Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.palimkarakshay/abap-mcp

NPM · ABAP-MCP · SCANNED AUG 3

Offline SAP ABAP static analysis, Clean Core readiness checks, and RAP scaffolding. No SAP system.

Available components

−10 this week 66 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability62
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2796 tokens (~310/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · abap-mcp

# add to Claude Code
claude mcp add palimkarakshay-abap-mcp -- npx -y abap-mcp
# add to Codex CLI
codex mcp add palimkarakshay-abap-mcp -- npx -y abap-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "palimkarakshay-abap-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "abap-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add palimkarakshay-abap-mcp --command npx --arg -y --arg abap-mcp
# ~/.hermes/config.yaml
mcp_servers:
  palimkarakshay-abap-mcp:
    command: "npx"
    args: ["-y", "abap-mcp"]
// mcp.json
{
  "mcpServers": {
    "palimkarakshay-abap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "abap-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +33
    • Provenance: unverified → fail security
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → pass security
    • Malware scan: unverified → pass security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Tool coverage: 100 → unverified functional
    • Capabilities: pass → unverified functional
    • Maintenance: unverified → pass functional
    • Dependency health: unverified → partial functional
    • License: unverified → pass functional
    • Stability: unverified → 0.20 functional
    • Licence: MIT functional
  • 31 Jul 26 −4
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −39
    • Known CVEs: partial → unverified security
    • Malware scan: pass → unverified security
    • Provenance: fail → unverified security
    • Install scripts: pass → unverified security
    • License: pass → unverified functional
    • Dependency health: partial → unverified functional
    • Maintenance: pass → unverified functional
    • Licence: MIT functional
  • 27 Jul 26 +50
    • Provenance: unverified → fail security
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → pass security
    • Security disclosure: unverified → fail functional
    • Maintenance: unverified → pass functional
    • License: unverified → pass functional
    • Tool coverage: unverified → 100 functional
    • First check of Tool coverage: 100 functional
    • First check of Tool coverage: 100 functional
    • First check of Schema quality: fail functional
    • First check of Schema quality: excellent functional
    • First check of Schema quality: fail functional
    • Licence: MIT functional
  • 26 Jul 26 26

    First indexed and scored.

    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 105 packages

105 packages in the resolved dependency tree · 104 deprecated · 30 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 9 exposed · ~2,796 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
check_cloud_readiness ~310

Assess how far ABAP source is from ABAP Cloud (Clean Core tier 1) by parsing it twice — once at a classic baseline (default v758) and once at version Cloud — and diffing: findings that appear only at Cloud are genuine cloud blockers (statements ABAP Cloud removed), reported in categories (dynpro, list output, native SQL, report events, …) with a transparent score, an A–D tech-debt grade and a verdict; findings already present at the baseline are reported separately as broken code, not migration work. Use this when someone asks 'is this code cloud-ready / Clean Core compliant / S/4HANA-cloud safe', before porting classic ABAP into an ABAP Cloud environment, or for a graded tech-debt assessment of an abapGit export. It is static and parser-level: it does not check released-API usage (that needs a system's ATC), does not connect to any SAP system, and a 'ready' verdict means no language-level blockers — not a certification. Example: check_cloud_readiness({ "files": [ { "source": "REPORT zold.\nWRITE: / 'hi'." } ] }).

NameTypeReqDescription
baselineVersionstringClassic ABAP version the code is assumed to run on today; used to separate broken-anyway code from cloud blockers.
filesarrayyesSource files to analyze, up to 32 per call, 100k chars each.
NameTypeReqDescription
baselineVersionstringyesThe baseline used.
brokenAtBaselinearrayyesFindings that fail even at the baseline version — fix first, they are not migration items.
categoriesarrayyes
cloudBlockerCountnumberyesStatements valid at the baseline but not in ABAP Cloud.
fileCountnumberyesFiles analyzed — the denominator of the grade's density banding.
gradestringyesClean Core tech-debt grade banded on blocker density: A = no blockers, B = ≤ 0.5 blockers/file, C = ≤ 2 blockers/file, D = more. The same objective count as the score, sized for assessment reports.
releasedApiFindingsarrayyesReleased-API observations from the bundled SAP Cloudification snapshot (deprecated-API usage, direct non-released table access with successor hints). Informational — NOT counted in cloudBlockerCount…
releasedApiSnapshotDatestringyesDate of the bundled released-API snapshot the releasedApiFindings reflect.
scopeNotestringyesExactly what this check does and does not cover.
scorenumberyes100 − 5×blockers, floored at 0. Transparent, not an oracle.
verdictstringyesBanded verdict from the blocker count (0 / ≤5 / ≤20 / >20).

No examples provided.

check_released_api ~360

Look up ABAP repository objects (DB tables, CDS view entities, function modules, classes, interfaces, …) in SAP's published ABAP Cloudification list and report, per object, whether it is a 'released' API (safe to use in ABAP Cloud / Clean Core), 'deprecated' (released but being retired), or 'not-released' (a classic/internal object that is not a public API — e.g. most classic DDIC tables) — with a curated CDS successor hint for common tables. This reflects SAP's official Cloudification list as bundled in this package (snapshot 2026-06-10); it ships offline with the server. Use this when you need to know if your code may reference a given object in ABAP Cloud, or which released CDS view to use instead of a classic table — the released-API half of readiness that check_cloud_readiness deliberately leaves to a system's ATC. It does not connect to any SAP system, does not run ATC, and is only as current as the bundled snapshot — a system's own released-API list (ATC check API_RELEASE_STATE_CHECK / SAP_CP_READINESS) remains authoritative; treat an 'absent from the list' result as 'not-released as of the snapshot', not as proof. Example: check_released_api({ "objects": ["MARA", "I_Product", "BAPI_MATERIAL_GET_DETAIL"] }).

NameTypeReqDescription
objectsarrayyesObjects to check, 1–200 per call. Each is a bare name string or a { name, type? } object, e.g. ["MARA", { "name": "I_Product", "type": "CDS_STOB" }].
NameTypeReqDescription
resultsarrayyes
snapshotDatestringyesDate of the bundled SAP Cloudification snapshot these results reflect.
sourcestringyesURL of the SAP Apache-2.0 source the snapshot was built from.

No examples provided.

compare_abap ~464

Compare a BEFORE and an AFTER version of ABAP source and report what a rework actually changed: lint findings resolved and introduced (matched by content, so moved-but-unchanged code is not noise), cloud-blocker / score / A–D grade movement from the same dual-parse diff as check_cloud_readiness, and structural changes — classes, methods and FORMs added or removed. Use this when reviewing a refactor, a modernization step or an AI-generated rewrite of an existing object and you need an objective better-or-worse verdict instead of eyeballing a diff. It is not a textual diff tool (use git diff to see the edits) and it cannot judge functional equivalence — behavior can change while every number improves; it does not connect to any SAP system. Example: compare_abap({ "before": [ { "source": "REPORT zr.\nWRITE 1." } ], "after": [ { "source": "REPORT zr.\nWRITE 2." } ] }).

NameTypeReqDescription
abapVersionstringABAP language version both sides are linted against. "v758" (default) is current on-prem; "Cloud" is ABAP Cloud.
afterarrayyesThe AFTER sources — the reworked version being judged. Up to 32 files, 100k chars each.
beforearrayyesThe BEFORE sources — the current/old version of the object(s). Up to 32 files, 100k chars each.
focusstringCurated rule-pack lens: report only rules carrying this abaplint tag — "Performance" for a tuning pass, "Security" for a security sweep, "Styleguide" for Clean ABAP adherence. Parser errors always su…
presetstringLint preset applied identically to both sides: "style" (default) for isolated snippets, "full" when every referenced object is provided, "syntax-only" for parser errors only.
rulesobjectabaplint rule overrides applied to both sides, e.g. { "line_length": { "length": 120 } }.
NameTypeReqDescription
afterobjectyesLint and readiness numbers for the AFTER side.
beforeobjectyesLint and readiness numbers for the BEFORE side.
introducedarrayyesFindings present only after — regressions to fix.
matchNotestringyesHow findings were matched and what the numbers do and do not mean.
outlineChangesobjectyes
resolvedarrayyesFindings present before but gone after — improvements.
unchangedCountnumberyesFindings present on both sides (content-matched).

No examples provided.

explain_abap_rule ~152

Explain one abaplint rule in depth: title, description, extended rationale (often citing the Clean ABAP style guide), tags, documentation URL, and good/bad code examples where the rule defines them. Use this when a lint_abap or check_cloud_readiness finding needs justification — to explain to a developer why the finding matters and how to fix it. It does not run analysis and only knows abaplint rules; SAP ATC check documentation is out of scope. Example: explain_abap_rule({ "rule": "exit_or_check" }).

NameTypeReqDescription
rulestringyesThe abaplint rule key from a finding, e.g. "exit_or_check" or "obsolete_statement".
NameTypeReqDescription
badExamplestringCode the rule flags, if the rule ships an example.
docsUrlstringyesDocumentation URL.
extendedInformationstringyesExtended rationale; may cite Clean ABAP.
goodExamplestringThe compliant version, if the rule ships one.
keystringyesRule key.
shortDescriptionstringyesOne-line description.
tagsarrayyesabaplint tags.
titlestringyesRule title.

No examples provided.

format_abap ~162

Pretty-print one ABAP source: normalize keyword casing and indentation using abaplint's formatter — the offline equivalent of Pretty Printer in ADT/SE80. Use this when generated or hand-written ABAP has inconsistent casing/indentation and you want it normalized before review or commit. It does not reformat CDS views or behavior definitions, does not change any logic, and fails cleanly on source it cannot parse. Example: format_abap({ "source": "report ztest.\nwrite 'hi'." }).

NameTypeReqDescription
filenamestringabapGit-style name if known, e.g. "zcl_x.clas.abap"; inferred from the source when omitted.
sourcestringyesThe complete ABAP source to format.
NameTypeReqDescription
formattedstringyesThe pretty-printed source.

No examples provided.

get_abap_outline ~237

Return the structural outline of ABAP sources — classes (with methods, visibility, attributes, interfaces, inheritance), interfaces, and FORM routines — without you having to read the whole file. Use this when navigating a large class or legacy program to decide which part to read or edit next; it is the cheap first call before pulling thousands of lines into context. Set mermaid: true to also get the structure as a Mermaid classDiagram (inheritance, interface realization, method visibility) for documentation visuals. It does not return method bodies or analyze code quality (use lint_abap for that), and CDS/behavior-definition files yield an empty outline. Example: get_abap_outline({ "files": [ { "filename": "zcl_big.clas.abap", "source": "CLASS zcl_big DEFINITION…" } ] }).

NameTypeReqDescription
filesarrayyesSource files to analyze, up to 32 per call, 100k chars each.
mermaidbooleanAlso return the outline as Mermaid classDiagram source — render it anywhere Mermaid renders (GitHub, docs sites) for an instant structure diagram.
NameTypeReqDescription
mermaidstringMermaid classDiagram source for all files; present only when requested.
outlinesarrayyes

No examples provided.

lint_abap ~476

Run abaplint static analysis over ABAP, CDS or behavior-definition sources and return structured findings (rule key, message, severity, file/line/column, the offending line, and a docs URL per finding). Use this when you have written or modified ABAP code and want style and correctness feedback before it goes anywhere near a system — it runs entirely offline on the provided text. It does not connect to any SAP system, does not run ATC, and cannot judge whether referenced objects exist unless you provide them in the same call (preset "style", the default, skips whole-program checks for that reason; preset "full" enables them when you provide every dependency). A focus tag turns a pass into a themed review (performance / security / Clean ABAP style) without hand-picking rules; rule overrides layer a team's own pack on top. For an ABAP-Cloud migration verdict use check_cloud_readiness instead. Example: lint_abap({ "files": [ { "source": "REPORT ztest.\nDATA foo TYPE i.\nIF foo = 1.\nENDIF." } ] }).

NameTypeReqDescription
abapVersionstringABAP language version to parse against. "v758" (default) is current on-prem; "Cloud" is ABAP Cloud / Steampunk.
filesarrayyesSource files to analyze, up to 32 per call, 100k chars each.
focusstringCurated rule-pack lens: report only rules carrying this abaplint tag — "Performance" for a tuning pass, "Security" for a security sweep, "Styleguide" for Clean ABAP adherence. Parser errors always su…
presetstring"style" (default): abaplint default rules minus whole-program semantic checks — right for isolated snippets. "full": every default rule, expects all referenced objects provided. "syntax-only": parser…
rulesobjectabaplint rule overrides merged onto the preset (and onto a focus filter), e.g. { "line_length": { "length": 120 }, "7bit_ascii": false } — encode an org's best-practice pack here.
NameTypeReqDescription
fileCountnumberyesNumber of files analyzed.
findingsarrayyes
truncatedbooleanyesTrue if more than 500 findings existed and the list was cut.

No examples provided.

list_abap_rules ~175

List the abaplint rules this server can check, optionally filtered by a free-text query or a tag, returning key, title, one-line description, tags and a documentation URL per rule. Use this when deciding which rules to enable or override in lint_abap, or to discover what a Clean-ABAP-style check exists for. It does not run any analysis and does not change configuration — it is a read-only catalog. Example: list_abap_rules({ "query": "obsolete" }).

NameTypeReqDescription
querystringCase-insensitive substring matched against rule key, title and description, e.g. "select" or "obsolete".
tagstringFilter by abaplint tag, e.g. "Styleguide", "Security", "Performance", "Quickfix", "SingleFile".
NameTypeReqDescription
countnumberyesNumber of rules returned.
rulesarrayyes

No examples provided.

scaffold_rap_bo ~460

Generate the complete, canonical RAP managed business-object stack for one root entity: root CDS view entity, behavior definition (managed, strict(2), optional draft), behavior implementation class with handler locals, projection view with transactional_query, projection behavior definition, UI metadata extension, and an OData V4 service definition — plus a suggested table DDL, the activation order, and next steps. Use this when starting a new RAP business object in ABAP Cloud or S/4HANA and you want correct boilerplate that follows the SAP /DMO reference shape instead of writing it by hand. Generated classes and CDS views are round-trip validated through abaplint at ABAP-Cloud level before being returned; behavior and service definitions are canonical templates (abaplint does not parse those deeply) and ADT activation is the final check. It does not create the table or the service binding (binding is not a source artifact — create it in ADT), and it generates single-entity BOs: model compositions (parent-child) yourself for now. Example: scaffold_rap_bo({ "entityName": "Travel", "sqlTable": "ztravel", "keyField": "travel_id", "fields": [ { "name": "agency_id", "type": "abap.char(6)" } ], "draft": true }).

NameTypeReqDescription
draftbooleanGenerate draft handling (draft table reference, draft actions, use draft).
entityNamestringyesEntity name in UpperCamelCase, e.g. "Travel" — drives ZR_/ZC_/ZBP_/ZUI_ artifact names.
fieldsarrayNon-key business fields. Admin fields (created_by/created_at/…) are added automatically.
keyFieldstringyessnake_case key field of that table, e.g. "travel_id".
managedUuidKeybooleantrue (default): UUID key filled by managed numbering — modern RAP default. false: the caller provides the key on create.
prefixstringCustomer namespace prefix for all generated names.
sqlTablestringyesPersistent table the BO is backed by, e.g. "ztravel". Must start with the namespace prefix.
NameTypeReqDescription
activationOrderarrayyesThe order to create/activate artifacts in ADT.
filesarrayyes
nextStepsarrayyesWhat the generator cannot do for you (table, binding, draft table).
suggestedTableDdlstringyesStarting-point DDL for the persistent table; adjust types.
validationIssuesarrayyesabaplint findings on the generated sources — empty in normal operation.

No examples provided.