io.github.palimkarakshay/abap-mcp
NPM · ABAP-MCP · SCANNED AUG 3
Offline SAP ABAP static analysis, Clean Core readiness checks, and RAP scaffolding. No SAP system.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 31 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2796 tokens (~310/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · abap-mcp
claude mcp add palimkarakshay-abap-mcp -- npx -y abap-mcp
codex mcp add palimkarakshay-abap-mcp -- npx -y abap-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"palimkarakshay-abap-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"abap-mcp"
],
"enabled": true
}
}
} openclaw mcp add palimkarakshay-abap-mcp --command npx --arg -y --arg abap-mcp
mcp_servers:
palimkarakshay-abap-mcp:
command: "npx"
args: ["-y", "abap-mcp"] {
"mcpServers": {
"palimkarakshay-abap-mcp": {
"command": "npx",
"args": [
"-y",
"abap-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +33
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Stability: unverified → 0.20 ▲ functional
- Licence: MIT functional
- 31 Jul 26 −4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −39
- Known CVEs: partial → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Provenance: fail → unverified ▼ security
- Install scripts: pass → unverified ▼ security
- License: pass → unverified ▼ functional
- Dependency health: partial → unverified ▼ functional
- Maintenance: pass → unverified ▼ functional
- Licence: MIT functional
- 27 Jul 26 +50
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Security disclosure: unverified → fail ▼ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Tool coverage: 100 functional
- First check of Tool coverage: 100 functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- Licence: MIT functional
- 26 Jul 26 26
First indexed and scored.
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 105 packages
105 packages in the resolved dependency tree · 104 deprecated · 30 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
check_cloud_readiness Check ABAP Cloud readiness ~310
Assess how far ABAP source is from ABAP Cloud (Clean Core tier 1) by parsing it twice — once at a classic baseline (default v758) and once at version Cloud — and diffing: findings that appear only at Cloud are genuine cloud blockers (statements ABAP Cloud removed), reported in categories (dynpro, list output, native SQL, report events, …) with a transparent score, an A–D tech-debt grade and a verdict; findings already present at the baseline are reported separately as broken code, not migration work. Use this when someone asks 'is this code cloud-ready / Clean Core compliant / S/4HANA-cloud safe', before porting classic ABAP into an ABAP Cloud environment, or for a graded tech-debt assessment of an abapGit export. It is static and parser-level: it does not check released-API usage (that needs a system's ATC), does not connect to any SAP system, and a 'ready' verdict means no language-level blockers — not a certification. Example: check_cloud_readiness({ "files": [ { "source": "REPORT zold.\nWRITE: / 'hi'." } ] }).
| Name | Type | Req | Description |
|---|---|---|---|
| baselineVersion | string | — | Classic ABAP version the code is assumed to run on today; used to separate broken-anyway code from cloud blockers. |
| files | array | yes | Source files to analyze, up to 32 per call, 100k chars each. |
| Name | Type | Req | Description |
|---|---|---|---|
| baselineVersion | string | yes | The baseline used. |
| brokenAtBaseline | array | yes | Findings that fail even at the baseline version — fix first, they are not migration items. |
| categories | array | yes | — |
| cloudBlockerCount | number | yes | Statements valid at the baseline but not in ABAP Cloud. |
| fileCount | number | yes | Files analyzed — the denominator of the grade's density banding. |
| grade | string | yes | Clean Core tech-debt grade banded on blocker density: A = no blockers, B = ≤ 0.5 blockers/file, C = ≤ 2 blockers/file, D = more. The same objective count as the score, sized for assessment reports. |
| releasedApiFindings | array | yes | Released-API observations from the bundled SAP Cloudification snapshot (deprecated-API usage, direct non-released table access with successor hints). Informational — NOT counted in cloudBlockerCount… |
| releasedApiSnapshotDate | string | yes | Date of the bundled released-API snapshot the releasedApiFindings reflect. |
| scopeNote | string | yes | Exactly what this check does and does not cover. |
| score | number | yes | 100 − 5×blockers, floored at 0. Transparent, not an oracle. |
| verdict | string | yes | Banded verdict from the blocker count (0 / ≤5 / ≤20 / >20). |
No examples provided.
check_released_api Check ABAP released-API status ~360
Look up ABAP repository objects (DB tables, CDS view entities, function modules, classes, interfaces, …) in SAP's published ABAP Cloudification list and report, per object, whether it is a 'released' API (safe to use in ABAP Cloud / Clean Core), 'deprecated' (released but being retired), or 'not-released' (a classic/internal object that is not a public API — e.g. most classic DDIC tables) — with a curated CDS successor hint for common tables. This reflects SAP's official Cloudification list as bundled in this package (snapshot 2026-06-10); it ships offline with the server. Use this when you need to know if your code may reference a given object in ABAP Cloud, or which released CDS view to use instead of a classic table — the released-API half of readiness that check_cloud_readiness deliberately leaves to a system's ATC. It does not connect to any SAP system, does not run ATC, and is only as current as the bundled snapshot — a system's own released-API list (ATC check API_RELEASE_STATE_CHECK / SAP_CP_READINESS) remains authoritative; treat an 'absent from the list' result as 'not-released as of the snapshot', not as proof. Example: check_released_api({ "objects": ["MARA", "I_Product", "BAPI_MATERIAL_GET_DETAIL"] }).
| Name | Type | Req | Description |
|---|---|---|---|
| objects | array | yes | Objects to check, 1–200 per call. Each is a bare name string or a { name, type? } object, e.g. ["MARA", { "name": "I_Product", "type": "CDS_STOB" }]. |
| Name | Type | Req | Description |
|---|---|---|---|
| results | array | yes | — |
| snapshotDate | string | yes | Date of the bundled SAP Cloudification snapshot these results reflect. |
| source | string | yes | URL of the SAP Apache-2.0 source the snapshot was built from. |
No examples provided.
compare_abap Compare two ABAP versions ~464
Compare a BEFORE and an AFTER version of ABAP source and report what a rework actually changed: lint findings resolved and introduced (matched by content, so moved-but-unchanged code is not noise), cloud-blocker / score / A–D grade movement from the same dual-parse diff as check_cloud_readiness, and structural changes — classes, methods and FORMs added or removed. Use this when reviewing a refactor, a modernization step or an AI-generated rewrite of an existing object and you need an objective better-or-worse verdict instead of eyeballing a diff. It is not a textual diff tool (use git diff to see the edits) and it cannot judge functional equivalence — behavior can change while every number improves; it does not connect to any SAP system. Example: compare_abap({ "before": [ { "source": "REPORT zr.\nWRITE 1." } ], "after": [ { "source": "REPORT zr.\nWRITE 2." } ] }).
| Name | Type | Req | Description |
|---|---|---|---|
| abapVersion | string | — | ABAP language version both sides are linted against. "v758" (default) is current on-prem; "Cloud" is ABAP Cloud. |
| after | array | yes | The AFTER sources — the reworked version being judged. Up to 32 files, 100k chars each. |
| before | array | yes | The BEFORE sources — the current/old version of the object(s). Up to 32 files, 100k chars each. |
| focus | string | — | Curated rule-pack lens: report only rules carrying this abaplint tag — "Performance" for a tuning pass, "Security" for a security sweep, "Styleguide" for Clean ABAP adherence. Parser errors always su… |
| preset | string | — | Lint preset applied identically to both sides: "style" (default) for isolated snippets, "full" when every referenced object is provided, "syntax-only" for parser errors only. |
| rules | object | — | abaplint rule overrides applied to both sides, e.g. { "line_length": { "length": 120 } }. |
| Name | Type | Req | Description |
|---|---|---|---|
| after | object | yes | Lint and readiness numbers for the AFTER side. |
| before | object | yes | Lint and readiness numbers for the BEFORE side. |
| introduced | array | yes | Findings present only after — regressions to fix. |
| matchNote | string | yes | How findings were matched and what the numbers do and do not mean. |
| outlineChanges | object | yes | — |
| resolved | array | yes | Findings present before but gone after — improvements. |
| unchangedCount | number | yes | Findings present on both sides (content-matched). |
No examples provided.
explain_abap_rule Explain an abaplint rule ~152
Explain one abaplint rule in depth: title, description, extended rationale (often citing the Clean ABAP style guide), tags, documentation URL, and good/bad code examples where the rule defines them. Use this when a lint_abap or check_cloud_readiness finding needs justification — to explain to a developer why the finding matters and how to fix it. It does not run analysis and only knows abaplint rules; SAP ATC check documentation is out of scope. Example: explain_abap_rule({ "rule": "exit_or_check" }).
| Name | Type | Req | Description |
|---|---|---|---|
| rule | string | yes | The abaplint rule key from a finding, e.g. "exit_or_check" or "obsolete_statement". |
| Name | Type | Req | Description |
|---|---|---|---|
| badExample | string | — | Code the rule flags, if the rule ships an example. |
| docsUrl | string | yes | Documentation URL. |
| extendedInformation | string | yes | Extended rationale; may cite Clean ABAP. |
| goodExample | string | — | The compliant version, if the rule ships one. |
| key | string | yes | Rule key. |
| shortDescription | string | yes | One-line description. |
| tags | array | yes | abaplint tags. |
| title | string | yes | Rule title. |
No examples provided.
format_abap Format ABAP source ~162
Pretty-print one ABAP source: normalize keyword casing and indentation using abaplint's formatter — the offline equivalent of Pretty Printer in ADT/SE80. Use this when generated or hand-written ABAP has inconsistent casing/indentation and you want it normalized before review or commit. It does not reformat CDS views or behavior definitions, does not change any logic, and fails cleanly on source it cannot parse. Example: format_abap({ "source": "report ztest.\nwrite 'hi'." }).
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | — | abapGit-style name if known, e.g. "zcl_x.clas.abap"; inferred from the source when omitted. |
| source | string | yes | The complete ABAP source to format. |
| Name | Type | Req | Description |
|---|---|---|---|
| formatted | string | yes | The pretty-printed source. |
No examples provided.
get_abap_outline Get ABAP source outline ~237
Return the structural outline of ABAP sources — classes (with methods, visibility, attributes, interfaces, inheritance), interfaces, and FORM routines — without you having to read the whole file. Use this when navigating a large class or legacy program to decide which part to read or edit next; it is the cheap first call before pulling thousands of lines into context. Set mermaid: true to also get the structure as a Mermaid classDiagram (inheritance, interface realization, method visibility) for documentation visuals. It does not return method bodies or analyze code quality (use lint_abap for that), and CDS/behavior-definition files yield an empty outline. Example: get_abap_outline({ "files": [ { "filename": "zcl_big.clas.abap", "source": "CLASS zcl_big DEFINITION…" } ] }).
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | Source files to analyze, up to 32 per call, 100k chars each. |
| mermaid | boolean | — | Also return the outline as Mermaid classDiagram source — render it anywhere Mermaid renders (GitHub, docs sites) for an instant structure diagram. |
| Name | Type | Req | Description |
|---|---|---|---|
| mermaid | string | — | Mermaid classDiagram source for all files; present only when requested. |
| outlines | array | yes | — |
No examples provided.
lint_abap Lint ABAP source ~476
Run abaplint static analysis over ABAP, CDS or behavior-definition sources and return structured findings (rule key, message, severity, file/line/column, the offending line, and a docs URL per finding). Use this when you have written or modified ABAP code and want style and correctness feedback before it goes anywhere near a system — it runs entirely offline on the provided text. It does not connect to any SAP system, does not run ATC, and cannot judge whether referenced objects exist unless you provide them in the same call (preset "style", the default, skips whole-program checks for that reason; preset "full" enables them when you provide every dependency). A focus tag turns a pass into a themed review (performance / security / Clean ABAP style) without hand-picking rules; rule overrides layer a team's own pack on top. For an ABAP-Cloud migration verdict use check_cloud_readiness instead. Example: lint_abap({ "files": [ { "source": "REPORT ztest.\nDATA foo TYPE i.\nIF foo = 1.\nENDIF." } ] }).
| Name | Type | Req | Description |
|---|---|---|---|
| abapVersion | string | — | ABAP language version to parse against. "v758" (default) is current on-prem; "Cloud" is ABAP Cloud / Steampunk. |
| files | array | yes | Source files to analyze, up to 32 per call, 100k chars each. |
| focus | string | — | Curated rule-pack lens: report only rules carrying this abaplint tag — "Performance" for a tuning pass, "Security" for a security sweep, "Styleguide" for Clean ABAP adherence. Parser errors always su… |
| preset | string | — | "style" (default): abaplint default rules minus whole-program semantic checks — right for isolated snippets. "full": every default rule, expects all referenced objects provided. "syntax-only": parser… |
| rules | object | — | abaplint rule overrides merged onto the preset (and onto a focus filter), e.g. { "line_length": { "length": 120 }, "7bit_ascii": false } — encode an org's best-practice pack here. |
| Name | Type | Req | Description |
|---|---|---|---|
| fileCount | number | yes | Number of files analyzed. |
| findings | array | yes | — |
| truncated | boolean | yes | True if more than 500 findings existed and the list was cut. |
No examples provided.
list_abap_rules List abaplint rules ~175
List the abaplint rules this server can check, optionally filtered by a free-text query or a tag, returning key, title, one-line description, tags and a documentation URL per rule. Use this when deciding which rules to enable or override in lint_abap, or to discover what a Clean-ABAP-style check exists for. It does not run any analysis and does not change configuration — it is a read-only catalog. Example: list_abap_rules({ "query": "obsolete" }).
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | — | Case-insensitive substring matched against rule key, title and description, e.g. "select" or "obsolete". |
| tag | string | — | Filter by abaplint tag, e.g. "Styleguide", "Security", "Performance", "Quickfix", "SingleFile". |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of rules returned. |
| rules | array | yes | — |
No examples provided.
scaffold_rap_bo Scaffold a RAP business object ~460
Generate the complete, canonical RAP managed business-object stack for one root entity: root CDS view entity, behavior definition (managed, strict(2), optional draft), behavior implementation class with handler locals, projection view with transactional_query, projection behavior definition, UI metadata extension, and an OData V4 service definition — plus a suggested table DDL, the activation order, and next steps. Use this when starting a new RAP business object in ABAP Cloud or S/4HANA and you want correct boilerplate that follows the SAP /DMO reference shape instead of writing it by hand. Generated classes and CDS views are round-trip validated through abaplint at ABAP-Cloud level before being returned; behavior and service definitions are canonical templates (abaplint does not parse those deeply) and ADT activation is the final check. It does not create the table or the service binding (binding is not a source artifact — create it in ADT), and it generates single-entity BOs: model compositions (parent-child) yourself for now. Example: scaffold_rap_bo({ "entityName": "Travel", "sqlTable": "ztravel", "keyField": "travel_id", "fields": [ { "name": "agency_id", "type": "abap.char(6)" } ], "draft": true }).
| Name | Type | Req | Description |
|---|---|---|---|
| draft | boolean | — | Generate draft handling (draft table reference, draft actions, use draft). |
| entityName | string | yes | Entity name in UpperCamelCase, e.g. "Travel" — drives ZR_/ZC_/ZBP_/ZUI_ artifact names. |
| fields | array | — | Non-key business fields. Admin fields (created_by/created_at/…) are added automatically. |
| keyField | string | yes | snake_case key field of that table, e.g. "travel_id". |
| managedUuidKey | boolean | — | true (default): UUID key filled by managed numbering — modern RAP default. false: the caller provides the key on create. |
| prefix | string | — | Customer namespace prefix for all generated names. |
| sqlTable | string | yes | Persistent table the BO is backed by, e.g. "ztravel". Must start with the namespace prefix. |
| Name | Type | Req | Description |
|---|---|---|---|
| activationOrder | array | yes | The order to create/activate artifacts in ADT. |
| files | array | yes | — |
| nextSteps | array | yes | What the generator cannot do for you (table, binding, draft table). |
| suggestedTableDdl | string | yes | Starting-point DDL for the persistent table; adjust types. |
| validationIssues | array | yes | abaplint findings on the generated sources — empty in normal operation. |
No examples provided.