io.github.SAP/fiori-mcp-server
NPM · @SAP-UX/FIORI-MCP-SERVER · SCANNED SEP 20
SAP Fiori - Model Context Protocol (MCP) server
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to SAP/open-ux-tools). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability59
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2948 tokens (~327/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 60% of tool parameters carry a description.Partial
- Structured output schemas are declared (67% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.SAP/fiori-mcp-server server?
io.github.SAP/fiori-mcp-server runs locally as an npm package, launched with npx -y @sap-ux/fiori-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @sap-ux/fiori-mcp-server
claude mcp add sap-fiori-mcp-server -- npx -y @sap-ux/fiori-mcp-server
{
"mcpServers": {
"sap-fiori-mcp-server": {
"command": "npx",
"args": [
"-y",
"@sap-ux/fiori-mcp-server"
]
}
}
} {
"servers": {
"sap-fiori-mcp-server": {
"command": "npx",
"args": [
"-y",
"@sap-ux/fiori-mcp-server"
]
}
}
} codex mcp add sap-fiori-mcp-server -- npx -y @sap-ux/fiori-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"sap-fiori-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@sap-ux/fiori-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add sap-fiori-mcp-server --command npx --arg -y --arg @sap-ux/fiori-mcp-server
mcp_servers:
sap-fiori-mcp-server:
command: "npx"
args: ["-y", "@sap-ux/fiori-mcp-server"] {
"McpServers": {
"sap-fiori-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@sap-ux/fiori-mcp-server"
]
}
}
} assistant mcp add sap-fiori-mcp-server -t stdio -c npx -a -y @sap-ux/fiori-mcp-server
{
"mcpServers": {
"sap-fiori-mcp-server": {
"command": "npx",
"args": [
"-y",
"@sap-ux/fiori-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −2
- Stability: pass → 0.87 functional
- 17 Sept 26 +1
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 1.12.5 → 1.12.6 functional
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 −3
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: pass → 0.80 functional
- Package version: 1.12.4 → 1.12.5 functional
- Package version: 1.11.7 → 1.12.4 functional
- 10 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.12.3 → 1.12.4 functional
- 9 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- Package version: 1.11.7 → 1.12.3 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@sap-ux/fiori-mcp-server@1.12.6
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | SAP/open-ux-tools |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/SAP/open-ux-tools/.github/workflows/pipeline.yml@refs/heads/main |
| Rekor log index | 2876963678 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:e276ad7d100c68871ca8757ec67d29fb2d6d2f65aac6afad8895c074b80af6b4910f825f8a28eb4ae9b1ced99c68ff5066ccd9f511c2c62d7e0cc6434 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
download_odata_service_metadata ~577
Downloads the metadata (EDMX) of a specific OData service URL from a SAP system and saves it as metadata.xml. Note: this tool replaces the old 'fetch-service-metadata' functionality that was previously available via the 'execute_functionality' workflow — use this tool directly instead. Usage guidelines: - Use this before calling 'generate_fiori_app_odata' when the user provides a SAP system reference and a service path. - If a service name or technical id is provided instead of a service path DO NOT USE THIS TOOL. Instead use the Service Center MCP server tool to retrieve the service metadata and then pass it to 'generate_fiori_app_odata'. - If a service path is provided by the user, use it directly via servicePath parameter. - If the user provides a system name or host, use 'list_sap_systems' first to resolve it. - Pass the full URL as sapSystemQuery. - Returns host, servicePath, client, and metadataFilePath inside the result's parameters object. - Pass ALL returned fields directly into the service config of 'generate_fiori_app_odata'. Map the returned properties to the app config service property input to 'generate_fiori_app_odata'. - **Note:** This tool is only supported in VSCode. For SAP Business Application Studio, use the Service Center MCP server tool to retrieve the service metadata instead. **IMPORTANT**: On VSCode, if the service requires authentication and the system is not already stored, ask the user to store it first. Do not ask for credentials directly. **DO NOT use this tool to refresh or update service metadata in an existing Fiori application. Instead, invoke the ['sap-fiori-create-cli' skill's 'update service-metadata' section](../sap-fiori-create-cli/SKILL.md#update-service-metadata).
| Name | Type | Req | Description |
|---|---|---|---|
| appPath | string | yes | Absolute path to an existing folder where metadata.xml will be written. The folder MUST exist before this tool is invoked — this tool does not create directories. If the caller is about to scaffold a… |
| sapSystemQuery | string | – | The name, host or a URL of the SAP system to fetch service metadata from. |
| servicePath | string | – | The path to the SAP service to fetch metadata for. ONLY use this if the user provides an EXACT path (e.g., "/sap/opu/odata/sap/ZUI_TRAVEL_O4/"). DO NOT construct paths from service names. This parame… |
| Name | Type | Req | Description |
|---|---|---|---|
| appPath | string | yes | – |
| changes | array | yes | – |
| message | string | yes | – |
| parameters | object | yes | – |
| status | string | yes | – |
| timestamp | string | yes | – |
No examples provided.
execute_functionality ~126
**(Step 3 of 3)** Executes a specific functionality to modify an existing SAP Fiori application with provided parameters. This is the **final step** of the workflow and performs the actual modification. You MUST provide the exact parameter information obtained from get_functionality_details (Step 2).
| Name | Type | Req | Description |
|---|---|---|---|
| appPath | string | yes | Path to the Fiori application if one exists or to the current directory. Path should be an absolute path. |
| functionalityId | – | yes | The ID of the functionality to execute |
| parameters | object | yes | Parameters for the functionality execution |
| Name | Type | Req | Description |
|---|---|---|---|
| appPath | string | yes | – |
| changes | array | yes | – |
| functionalityId | – | yes | – |
| message | string | yes | – |
| parameters | – | yes | – |
| status | string | yes | – |
| timestamp | string | yes | – |
No examples provided.
generate_fiori_app_cap ~142
Creates (generates) a new SAP Fiori UI application within an existing CAP project. To populate parameters, you **MUST** use the ***CDS MCP*** to search the model for service definitions, entities, associations, and UI annotations. As a fallback, only if no such tool is available, manually read and parse all .cds files in the projectPath. The configuration **MUST** be a valid JSON object matching the tool's inputSchema and based on the project files.
| Name | Type | Req | Description |
|---|---|---|---|
| entityConfig | object | – | – |
| floorplan | – | yes | – |
| project | object | yes | – |
| service | object | – | – |
No output schema declared.
No examples provided.
generate_fiori_app_odata ~750
Creates (generates) a new SAP Fiori UI application either within an existing CAP project or standalone. ALWAYS read ALL of the following instructions carefully before calling this tool. 🚨 CRITICAL - READ SCHEMA FIRST 🚨 Before calling this tool, you MUST: 1. Examine the inputSchema below to understand the EXACT structure required 2. The input MUST match the schema type 'GeneratorConfigOData' with these TOP-LEVEL properties: - floorplan (must be: 'FE_LROP', 'FE_OVP', 'FE_ALP', 'FE_WORKLIST', 'FE_FEOP', 'FE_FPM', 'FF_SIMPLE', required) - project (object, required) - service (object, optional) - entityConfig (object, optional) 3. DO NOT create properties like "config", or any other structure - use ONLY the properties defined in inputSchema Steps: 1. Construct the tool arguments. - **IMPORTANT** ALWAYS use the app config schema defined by the type 'GeneratorConfigOData' to create the input structure. NEVER create an input in any other format. - The input MUST use the exact property names defined in the inputSchema: floorplan, project, service, entityConfig. - **ONLY** if the Service Center MCP is NOT available and the user provided a SAP system reference or URL with a **service path**, you **MUST** first call 'download_odata_service_metadata'. - If the Service Center MCP is available and the user provided a **service name or technical service id**, you **MUST** call the Service Center MCP server tool to retrieve the metadata and properties required for the service property of the input. - Use the data returned to provide the required values (host, servicePath, client, destination, metadataFilePath) directly in the service property of the input. - If the Service Center MCP was used both host and destination **MUST** be passed in the service property of the input. - If Fiori MCP 'download_odat…
| Name | Type | Req | Description |
|---|---|---|---|
| entityConfig | object | – | – |
| floorplan | – | yes | – |
| project | object | yes | – |
| service | object | – | – |
No output schema declared.
No examples provided.
get_functionality_details ~126
**(Step 2 of 3)** Gets the required parameters and detailed information for a specific functionality to modify an existing SAP Fiori application. You MUST provide a functionalityId obtained from 'list_functionality' (Step 1). The output of this tool is required for the final step 'execute_functionality' (Step 3).
| Name | Type | Req | Description |
|---|---|---|---|
| appPath | string | yes | Path to the Fiori application if one exists or to the current directory. Path should be an absolute path. |
| functionalityId | – | yes | The ID of the functionality to get details for |
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | – |
| examples | array | – | – |
| functionalityId | – | yes | Identifier to pass as the `functionalityId` parameter when calling `get_functionality_details` or `execute_functionality` |
| impact | string | – | – |
| name | string | yes | – |
| pageName | string | – | – |
| parameters | object | yes | – |
| prerequisites | array | – | – |
| technicalDescription | string | – | – |
No examples provided.
list_fiori_apps ~112
Scans a specified directory to find existing SAP Fiori applications that can be modified. This is an optional, preliminary tool. **Use this first ONLY if the target application's name or path is not already known.** The output can be used to ask the user for clarification before starting the main 3-step workflow.
| Name | Type | Req | Description |
|---|---|---|---|
| searchPath | array | yes | Path to search for Fiori applications (defaults to current directory). If VSCode - list of VS Code workspace folder paths(`workspace.workspaceFolders`) |
| Name | Type | Req | Description |
|---|---|---|---|
| applications | array | yes | – |
No examples provided.
list_functionality ~261
**(Step 1 of 3) — Use this to modify an existing SAP Fiori application.** Returns the complete list of supported modification operations for a given application, including: adding or deleting pages, creating controller extensions, and changing any Fiori Elements manifest property. This is the **first mandatory step** for modifying an existing app and requires a valid absolute path to a SAP Fiori application. You MUST use a functionalityId from this tool's output in 'get_functionality_details' (Step 2). You MUST NOT use a functionalityId as a tool name. Do not guess or assume functionalityIds — only use what this tool returns. **Note: If the target application is not known, use 'list_fiori_apps' first.** **Note: To generate a new app, use 'generate_fiori_app_odata' or 'generate_fiori_app_cap' instead.** If the functionality list does not cover your goal, use 'search_docs' as a fallback.
| Name | Type | Req | Description |
|---|---|---|---|
| appPath | string | yes | Path to the root folder of the Fiori application (where package.json and ui5.yaml reside) if one exists or to the current directory. Path should be an absolute path. |
| Name | Type | Req | Description |
|---|---|---|---|
| applicationPath | string | yes | – |
| functionalities | array | yes | – |
No examples provided.
list_sap_systems ~141
Lists all SAP systems from the user's environment. This tool should only be used if the Service Center MCP tool list systems is unavailable. **ALWAYS** use the Service Center MCP tool 'list_systems' first if it is available. This tool is a fallback for environments where the Service Center MCP tool is not available. Also use this tool when the user asks to 'list systems', 'list backends', or any equivalent phrasing. Use this tool when the user references a SAP system by name or when you need to discover available systems before calling 'download_odata_service_metadata' or generating a Fiori application.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| systems | array | yes | – |
No examples provided.
search_docs ~75
Searches code snippets of Fiori Elements, Annotations, SAPUI5, Fiori tools documentation for the given query. You MUST use this tool if you're unsure about Fiori APIs. Optionally returns only code blocks.
| Name | Type | Req | Description |
|---|---|---|---|
| maxResults | number | – | Maximum number of results to return |
| query | string | yes | Search query |
No output schema declared.
No examples provided.
What is the io.github.SAP/fiori-mcp-server server?
io.github.SAP/fiori-mcp-server is listed in the public MCP registry as io.github.SAP/fiori-mcp-server. SAP Fiori - Model Context Protocol (MCP) server. This page covers its npm package (@sap-ux/fiori-mcp-server).
Is the io.github.SAP/fiori-mcp-server server safe to use?
io.github.SAP/fiori-mcp-server scores 90 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.SAP/fiori-mcp-server server expose?
io.github.SAP/fiori-mcp-server exposes 9 tools: search_docs, list_fiori_apps, list_sap_systems, download_odata_service_metadata, generate_fiori_app_odata, and 4 more. Their descriptions and schemas cost roughly 2,310 tokens of context every time the server is loaded.
Is the io.github.SAP/fiori-mcp-server server still maintained?
io.github.SAP/fiori-mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.SAP/fiori-mcp-server server under?
io.github.SAP/fiori-mcp-server declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.