OIDC or XSUAA. It is not meant for business-data extraction, and it is not published by SAP. Organisations that need a vendor-supported route, or that cannot get approval for ADT access under their SAP agreement, should settle that first.
6 only read, 3 change things, 3 can delete or overwrite. A ? marks an optional parameter.
SAPReadtype: enumname?: stringinclude?: stringmethod?: stringgrep?: stringformat?: enumversion?: enummaxRows?: numberSAPSearchquery?: stringsearchType?: enummaxResults?: numbernames?: arrayobjectType?: stringpackageName?: stringSAPWrite deletesaction: enumtype?: enumname?: stringsource?: stringpackage?: stringtransport?: stringactivate?: booleandryRun?: booleanobjects?: arraySAPActivate changesaction?: enumname?: stringtype?: stringobjects?: arraypreaudit?: booleanSAPNavigateaction: enumuri?: stringname?: stringline?: numbercolumn?: numberSAPQueryaction?: enumsql?: stringmaxRows?: numberlongText?: objectapplicationLog?: objectSAPTransport deletesaction: enumid?: stringdescription?: stringpackage?: stringrecursive?: booleanSAPGit deletesaction: enumbackend?: enumrepoId?: stringurl?: stringbranch?: stringmessage?: stringSAPContextname: stringaction?: enumtype?: enumdepth?: numberSAPLint changesaction: enumsource?: stringname?: stringrules?: objectSAPDiagnoseaction: enumname?: stringtype?: stringobjects?: arrayid?: stringSAPManage changesaction: enumname?: stringobjectName?: stringnewPackage?: string