ARC-1
NPM · ARC-1 · 2 COMPONENTS · SCANNED SEP 20
MCP server for SAP ABAP systems
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 72 of 189 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency74
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to arc-mcp/arc-1). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability57
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 9088 tokens (~1136/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the ARC-1 MCP server?
ARC-1 runs locally as an npm package, launched with npx -y arc-1. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · arc-1
claude mcp add arc-mcp-arc-1 -- npx -y arc-1
{
"mcpServers": {
"arc-mcp-arc-1": {
"command": "npx",
"args": [
"-y",
"arc-1"
]
}
}
} {
"servers": {
"arc-mcp-arc-1": {
"command": "npx",
"args": [
"-y",
"arc-1"
]
}
}
} codex mcp add arc-mcp-arc-1 -- npx -y arc-1
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"arc-mcp-arc-1": {
"type": "local",
"command": [
"npx",
"-y",
"arc-1"
],
"enabled": true
}
}
} openclaw mcp add arc-mcp-arc-1 --command npx --arg -y --arg arc-1
mcp_servers:
arc-mcp-arc-1:
command: "npx"
args: ["-y", "arc-1"] {
"McpServers": {
"arc-mcp-arc-1": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"arc-1"
]
}
}
} assistant mcp add arc-mcp-arc-1 -t stdio -c npx -a -y arc-1
{
"mcpServers": {
"arc-mcp-arc-1": {
"command": "npx",
"args": [
"-y",
"arc-1"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −2
- Stability: pass → 0.80 functional
- 17 Sept 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.97 → unverified ▼ security
- Stability: 0.97 → pass security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 1.2.0 → 1.3.0 functional
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −3
- Stability: pass → 0.80 functional
- 10 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/arc-1@1.3.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | arc-mcp/arc-1 |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/arc-mcp/arc-1/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2880084057 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:f831396f5f3c2d643e68e9ede111659562b3cf462f3984e79069dcb4ee6cf9c4ba360cca7ac284985419e6dcc2b65f0cb3f2044b7427bc9881c56733b |
Background: How many MCP packages publish verified provenance →
Dependencies 189 packages
| Packages resolved | 189 |
|---|---|
| Stale | 70 |
| No linked repository | 2 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
SAPContext ~963
Primary tool for understanding ABAP/CDS objects before specs, reviews, explanations, or changes — use instead of SAPRead when the user asks what an object does. Returns intent first (the object KTD when available) then compressed dependency contracts. Use SAPRead after SAPContext for exact source/method bodies/grep/drafts. Decision rule — pick the action from the user's question: - "What breaks if I change <CDS>?" / "Who consumes <I_*>?" / "Blast radius" → action="impact" (DDLS only). - "Which includes/appends extend <TABL>?" → action="structure", type="TABL". - "What does <object> do?" / "Explain" / "deps before editing" → action="deps" (default); type+name required. - "Find all callers of <object>" → action="usages" (live SAP where-used lookup). impact (CDS blast-radius): upstream AST deps + downstream where-used, classified into RAP buckets (projectionViews, bdefs, serviceDefinitions, serviceBindings, accessControls, metadataExtensions, abapConsumers, documentation, tables, other) + sibling-consistency hints. Use this instead of text-scanning DDDDLSRC/ACMDCLSRC with SAPQuery (it filters the noise). Optional includeIndirect, siblingCheck, siblingMaxCandidates. deps: target KTD when available + selected dependency contracts, derived from source (not SAP-native relationships or a complete inventory). Counts distinguish root candidates from recursive attempts. Standard helper names are filtered. For CDS, includes dependency DDL/field catalogs for cl_cds_test_environment. structure (TABL only): the DDIC include/append tree. Non-CDS reverse-lookup: SAPNavigate(references); CDS: impact. Full detail: docs_page SAPContext.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action: "impact" = CDS blast-radius analysis (DDLS only). USE THIS for any question like "what breaks if I change <view>", "who consumes <I_*>", "impact analysis on <CDS>", "downstream of <view>". Re… |
| depth | number | – | Dependency depth: 1 = direct deps only (default), 2 = deps of deps, 3 = maximum. Higher depth = more context but more SAP calls. |
| group | string | – | Required for FUNC type. The function group containing the function module. |
| includeIndirect | boolean | – | impact: Include indirect (transitive) downstream where-used entries. Default false. |
| includeKtd | boolean | – | deps: When true/default, prepend the object Knowledge Transfer Document (KTD/SKTD) when one exists. Set false to skip the KTD lookup. |
| maxDeps | number | – | Max dependencies to resolve (default 20). Lower = faster + fewer tokens. |
| maxResults | number | – | usages: max entries (default 100); impact: max per downstream bucket (default 50). Max 1000. "usageCount"/"summary" stay true totals, not page sizes. |
| name | string | yes | Object name (e.g., ZCL_ORDER) |
| siblingCheck | boolean | – | impact: Enable sibling metadata-extension consistency analysis. Default true. |
| siblingMaxCandidates | number | – | impact: Maximum sibling DDLS candidates to compare. Default 4; hard cap 10. |
| source | string | – | Optional: provide source directly instead of fetching from SAP. Saves one round-trip if you already have the source from SAPRead. |
| type | string | – | Root type. deps requires type+name, even with source. Optional for action="impact" (defaults to DDLS) or usages (unique name lookup); structure requires TABL. |
No output schema declared.
No examples provided.
SAPDiagnose ~1,594
ABAP diagnostics and runtime analysis. Actions: - "syntax": syntax-check (name+type; optional version; optional source = pre-write dry-run, nothing written). - "unittest": harmless ABAP Unit for CLAS/PROG/FUGR or DEVC (exact; includeSubpackages recurses). - "unittest_ci": harmless package tests with source reconciliation; empty/incomplete runs fail. - "atc": run ATC checks (name+type or objects [{type,name}], max 20; omit variant to bind the system default; unknown variant = error). "atc_variants": list variants + that default (variant = name filter; read-only). - "atc_ci": package ATC CI; requires available API and verified selection. - "cds_testcases": SAP-suggested ABAP Unit test cases for a CDS entity (name; read-only; SAP_BASIS 8.16+). - "object_state": compare active vs inactive source versions (name+type; CLAS compares all includes). Returns ETags/hashes/divergence flags. - "quickfix": proposals at name+type+source+line (optional column/sourceUri). - "apply_quickfix": return proposal text deltas without writing; needs quickfix inputs + proposalUri/proposalUserContent. - "dumps": list/read ST22 short dumps (no id = list; id = read; includeFullText, sections). - "traces": list profiler traces; id+analysis analyzes one. - "trace_start": arm a profiler trace for the NEXT matching execution, then reproduce and read via "traces" (write scope; defaults: next HTTP request, SQL on). - "trace_requests": list armed trace requests. "trace_cancel": cancel one by id (write scope). - "system_messages": list SM02 messages. "gateway_errors": list /IWFND/ERROR_LOG (on-prem; detailUrl or id+errorType for detail). - "odata_perf": diagnose why an OData call is slow (url = host-relative path); returns the sap-statistics timing split (DB/ABAP/framework/auth). Read-only; needs allowDataPreview. - "authorization_trace": read the on-prem STUSERTRACE auth trace (SUAUTHVALTRC); needs SAP_ALLOW_DATA_PREVIEW. - "cds_sql": show the native SQL a CDS view compiles to (name; read-only). - "s…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| aggregate | boolean | – | trace_start aggregation (default true). |
| analysis | string | – | traces with id: hitlist=hot spots, statements=call tree, dbAccesses=DB access stats. |
| authObject | string | – | Authorization object filter, e.g. S_TCODE. |
| column | number | – | Quickfix source column (default 0). |
| configuration | string | – | atc_ci: optional configuration. |
| coverage | boolean | – | unittest only: collect statement/branch/procedure coverage and methodsBelowFull. Unavailable measurements do not discard test results. Default false. |
| description | string | – | trace_start label. |
| detailUrl | string | – | Detail path: canonical /sap/bc/adt/gw/errorlog/...; no absolute URLs. |
| errorType | string | – | gateway_errors: required with id instead of detailUrl, e.g. "Frontend Error". |
| expiresHours | number | – | trace_start expiry in hours (default 24). |
| failOnSeverity | string | – | atc_ci failure threshold (default error). |
| from | string | – | system_messages/gateway_errors lower time bound. |
| id | string | – | Dump or trace ID (for dumps/traces actions); also the trace-request id to cancel (for trace_cancel). Omit to list, provide to get details. |
| includeFullText | boolean | – | dumps detail: include full formattedText (default false). |
| includeReportXml | boolean | – | CI XML reports (default false; 256 KiB total cap). |
| includeSubpackages | boolean | – | – |
| line | number | – | Required quickfix/apply_quickfix source line. |
| maxExecutions | number | – | trace_start executions to capture (default 1). |
| maxResults | number | – | Result limit: dumps/system_messages/gateway_errors default 50; authorization_trace 100. Capped. |
| name | string | – | syntax/unittest/atc/object_state object name; cds_testcases/cds_sql CDS entity or DDLS name. |
| objectType | string | – | trace_start match type; defaults: http→url, dialog→transaction, batch→report, rfc→functionModule. |
| objects | array | – | ATC only, instead of name/type/url. One batch + at most one verification. Returns coverage; unreported objects stay incomplete. No packages. |
| onlyFailures | boolean | – | authorization_trace: only denied checks (RC<>0), like SU53. |
| packageTrees | array | – | CI packages including subpackages. |
| packages | array | – | CI exact packages; 1–50 total with packageTrees. |
| processType | string | – | trace_start work process (default http/OData): dialog=SAP GUI, batch=background job, rfc=RFC. |
| proposalAffectedObjects | array | – | quickfix affectedObjects; provide current content for each source unit when applying multi-object fixes. |
| proposalUri | string | – | Quickfix proposal URI from quickfix action (required for apply_quickfix). |
| proposalUserContent | string | – | Opaque userContent from quickfix action (required for apply_quickfix). May be an empty string; pass through exactly. |
| resultFormat | string | – | unittest: legacy|structured|junit; atc: legacy|structured; other actions reject it. |
| sections | array | – | dumps detail chapter IDs, e.g. ["kap0","kap3","kap8"]; omit for focused defaults. |
| source | string | – | Current source code (required for quickfix/apply_quickfix). |
| sourceUri | string | – | quickfix/apply_quickfix source URI; default type/name main source. Set for includes, e.g. /includes/definitions. |
| sqlOn | boolean | – | set_sql_trace_state: true arms ST05 SQL trace, false disarms; user filters the SAP user. |
| sqlTrace | boolean | – | trace_start SQL capture (default true; required for analysis="dbAccesses"). |
| timeoutSeconds | number | – | Timeout 1–3600s: unittest/atc default 300; CI overall default 600. |
| to | string | – | system_messages/gateway_errors upper time bound. |
| traceUser | string | – | trace_start/trace_requests SAP user (default connected user). |
| type | string | – | Object type; unittest accepts CLAS, PROG, FUGR, or DEVC. |
| url | string | – | odata_perf: host-relative OData path from the app network request (e.g. /sap/opu/odata4/sap/.../Entity?$filter=…). Absolute URLs rejected. |
| user | string | – | SAP-user filter for dumps, feeds, or authorization_trace. |
| variant | string | – | atc/atc_ci variant; atc_variants name filter (*=all) |
| version | string | – | syntax source version (default active); inactive checks pending changes. |
No output schema declared.
No examples provided.
SAPLint ~318
Run local abaplint rules on ABAP/CDS source (auto-selects cloud or on-prem rules by system type). Actions: - "lint": check source (errors+warnings) for ABAP (PROG/CLAS/INTF/FUNC) and CDS (DDLS). - "lint_and_fix": lint + auto-fix fixable issues (keyword case, obsolete statements); returns fixed source. - "list_rules": list rules + current config (no source). - "format": pretty-print via SAP's ADT formatter (needs source). - "get_formatter_settings" / "set_formatter_settings": read/update the system's global PrettyPrinter (indentation bool, style keywordUpper|keywordLower|keywordAuto|none; set is blocked read-only). lint/lint_and_fix/list_rules run locally; format/*_formatter_settings call SAP. For ATC/syntax/unit tests use SAPDiagnose.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Check type |
| indentation | boolean | – | PrettyPrinter: indent source (for set_formatter_settings) |
| name | string | – | Object name (used for filename detection) |
| rules | object | – | Rule overrides: { "rule_name": false } to disable, { "rule_name": { "severity": "Warning" } } to configure. Overrides system defaults. |
| source | string | – | ABAP or CDS source code to lint/format (not needed for list_rules/get_formatter_settings) |
| style | string | – | PrettyPrinter: keyword casing (for set_formatter_settings) |
No output schema declared.
No examples provided.
SAPManage ~1,127
Probe and report SAP system capabilities. Use BEFORE operations that depend on optional features (abapGit, RAP/CDS, AMDP, HANA, UI5/Fiori, CTS transports, FLP). Also handles package (DEVC) lifecycle. Actions: - "features": cached feature status (fast, no round-trip; id, available, mode, probedAt). "probe": re-probe now (feature probes + auth + discovery refresh). "cache_stats": object cache health. - "create_package" / "delete_package" / "change_package": DEVC lifecycle via ADT packages API. - FLP read: flp_list_catalogs, flp_list_groups, flp_list_tiles (catalogId). FLP write: flp_create_catalog, flp_create_group, flp_create_tile, flp_add_tile_to_group, flp_delete_catalog. Classic designer tile/target-mapping model, deprecated since S/4HANA 2023; Work Zone exposure v2 needs LADIs (SAPRead type=UIAD). - "set_api_state": release/revoke an object's API release contract (objectUri, or name+objectType; apiState defaults RELEASED, contract defaults C1 — C0 for SRVD, C3 for classic views). Write counterpart of SAPRead(type="API_STATE"). Returns features + systemType ("onprem"/"btp"); "available: false" means do NOT attempt dependent operations.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to execute. Read actions: features, probe, cache_stats, flp_list_catalogs, flp_list_groups, flp_list_tiles. Mutating package/FLP actions require writable safety config and write scope in authe… |
| apiState | string | – | For set_api_state: target state of the object's API release contract — RELEASED (mark released for ABAP Cloud / Clean Core) or NOT_RELEASED (revoke). Default RELEASED. Visibility (ABAP Cloud / Key Us… |
| catalogId | string | – | FLP catalog identifier — accepts either full ID (X-SAP-UI2-CATALOGPAGE:MY_CAT) or domain ID (MY_CAT). Required for flp_list_tiles, flp_create_tile, flp_add_tile_to_group, flp_delete_catalog. |
| contract | string | – | For set_api_state: which release contract to set. Default C1 (Key-User/Cloud — the common clean-core contract). Object types support different contracts: e.g. service definitions (SRVD) only support… |
| description | string | – | Package description (required for create_package). |
| domainId | string | – | Domain ID — required for flp_create_catalog (e.g., ZARC1_SALES). |
| groupId | string | – | FLP group/page identifier (required for flp_create_group, flp_add_tile_to_group). |
| name | string | – | Package name (required for create_package and delete_package). |
| newPackage | string | – | Target package to move the object to. Required for change_package. |
| objectName | string | – | Object name to move (e.g., ZCL_MY_CLASS). Required for change_package. |
| objectType | string | – | ADT object type (e.g., CLAS/OC, DDLS/DF, PROG/P). Required for change_package. For set_api_state: object type of "name" when objectUri is omitted (e.g. CLAS, INTF, DDLS, TABL). |
| objectUri | string | – | ADT URI of the object to move (e.g., /sap/bc/adt/oo/classes/zcl_my_class). If not provided, resolved automatically from objectName + objectType via search. For set_api_state: the object whose API rel… |
| oldPackage | string | – | Current package of the object. Required for change_package. |
| packageType | string | – | Package type for create_package (default: development). |
| recordChanges | boolean | – | Whether the created package records object changes in transport requests. Defaults to true for non-LOCAL software components or when a transport layer is set; false for literal LOCAL packages. |
| responsible | string | – | Person-responsible: an existing ABAP user (XUBNAME, max 12 chars); an email is rejected. Defaults to the connection user; pass explicitly under principal propagation. BTP: auto-resolved from prior cr… |
| softwareComponent | string | – | Software component for create_package (default: LOCAL on-prem, ZLOCAL on BTP). |
| superPackage | string | – | Parent package for create_package (defaults to empty root package). |
| tile | object | – | Tile definition for flp_create_tile. |
| tileInstanceId | string | – | Tile instance ID in the source catalog (required for flp_add_tile_to_group). |
| title | string | – | Title — required for flp_create_catalog and flp_create_group. |
| transport | string | – | Optional transport request (corrNr) for create_package, delete_package, or change_package. |
| transportLayer | string | – | Transport layer for create_package (optional; required by some transportable landscapes). |
No output schema declared.
No examples provided.
SAPNavigate ~532
Navigate code: definitions, references, completion, hierarchy. references: scope-based where-used with lines/snippets/package; objectType filters results (e.g. CLAS/OC, PROG/P); type+name replaces uri. hierarchy queries SEOMETAREL for superclass/interfaces/direct subclasses: requires data/SQL opt-in + matching scope; otherwise inspect class MAIN with SAPRead. CDS (DDLS) impact: SAPContext(action="impact") classifies where-used into RAP buckets. Experimental relations: dependency maps or package neighborhoods, then selected reads. Consumer locations: references; objectType="CLAS/OC" for class-only; otherwise omit. Active metadata, not source-call/runtime proof. Coverage unknown. type+name required, no uri/source.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Navigation action |
| column | number | – | Column number (1-based) |
| depth | integer | – | relations: native steps (default 1), not source-call hops. |
| direction | string | – | relations: incoming=users; outgoing=dependencies (default). |
| expandPackages | array | – | relations: expand exact packages beyond root; others visible. Not authorization. |
| line | number | – | Line number (1-based) |
| maxResults | number | – | references: max entries (default 100, max 1000). "total" counts every match of the filter. relations: node cap incl. root, 1–100 (default 50); may stop earlier. |
| name | string | – | Object name — alternative to uri for references. |
| objectType | string | – | references RESULT filter, not the root type: CLAS/OC, PROG/P, FUGR/FF. Omit for all consumer types. A bare prefix ("CLAS") matches every subtype. |
| source | string | – | Current source code (for definition/completion) |
| type | string | – | Root object type, paired with name instead of uri (e.g. type="INTF"). Not the result-type filter. relations: CLAS, INTF, DDLS, DCLS, BDEF, SRVD, TABL, TTYP, DTEL, DOMA, PROG, INCL, FUGR, FUNC, VIEW,… |
| uri | string | – | Source URI of the object. Optional for references if type+name are provided. |
No output schema declared.
No examples provided.
SAPRead ~2,201
Read SAP ABAP source or metadata. For purpose, explanations, specs, reviews or pre-change context, prefer SAPContext first. DDIC metadata: omit format (default text); structured is CLAS-only for ordinary reads. Types: PROG, CLAS, INTF, FUNC, FUGR (expand_includes=true for all include sources), INCL, DDLS, DCLS, DDLX, BDEF, SRVD, SRVB, SKTD/KTD (KTD aliases SKTD), TABL (covers both transparent tables AND DDIC structures — no separate STRU type), TTYP, VIEW, DOMA, DTEL, TRAN, TABLE_CONTENTS (single-column filter), TABLE_QUERY (multi-column WHERE via the freestyle endpoint; gated by allowDataPreview; CDS views need SAP_BASIS 752+), DEVC, SOBJ (BOR — method param reads one method), SYSTEM, COMPONENTS, MSAG, TEXT_ELEMENTS, VARIANTS, BSP, BSP_DEPLOY, API_STATE (contract states C0-C4; objectType for non-class), INACTIVE_OBJECTS (no name; pending-activation list), AUTH, FEATURE_TOGGLE, ENHO, VERSIONS, VERSION_SOURCE. AUTH/FEATURE_TOGGLE/ENHO/VERSIONS/VERSION_SOURCE are on-prem only. CLAS: method="*" for signatures, method="NAME" for one body, or grep. Global class declaration/implementation: MAIN (omit include). definitions/implementations contain local helpers. Details: docs_page SAPRead. grep: case-insensitive regex; returns matching lines, context and line numbers, with owning class/method for CLAS. Optional version parameter: source types default active; "inactive" requests the draft (SAP may return active if none); "auto" uses the developer view. DTEL omitted/auto uses its developer view; explicit values pass through. Active source reads note when a draft exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Set to "diff" for a unified diff between two source versions (uses from/to) — cheaper than fetching both sources. Source types only: PROG, CLAS, INTF, FUNC, FUGR, INCL, DDLS, DCLS, BDEF, SRVD, DDLX,… |
| columns | array | – | For TABLE_QUERY: columns to SELECT (default: all). Example: ["MATNR","BWART","BUDAT","MENGE"]. |
| expand_includes | boolean | – | For FUGR type only. When true, recursively expands the function group include tree — the main source plus all nested INCLUDEs (the FUNCTION...ENDFUNCTION bodies live in nested LZ<grp>U01/U02 includes… |
| force_refresh | boolean | – | For source reads: bypass cached source and inactive-list state before reading. Use when you know the object changed outside ARC-1. |
| format | string | – | Default "text" (TABL/TTYP/DTEL/DOMA/INTF metadata included). DEVC: array in first text block + listing metadata in second; "structured" returns {objects, listing}. CLAS "structured": metadata + all i… |
| from | string | – | action="diff" OLD side: "active" (default), "inactive", a revision id from SAPRead(type="VERSIONS"), or a /sap/bc/adt/ revision URI. |
| fromLabel | string | – | action="diff" optional display label for the OLD side in the summary and patch header, e.g. "DNT-6-6: Validate discounts (DS7K900123)". Does not affect source resolution. |
| grep | string | – | Regex pattern (case-insensitive) to search within the object source. Returns only matching lines with 1-based line numbers and ±3 context lines, instead of the full source — token-efficient. For CLAS… |
| group | string | – | For FUNC/VERSIONS type. The function group containing the function module. Optional for FUNC — auto-resolved via SAPSearch if omitted. Required for VERSIONS when querying a function module revision f… |
| include | string | – | CLAS: omit include or use main for the global declaration + implementation; definitions/implementations select local helper classes, macros/testclasses their own sections. Explicit include wins over… |
| includeSignature | boolean | – | For FUNC type only. When true, response is JSON: {source, signature: {importing[], exporting[], changing[], tables[], exceptions[], raising[]}, processingType?, updateTaskKind?} — each parameter pars… |
| maxResults | number | – | DEVC object limit (default 200, clamped to [1, 1000]). Listing metadata reports the effective limit and possible truncation. Total and full repository completeness remain unknown. |
| maxRows | number | – | Row cap for TABLE_CONTENTS/TABLE_QUERY (default 100, max 10,000; byte limit may apply sooner). On 758, TABLE_CONTENTS returns N+1; use TABLE_QUERY for exact caps. |
| method | string | – | For CLAS: read a method (e.g., "get_name", "zif_order~process", "lhc_travel~accept") or use "*" to list methods. Without include=, lhc_*/lcl_* use implementations, ltc_* uses testclasses, and others… |
| name | string | – | Object name (e.g., ZTEST_PROGRAM, ZCL_ORDER, MARA) |
| objectType | string | – | For API_STATE and VERSIONS: SAP object type (CLAS, INTF, PROG, FUNC, INCL, DDLS, DCLS, BDEF, SRVD, etc.). For API_STATE: auto-detected from name if omitted. For VERSIONS: required to pick the correct… |
| sqlFilter | string | – | TABLE_CONTENTS condition expression only (no WHERE, no SELECT); broken on 758 (SAP expects SELECT). Use TABLE_QUERY where. |
| to | string | – | action="diff" NEW side (default "inactive" = pending unactivated changes). Same values as from. |
| toLabel | string | – | action="diff" optional display label for the NEW side in the summary and patch header, e.g. "active" or "inactive draft". Does not affect source resolution. |
| type | string | yes | Object type to read (on-prem): PROG, CLAS, INTF, FUNC, FUGR, INCL, DDLS, DCLS, DDLX, BDEF, SRVD, SRVB, SKTD or KTD (Knowledge Transfer Documents), TABL (transparent tables and DDIC structures), TTYP,… |
| version | string | – | Version to read. Source: "active" (default); "inactive" requests the draft (SAP may return active if none); "auto" uses the developer view. DTEL: omitted/"auto" uses its developer view; explicit valu… |
| versionUri | string | – | VERSION_SOURCE: canonical source/revision URI from VERSIONS .revisions[].uri; rejects unrelated ADT endpoints, absolute URLs, traversal, queries, and fragments. |
| where | array | – | For TABLE_QUERY: structured WHERE conditions, ANDed together. Each item: {field, op, value?}. Ops: =, <>, <, <=, >, >=, LIKE, NOT LIKE, IN, NOT IN, IS NULL, IS NOT NULL; use <> because 758 rejects !=… |
No output schema declared.
No examples provided.
SAPSearch ~462
Search for ABAP objects, exact object-directory entries, or source code. Modes: 1. Object search (default): name pattern with wildcards (*); returns type, name, package, description, ADT URI. 2. TADIR lookup (searchType="tadir_lookup"): exact cross-package lookup of one or more names (prefer over long SAPQuery TADIR IN-lists). Tips: BOR objects appear as SOBJ; the uri field feeds SAPNavigate, objectType feeds SAPRead/SAPWrite/SAPActivate. Searches object NAMES only — for field names use SAPRead(type='DDLS', include='elements') or SAPQuery on DD03L.
| Name | Type | Req | Description |
|---|---|---|---|
| maxResults | number | – | Maximum results (default 100) |
| names | array | – | For tadir_lookup: exact object names to resolve across packages. Prefer this over long SAPQuery TADIR IN-lists. |
| objectType | string | – | Object search: SAP-side type filter before the result limit (e.g., UIAC, CLAS, CLAS/OC). Source search: type filter (e.g., PROG, CLAS, FUNC). For tadir_lookup: single type filter; use objectTypes for… |
| objectTypes | array | – | For tadir_lookup: optional ADT/TADIR type filters (e.g., TABL, DDLS, BDEF, SRVB, CLAS/OC). |
| query | string | – | Search pattern for object search, or comma/whitespace-separated names for tadir_lookup. |
| searchType | string | – | Search mode: "object" (default) searches by object name, "tadir_lookup" does exact cross-package object lookup. |
| source | string | – | For tadir_lookup only: data source for the lookup. "adt" (default) uses the ADT info-system endpoint — workbench-resolvable objects only. "db" issues SQL against table TADIR — also surfaces orphan/gh… |
No output schema declared.
No examples provided.
SAPTransport ~1,505
Manage CTS transport requests (SE09/SE10). Actions: list (current user, modifiable), get (tasks + objects), create (always a Workbench (K) request — the package/target sets target & layer, not the request category; optional explicit target), release, delete, remove_object (keep the request), reassign (change owner), release_recursive (tasks then parent), check (does a package need a transport — type, name, package), history (legacy name: current object lock plus assignment candidates — type, name; not complete transport history; read-only, no write scope needed). IDs look like A4HK900123. Status: D/L=modifiable, O/P=releasing, R/N=released.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | list: show transports (defaults to current user, modifiable only). Pass summary=true for a headers-only overview that omits each transport's object lists (keeps an objectCount) — far cheaper when man… |
| description | string | – | Transport description text (required for create) |
| id | string | – | Transport request ID, e.g. A4HK900123 (required for get/diff/release/delete/reassign/release_recursive/remove_object) |
| limit | number | – | diff: objects per call (default 20, max 40); page with offset. |
| maxResults | number | – | Maximum list rows or check/history assignment candidates (defaults: list/history 50, check 10; max 1000). |
| name | string | – | Object name (for check, history, or remove_object actions) |
| offset | number | – | diff: first object to diff (default 0). |
| operation | string | – | Check mode: create (default) or modify. |
| owner | string | – | New owner SAP username (required for reassign) |
| package | string | – | Package name. For create: optional — defaults to $TMP; an explicit package influences the route/target, while the request remains Workbench type K. For check: required. |
| pgmid | string | – | Program ID for remove_object: "R3TR" (whole object) or "LIMU" (sub-object). Required — object type alone does not determine pgmid. |
| recursive | boolean | – | Apply recursively to child tasks (for delete/reassign). release_recursive always recurses. |
| removeLockedObjects | boolean | – | For delete only. Strip locked objects from each task before deleting, so a request that still holds a locked object (e.g. a deleted object's lingering record → HTTP 400 "...contains locked objects")… |
| resultFormat | string | – | release actions: legacy (default) or structured JSON. |
| status | string | – | Transport status filter (for list). D=modifiable (default), R=released, "*"=all statuses. |
| summary | boolean | – | For list only. DEFAULT true: headers-only — drops each transport's (and task's) object lists, keeping id/description/owner/status/target + objectCount; use action="get" for one in full. Pass false fo… |
| target | string | – | Explicit transport target (Transportziel / TR_TARGET) for create — what the user means by "create a transport with target X". Forms: a system ("C11"), system.client ("C11.021"), or target group ("/TR… |
| timeoutSeconds | number | – | release timeout seconds: 1-1800; default 300. |
| transportLayer | string | – | Transport layer for create (optional, advanced). Sent as the ?transportLayer= query param to override which consolidation route — and therefore which target — SAP resolves. OMIT IT by default: SAP re… |
| type | string | – | Object type for check/history/remove_object actions (PROG, CLAS, DDLS, etc.). Not used by create, which creates a Workbench (K) request. |
| user | string | – | List user (default: current SAP user; "*" means all visible owners). |
No output schema declared.
No examples provided.
What is the ARC-1 MCP server?
ARC-1 is an MCP server listed in the public MCP registry as io.github.arc-mcp/arc-1. MCP server for SAP ABAP systems. This page covers its npm package (arc-1).
Is the ARC-1 MCP server safe to use?
ARC-1 scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ARC-1 MCP server expose?
ARC-1 exposes 8 tools: SAPRead, SAPSearch, SAPNavigate, SAPLint, SAPDiagnose, and 3 more. Their descriptions and schemas cost roughly 8,702 tokens of context every time the server is loaded.
Is the ARC-1 MCP server still maintained?
ARC-1 is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the ARC-1 MCP server under?
ARC-1 declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.