io.github.SAP/fiori-mcp-server

NPM · @SAP-UX/FIORI-MCP-SERVER · SCANNED AUG 3

SAP Fiori - Model Context Protocol (MCP) server

Available components

−41 this week 38 38 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security63

No malware found by supply-chain analysis.Pass
CVE data not yet available for this package.Unverified
No install/post-install scripts declared.Pass
Dependency-health data not yet available.Unverified

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to SAP/open-ux-tools). View diagnostics → Pass
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability0

Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.Unverified

Stability & Change Management0

Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.Unverified

Tool Coverage0

Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.Unverified

Capabilities0

Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.Unverified

Unverified: 4 categories

Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you. How we score packages →

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @sap-ux/fiori-mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add sap-fiori-mcp-server -- npx -y @sap-ux/fiori-mcp-server

# add to Codex CLI

codex mcp add sap-fiori-mcp-server -- npx -y @sap-ux/fiori-mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sap-fiori-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sap-ux/fiori-mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add sap-fiori-mcp-server --command npx --arg -y --arg @sap-ux/fiori-mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  sap-fiori-mcp-server:
    command: "npx"
    args: ["-y", "@sap-ux/fiori-mcp-server"]

// mcp.json

{
  "mcpServers": {
    "sap-fiori-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@sap-ux/fiori-mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 −33
- Stability: 0.20 → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Dependency health: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Package version: 1.11.4 → 1.11.5 functional
2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
1 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
31 Jul 26 +14
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 0
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 1.11.0 → 1.11.3 functional
29 Jul 26 0
- Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess. functional
- Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess. functional
28 Jul 26 −38
- Malware scan: pass → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- Package version: 1.11.0 → 1.11.2 functional
27 Jul 26 +20
- Tool coverage: unverified → 100 ▲ functional
- First check of Tool coverage: 60 functional
- First check of Schema quality: fail functional
- First check of Schema quality: poor functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 67 functional

Show 5 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@sap-ux/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: SAP/open-ux-tools
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/SAP/open-ux-tools/.github/workflows/pipeline.yml@refs/heads/main
Rekor log index:: 2334014364
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:6a7072a0522fc6fce12399e8aac339ffc35cffb4aa7bcb6f979f7195aebf4b7d9242fb7f0cb2530025b4d25ff5e5a4bd64e5e9ee96b32e42466487acb
Discovery method:: attestation_endpoint

MCP tools — 9 exposed · ~2,182 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

download_odata_service_metadata ~449

Downloads the metadata (EDMX) of a specific OData service URL from a SAP system and saves it as metadata.xml. Note: this tool replaces the old 'fetch-service-metadata' functionality that was previously available via the 'execute_functionality' workflow — use this tool directly instead. Usage guidelines: - Use this before calling 'generate_fiori_app_odata' when the user provides a SAP system reference and a service path. - If a service name or technical id is provided instead of a service path DO NOT USE THIS TOOL. Instead use the Service Center MCP server tool to retrieve the service metadata and then pass it to 'generate_fiori_app_odata'. - If a service path is provided by the user, use it directly via servicePath parameter. - If the user provides a system name or host, use 'list_sap_systems' first to resolve it. - Pass the full URL as sapSystemQuery. - Returns host, servicePath, client, and metadataFilePath inside the result's parameters object. - Pass ALL returned fields directly into the service config of 'generate_fiori_app_odata'. Map the returned properties to the app config service property input to 'generate_fiori_app_odata'. - **Note:** This tool is only supported in VSCode. For SAP Business Application Studio, use the Service Center MCP server tool to retrieve the service metadata instead. **IMPORTANT**: On VSCode, if the service requires authentication and the system is not already stored, ask the user to store it first. Do not ask for credentials directly.

Input Output Examples

Name	Type	Req	Description
appPath	string	yes	Absolute path to the folder where metadata.xml will be saved. Typically the project target folder.
sapSystemQuery	string	—	The name, host or a URL of the SAP system to fetch service metadata from.
servicePath	string	—	The path to the SAP service to fetch metadata for. ONLY use this if the user provides an EXACT path (e.g., "/sap/opu/odata/sap/ZUI_TRAVEL_O4/"). DO NOT construct paths from service names. This parame…

Name	Type	Req	Description
appPath	string	yes	—
changes	array	yes	—
message	string	yes	—
parameters	object	yes	—
status	string	yes	—
timestamp	string	yes	—

No examples provided.

execute_functionality ~126

**(Step 3 of 3)** Executes a specific functionality to modify an existing SAP Fiori application with provided parameters. This is the **final step** of the workflow and performs the actual modification. You MUST provide the exact parameter information obtained from get_functionality_details (Step 2).

Input Output Examples

Name	Type	Req	Description
appPath	string	yes	Path to the Fiori application if one exists or to the current directory. Path should be an absolute path.
functionalityId	—	yes	The ID of the functionality to execute
parameters	object	yes	Parameters for the functionality execution

Name	Type	Req	Description
appPath	string	yes	—
changes	array	yes	—
functionalityId	—	yes	—
message	string	yes	—
parameters	—	yes	—
status	string	yes	—
timestamp	string	yes	—

No examples provided.

generate_fiori_app_cap ~142

Creates (generates) a new SAP Fiori UI application within an existing CAP project. To populate parameters, you **MUST** use the ***CDS MCP*** to search the model for service definitions, entities, associations, and UI annotations. As a fallback, only if no such tool is available, manually read and parse all .cds files in the projectPath. The configuration **MUST** be a valid JSON object matching the tool's inputSchema and based on the project files.

Input Output Examples

Name	Type	Req	Description
entityConfig	object	—	—
floorplan	—	yes	—
project	object	yes	—
service	object	—	—

No output schema declared.

No examples provided.

generate_fiori_app_odata ~750

Creates (generates) a new SAP Fiori UI application either within an existing CAP project or standalone. ALWAYS read ALL of the following instructions carefully before calling this tool. 🚨 CRITICAL - READ SCHEMA FIRST 🚨 Before calling this tool, you MUST: 1. Examine the inputSchema below to understand the EXACT structure required 2. The input MUST match the schema type 'GeneratorConfigOData' with these TOP-LEVEL properties: - floorplan (must be: 'FE_LROP', 'FE_OVP', 'FE_ALP', 'FE_WORKLIST', 'FE_FEOP', 'FE_FPM', 'FF_SIMPLE', required) - project (object, required) - service (object, optional) - entityConfig (object, optional) 3. DO NOT create properties like "config", or any other structure - use ONLY the properties defined in inputSchema Steps: 1. Construct the tool arguments. - **IMPORTANT** ALWAYS use the app config schema defined by the type 'GeneratorConfigOData' to create the input structure. NEVER create an input in any other format. - The input MUST use the exact property names defined in the inputSchema: floorplan, project, service, entityConfig. - **ONLY** if the Service Center MCP is NOT available and the user provided a SAP system reference or URL with a **service path**, you **MUST** first call 'download_odata_service_metadata'. - If the Service Center MCP is available and the user provided a **service name or technical service id**, you **MUST** call the Service Center MCP server tool to retrieve the metadata and properties required for the service property of the input. - Use the data returned to provide the required values (host, servicePath, client, destination, metadataFilePath) directly in the service property of the input. - If the Service Center MCP was used both host and destination **MUST** be passed in the service property of the input. - If Fiori MCP 'download_odat…

Input Output Examples

Name	Type	Req	Description
entityConfig	object	—	—
floorplan	—	yes	—
project	object	yes	—
service	object	—	—

No output schema declared.

No examples provided.

get_functionality_details ~126

**(Step 2 of 3)** Gets the required parameters and detailed information for a specific functionality to modify an existing SAP Fiori application. You MUST provide a functionalityId obtained from 'list_functionality' (Step 1). The output of this tool is required for the final step 'execute_functionality' (Step 3).

Input Output Examples

Name	Type	Req	Description
appPath	string	yes	Path to the Fiori application if one exists or to the current directory. Path should be an absolute path.
functionalityId	—	yes	The ID of the functionality to get details for

Name	Type	Req	Description
description	string	yes	—
examples	array	—	—
functionalityId	—	yes	Identifier to pass as the `functionalityId` parameter when calling `get_functionality_details` or `execute_functionality`
impact	string	—	—
name	string	yes	—
pageName	string	—	—
parameters	object	yes	—
prerequisites	array	—	—
technicalDescription	string	—	—

No examples provided.

list_fiori_apps ~112

Scans a specified directory to find existing SAP Fiori applications that can be modified. This is an optional, preliminary tool. **Use this first ONLY if the target application's name or path is not already known.** The output can be used to ask the user for clarification before starting the main 3-step workflow.

Input Output Examples

Name	Type	Req	Description
searchPath	array	yes	Path to search for Fiori applications (defaults to current directory). If VSCode - list of VS Code workspace folder paths(`workspace.workspaceFolders`)

Name	Type	Req	Description
applications	array	yes	—

No examples provided.

list_functionality ~261

**(Step 1 of 3) — Use this to modify an existing SAP Fiori application.** Returns the complete list of supported modification operations for a given application, including: adding or deleting pages, creating controller extensions, and changing any Fiori Elements manifest property. This is the **first mandatory step** for modifying an existing app and requires a valid absolute path to a SAP Fiori application. You MUST use a functionalityId from this tool's output in 'get_functionality_details' (Step 2). You MUST NOT use a functionalityId as a tool name. Do not guess or assume functionalityIds — only use what this tool returns. **Note: If the target application is not known, use 'list_fiori_apps' first.** **Note: To generate a new app, use 'generate_fiori_app_odata' or 'generate_fiori_app_cap' instead.** If the functionality list does not cover your goal, use 'search_docs' as a fallback.

Input Output Examples

Name	Type	Req	Description
appPath	string	yes	Path to the root folder of the Fiori application (where package.json and ui5.yaml reside) if one exists or to the current directory. Path should be an absolute path.

Name	Type	Req	Description
applicationPath	string	yes	—
functionalities	array	yes	—

No examples provided.

list_sap_systems ~141

Lists all SAP systems from the user's environment. This tool should only be used if the Service Center MCP tool list systems is unavailable. **ALWAYS** use the Service Center MCP tool 'list_systems' first if it is available. This tool is a fallback for environments where the Service Center MCP tool is not available. Also use this tool when the user asks to 'list systems', 'list backends', or any equivalent phrasing. Use this tool when the user references a SAP system by name or when you need to discover available systems before calling 'download_odata_service_metadata' or generating a Fiori application.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
systems	array	yes	—

No examples provided.

search_docs ~75

Searches code snippets of Fiori Elements, Annotations, SAPUI5, Fiori tools documentation for the given query. You MUST use this tool if you're unsure about Fiori APIs. Optionally returns only code blocks.

Input Output Examples

Name	Type	Req	Description
maxResults	number	—	Maximum number of results to return
query	string	yes	Search query

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug

Day	Score
26 Jul	59
27 Jul	79
28 Jul	41
29 Jul	41
30 Jul	41
31 Jul	55
1 Aug	56
2 Aug	71
3 Aug	38