# io.github.palimkarakshay/abap-mcp (npm · abap-mcp)

Offline SAP ABAP static analysis, Clean Core readiness checks, and RAP scaffolding. No SAP system.

- Trust score: 66/100 (medium)
- Change this week: −10
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `abap-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/palimkarakshay-abap-mcp/abap-mcp.md), [page](https://verifymcp.io/servers/palimkarakshay-abap-mcp/abap-mcp)

## Channel facts

- Registry: `npm`
- Package: `abap-mcp`
- Version: `0.4.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (105 of 109), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 31 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 62/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2796 tokens (~310/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add palimkarakshay-abap-mcp -- npx -y abap-mcp
```

### Codex

```bash
codex mcp add palimkarakshay-abap-mcp -- npx -y abap-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "palimkarakshay-abap-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "abap-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add palimkarakshay-abap-mcp --command npx --arg -y --arg abap-mcp
```

### Hermes

```yaml
mcp_servers:
  palimkarakshay-abap-mcp:
    command: "npx"
    args: ["-y", "abap-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "palimkarakshay-abap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "abap-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +33)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Stability: unverified → 0.20
- [functional] Licence: MIT

### 2026-07-31 (score 33, −4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 37, −39)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT

### 2026-07-27 (score 76, +50)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-26 (score 26)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (9)

### `lint_abap` (~476 tokens)

Lint ABAP source

Run abaplint static analysis over ABAP, CDS or behavior-definition sources and return structured findings (rule key, message, severity, file/line/column, the offending line, and a docs URL per finding). Use this when you have written or modified ABAP code and want style and correctness feedback before it goes anywhere near a system — it runs entirely offline on the provided text. It does not connect to any SAP system, does not run ATC, and cannot judge whether referenced objects exist unless you provide them in the same call (preset "style", the default, skips whole-program checks for that reason; preset "full" enables them when you provide every dependency). A focus tag turns a pass into a themed review (performance / security / Clean ABAP style) without hand-picking rules; rule overrides layer a team's own pack on top. For an ABAP-Cloud migration verdict use check_cloud_readiness instead. Example: lint_abap({ "files": [ { "source": "REPORT ztest.\nDATA foo TYPE i.\nIF foo = 1.\nENDIF." } ] }).

Input parameters:

- `abapVersion` (string): ABAP language version to parse against. "v758" (default) is current on-prem; "Cloud" is ABAP Cloud / Steampunk.
- `files` (array, required): Source files to analyze, up to 32 per call, 100k chars each.
- `focus` (string): Curated rule-pack lens: report only rules carrying this abaplint tag — "Performance" for a tuning pass, "Security" for a security sweep, "Styleguide" for Clean ABAP adherence. Parser errors always su…
- `preset` (string): "style" (default): abaplint default rules minus whole-program semantic checks — right for isolated snippets. "full": every default rule, expects all referenced objects provided. "syntax-only": parser…
- `rules` (object): abaplint rule overrides merged onto the preset (and onto a focus filter), e.g. { "line_length": { "length": 120 }, "7bit_ascii": false } — encode an org's best-practice pack here.

Output parameters:

- `fileCount` (number): Number of files analyzed.
- `findings` (array)
- `truncated` (boolean): True if more than 500 findings existed and the list was cut.

### `check_cloud_readiness` (~310 tokens)

Check ABAP Cloud readiness

Assess how far ABAP source is from ABAP Cloud (Clean Core tier 1) by parsing it twice — once at a classic baseline (default v758) and once at version Cloud — and diffing: findings that appear only at Cloud are genuine cloud blockers (statements ABAP Cloud removed), reported in categories (dynpro, list output, native SQL, report events, …) with a transparent score, an A–D tech-debt grade and a verdict; findings already present at the baseline are reported separately as broken code, not migration work. Use this when someone asks 'is this code cloud-ready / Clean Core compliant / S/4HANA-cloud safe', before porting classic ABAP into an ABAP Cloud environment, or for a graded tech-debt assessment of an abapGit export. It is static and parser-level: it does not check released-API usage (that needs a system's ATC), does not connect to any SAP system, and a 'ready' verdict means no language-level blockers — not a certification. Example: check_cloud_readiness({ "files": [ { "source": "REPORT zold.\nWRITE: / 'hi'." } ] }).

Input parameters:

- `baselineVersion` (string): Classic ABAP version the code is assumed to run on today; used to separate broken-anyway code from cloud blockers.
- `files` (array, required): Source files to analyze, up to 32 per call, 100k chars each.

Output parameters:

- `baselineVersion` (string): The baseline used.
- `brokenAtBaseline` (array): Findings that fail even at the baseline version — fix first, they are not migration items.
- `categories` (array)
- `cloudBlockerCount` (number): Statements valid at the baseline but not in ABAP Cloud.
- `fileCount` (number): Files analyzed — the denominator of the grade's density banding.
- `grade` (string): Clean Core tech-debt grade banded on blocker density: A = no blockers, B = ≤ 0.5 blockers/file, C = ≤ 2 blockers/file, D = more. The same objective count as the score, sized for assessment reports.
- `releasedApiFindings` (array): Released-API observations from the bundled SAP Cloudification snapshot (deprecated-API usage, direct non-released table access with successor hints). Informational — NOT counted in cloudBlockerCount…
- `releasedApiSnapshotDate` (string): Date of the bundled released-API snapshot the releasedApiFindings reflect.
- `scopeNote` (string): Exactly what this check does and does not cover.
- `score` (number): 100 − 5×blockers, floored at 0. Transparent, not an oracle.
- `verdict` (string): Banded verdict from the blocker count (0 / ≤5 / ≤20 / >20).

### `compare_abap` (~464 tokens)

Compare two ABAP versions

Compare a BEFORE and an AFTER version of ABAP source and report what a rework actually changed: lint findings resolved and introduced (matched by content, so moved-but-unchanged code is not noise), cloud-blocker / score / A–D grade movement from the same dual-parse diff as check_cloud_readiness, and structural changes — classes, methods and FORMs added or removed. Use this when reviewing a refactor, a modernization step or an AI-generated rewrite of an existing object and you need an objective better-or-worse verdict instead of eyeballing a diff. It is not a textual diff tool (use git diff to see the edits) and it cannot judge functional equivalence — behavior can change while every number improves; it does not connect to any SAP system. Example: compare_abap({ "before": [ { "source": "REPORT zr.\nWRITE 1." } ], "after": [ { "source": "REPORT zr.\nWRITE 2." } ] }).

Input parameters:

- `abapVersion` (string): ABAP language version both sides are linted against. "v758" (default) is current on-prem; "Cloud" is ABAP Cloud.
- `after` (array, required): The AFTER sources — the reworked version being judged. Up to 32 files, 100k chars each.
- `before` (array, required): The BEFORE sources — the current/old version of the object(s). Up to 32 files, 100k chars each.
- `focus` (string): Curated rule-pack lens: report only rules carrying this abaplint tag — "Performance" for a tuning pass, "Security" for a security sweep, "Styleguide" for Clean ABAP adherence. Parser errors always su…
- `preset` (string): Lint preset applied identically to both sides: "style" (default) for isolated snippets, "full" when every referenced object is provided, "syntax-only" for parser errors only.
- `rules` (object): abaplint rule overrides applied to both sides, e.g. { "line_length": { "length": 120 } }.

Output parameters:

- `after` (object): Lint and readiness numbers for the AFTER side.
- `before` (object): Lint and readiness numbers for the BEFORE side.
- `introduced` (array): Findings present only after — regressions to fix.
- `matchNote` (string): How findings were matched and what the numbers do and do not mean.
- `outlineChanges` (object)
- `resolved` (array): Findings present before but gone after — improvements.
- `unchangedCount` (number): Findings present on both sides (content-matched).

### `scaffold_rap_bo` (~460 tokens)

Scaffold a RAP business object

Generate the complete, canonical RAP managed business-object stack for one root entity: root CDS view entity, behavior definition (managed, strict(2), optional draft), behavior implementation class with handler locals, projection view with transactional_query, projection behavior definition, UI metadata extension, and an OData V4 service definition — plus a suggested table DDL, the activation order, and next steps. Use this when starting a new RAP business object in ABAP Cloud or S/4HANA and you want correct boilerplate that follows the SAP /DMO reference shape instead of writing it by hand. Generated classes and CDS views are round-trip validated through abaplint at ABAP-Cloud level before being returned; behavior and service definitions are canonical templates (abaplint does not parse those deeply) and ADT activation is the final check. It does not create the table or the service binding (binding is not a source artifact — create it in ADT), and it generates single-entity BOs: model compositions (parent-child) yourself for now. Example: scaffold_rap_bo({ "entityName": "Travel", "sqlTable": "ztravel", "keyField": "travel_id", "fields": [ { "name": "agency_id", "type": "abap.char(6)" } ], "draft": true }).

Input parameters:

- `draft` (boolean): Generate draft handling (draft table reference, draft actions, use draft).
- `entityName` (string, required): Entity name in UpperCamelCase, e.g. "Travel" — drives ZR_/ZC_/ZBP_/ZUI_ artifact names.
- `fields` (array): Non-key business fields. Admin fields (created_by/created_at/…) are added automatically.
- `keyField` (string, required): snake_case key field of that table, e.g. "travel_id".
- `managedUuidKey` (boolean): true (default): UUID key filled by managed numbering — modern RAP default. false: the caller provides the key on create.
- `prefix` (string): Customer namespace prefix for all generated names.
- `sqlTable` (string, required): Persistent table the BO is backed by, e.g. "ztravel". Must start with the namespace prefix.

Output parameters:

- `activationOrder` (array): The order to create/activate artifacts in ADT.
- `files` (array)
- `nextSteps` (array): What the generator cannot do for you (table, binding, draft table).
- `suggestedTableDdl` (string): Starting-point DDL for the persistent table; adjust types.
- `validationIssues` (array): abaplint findings on the generated sources — empty in normal operation.

### `check_released_api` (~360 tokens)

Check ABAP released-API status

Look up ABAP repository objects (DB tables, CDS view entities, function modules, classes, interfaces, …) in SAP's published ABAP Cloudification list and report, per object, whether it is a 'released' API (safe to use in ABAP Cloud / Clean Core), 'deprecated' (released but being retired), or 'not-released' (a classic/internal object that is not a public API — e.g. most classic DDIC tables) — with a curated CDS successor hint for common tables. This reflects SAP's official Cloudification list as bundled in this package (snapshot 2026-06-10); it ships offline with the server. Use this when you need to know if your code may reference a given object in ABAP Cloud, or which released CDS view to use instead of a classic table — the released-API half of readiness that check_cloud_readiness deliberately leaves to a system's ATC. It does not connect to any SAP system, does not run ATC, and is only as current as the bundled snapshot — a system's own released-API list (ATC check API_RELEASE_STATE_CHECK / SAP_CP_READINESS) remains authoritative; treat an 'absent from the list' result as 'not-released as of the snapshot', not as proof. Example: check_released_api({ "objects": ["MARA", "I_Product", "BAPI_MATERIAL_GET_DETAIL"] }).

Input parameters:

- `objects` (array, required): Objects to check, 1–200 per call. Each is a bare name string or a { name, type? } object, e.g. ["MARA", { "name": "I_Product", "type": "CDS_STOB" }].

Output parameters:

- `results` (array)
- `snapshotDate` (string): Date of the bundled SAP Cloudification snapshot these results reflect.
- `source` (string): URL of the SAP Apache-2.0 source the snapshot was built from.

### `list_abap_rules` (~175 tokens)

List abaplint rules

List the abaplint rules this server can check, optionally filtered by a free-text query or a tag, returning key, title, one-line description, tags and a documentation URL per rule. Use this when deciding which rules to enable or override in lint_abap, or to discover what a Clean-ABAP-style check exists for. It does not run any analysis and does not change configuration — it is a read-only catalog. Example: list_abap_rules({ "query": "obsolete" }).

Input parameters:

- `query` (string): Case-insensitive substring matched against rule key, title and description, e.g. "select" or "obsolete".
- `tag` (string): Filter by abaplint tag, e.g. "Styleguide", "Security", "Performance", "Quickfix", "SingleFile".

Output parameters:

- `count` (number): Number of rules returned.
- `rules` (array)

### `explain_abap_rule` (~152 tokens)

Explain an abaplint rule

Explain one abaplint rule in depth: title, description, extended rationale (often citing the Clean ABAP style guide), tags, documentation URL, and good/bad code examples where the rule defines them. Use this when a lint_abap or check_cloud_readiness finding needs justification — to explain to a developer why the finding matters and how to fix it. It does not run analysis and only knows abaplint rules; SAP ATC check documentation is out of scope. Example: explain_abap_rule({ "rule": "exit_or_check" }).

Input parameters:

- `rule` (string, required): The abaplint rule key from a finding, e.g. "exit_or_check" or "obsolete_statement".

Output parameters:

- `badExample` (string): Code the rule flags, if the rule ships an example.
- `docsUrl` (string): Documentation URL.
- `extendedInformation` (string): Extended rationale; may cite Clean ABAP.
- `goodExample` (string): The compliant version, if the rule ships one.
- `key` (string): Rule key.
- `shortDescription` (string): One-line description.
- `tags` (array): abaplint tags.
- `title` (string): Rule title.

### `format_abap` (~162 tokens)

Format ABAP source

Pretty-print one ABAP source: normalize keyword casing and indentation using abaplint's formatter — the offline equivalent of Pretty Printer in ADT/SE80. Use this when generated or hand-written ABAP has inconsistent casing/indentation and you want it normalized before review or commit. It does not reformat CDS views or behavior definitions, does not change any logic, and fails cleanly on source it cannot parse. Example: format_abap({ "source": "report ztest.\nwrite 'hi'." }).

Input parameters:

- `filename` (string): abapGit-style name if known, e.g. "zcl_x.clas.abap"; inferred from the source when omitted.
- `source` (string, required): The complete ABAP source to format.

Output parameters:

- `formatted` (string): The pretty-printed source.

### `get_abap_outline` (~237 tokens)

Get ABAP source outline

Return the structural outline of ABAP sources — classes (with methods, visibility, attributes, interfaces, inheritance), interfaces, and FORM routines — without you having to read the whole file. Use this when navigating a large class or legacy program to decide which part to read or edit next; it is the cheap first call before pulling thousands of lines into context. Set mermaid: true to also get the structure as a Mermaid classDiagram (inheritance, interface realization, method visibility) for documentation visuals. It does not return method bodies or analyze code quality (use lint_abap for that), and CDS/behavior-definition files yield an empty outline. Example: get_abap_outline({ "files": [ { "filename": "zcl_big.clas.abap", "source": "CLASS zcl_big DEFINITION…" } ] }).

Input parameters:

- `files` (array, required): Source files to analyze, up to 32 per call, 100k chars each.
- `mermaid` (boolean): Also return the outline as Mermaid classDiagram source — render it anywhere Mermaid renders (GitHub, docs sites) for an instant structure diagram.

Output parameters:

- `mermaid` (string): Mermaid classDiagram source for all files; present only when requested.
- `outlines` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/palimkarakshay-abap-mcp/abap-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 33
- 2026-07-31: 33
- 2026-07-30: 37
- 2026-07-28: 76
- 2026-07-27: 76
- 2026-07-26: 26

## Links

- npm package: https://www.npmjs.com/package/abap-mcp
- Socket report: https://socket.dev/npm/package/abap-mcp
- Repository: https://github.com/palimkarakshay/abap-mcp
- Changelog RSS feed: https://verifymcp.io/servers/palimkarakshay-abap-mcp/abap-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/palimkarakshay-abap-mcp/abap-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/palimkarakshay-abap-mcp/abap-mcp