# io.github.SAP/fiori-mcp-server (npm · @sap-ux/fiori-mcp-server)

SAP Fiori - Model Context Protocol (MCP) server

- Trust score: 38/100 (low)
- Change this week: −41
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@sap-ux/fiori-mcp-server`: 38/100 (this document), [markdown](https://verifymcp.io/servers/sap-fiori-mcp-server/sap-ux-fiori-mcp-server.md), [page](https://verifymcp.io/servers/sap-fiori-mcp-server/sap-ux-fiori-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@sap-ux/fiori-mcp-server`
- Version: `1.11.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 63/100
  - No malware found by supply-chain analysis.
  - CVE data not yet available for this package.
  - No install/post-install scripts declared.
  - Dependency-health data not yet available.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to SAP/open-ux-tools).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 0/100
  - Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- **Capabilities**: 0/100
  - Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.

**Unverified: 4 categories.** Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you.

## Install

### Claude

```bash
claude mcp add sap-fiori-mcp-server -- npx -y @sap-ux/fiori-mcp-server
```

### Codex

```bash
codex mcp add sap-fiori-mcp-server -- npx -y @sap-ux/fiori-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sap-fiori-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sap-ux/fiori-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sap-fiori-mcp-server --command npx --arg -y --arg @sap-ux/fiori-mcp-server
```

### Hermes

```yaml
mcp_servers:
  sap-fiori-mcp-server:
    command: "npx"
    args: ["-y", "@sap-ux/fiori-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "sap-fiori-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@sap-ux/fiori-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 38, −33)

- [security regression] Stability: 0.20 → unverified
- [security regression] Known CVEs: pass → unverified
- [functional regression] Dependency health: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional] Package version: 1.11.4 → 1.11.5

### 2026-08-02 (score 71, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-01 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 55, +14)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 41, 0)

- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Package version: 1.11.0 → 1.11.3

### 2026-07-29 (score 41, 0)

- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.

### 2026-07-28 (score 41, −38)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] Package version: 1.11.0 → 1.11.2

### 2026-07-27 (score 79, +20)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 60
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: poor
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 67

## MCP tools (9)

### `search_docs` (~75 tokens)

Searches code snippets of Fiori Elements, Annotations, SAPUI5, Fiori tools documentation for the given query. You MUST use this tool if you're unsure about Fiori APIs. Optionally returns only code blocks.

Input parameters:

- `maxResults` (number): Maximum number of results to return
- `query` (string, required): Search query

### `list_fiori_apps` (~112 tokens)

Scans a specified directory to find existing SAP Fiori applications that can be modified.
                    This is an optional, preliminary tool.
                    **Use this first ONLY if the target application's name or path is not already known.**
                    The output can be used to ask the user for clarification before starting the main 3-step workflow.

Input parameters:

- `searchPath` (array, required): Path to search for Fiori applications (defaults to current directory). If VSCode - list of VS Code workspace folder paths(`workspace.workspaceFolders`)

Output parameters:

- `applications` (array)

### `list_sap_systems` (~141 tokens)

Lists all SAP systems from the user's environment. This tool should only be used if the Service Center MCP tool list systems is unavailable. 
                    **ALWAYS** use the Service Center MCP tool 'list_systems' first if it is available. This tool is a fallback for environments where the Service Center MCP tool is not available.
                    Also use this tool when the user asks to 'list systems', 'list backends', or any equivalent phrasing.
                    Use this tool when the user references a SAP system by name or when you need to discover available systems
                    before calling 'download_odata_service_metadata' or generating a Fiori application.

Output parameters:

- `systems` (array)

### `download_odata_service_metadata` (~449 tokens)

Downloads the metadata (EDMX) of a specific OData service URL from a SAP system and saves it as metadata.xml.
                    Note: this tool replaces the old 'fetch-service-metadata' functionality that was previously available via the 'execute_functionality' workflow — use this tool directly instead.

                    Usage guidelines:
                    - Use this before calling 'generate_fiori_app_odata' when the user provides a SAP system reference and a service path. 
                    - If a service name or technical id is provided instead of a service path DO NOT USE THIS TOOL. Instead use the Service Center MCP server tool to retrieve the service metadata and then pass it to 'generate_fiori_app_odata'.
                    - If a service path is provided by the user, use it directly via servicePath parameter.
                    - If the user provides a system name or host, use 'list_sap_systems' first to resolve it.
                    - Pass the full URL as sapSystemQuery.
                    - Returns host, servicePath, client, and metadataFilePath inside the result's parameters object.
                    - Pass ALL returned fields directly into the service config of 'generate_fiori_app_odata'. Map the returned properties to the app config service property input to 'generate_fiori_app_odata'.
                    - **Note:** This tool is only supported in VSCode. For SAP Business Application Studio, use the Service Center MCP server tool to retrieve the service metadata instead.
                    **IMPORTANT**: On VSCode, if the service requires authentication and the system is not already stored, ask the user to store it first. Do not ask for credentials directly.

Input parameters:

- `appPath` (string, required): Absolute path to the folder where metadata.xml will be saved. Typically the project target folder.
- `sapSystemQuery` (string): The name, host or a URL of the SAP system to fetch service metadata from.
- `servicePath` (string): The path to the SAP service to fetch metadata for. ONLY use this if the user provides an EXACT path (e.g., "/sap/opu/odata/sap/ZUI_TRAVEL_O4/"). DO NOT construct paths from service names. This parame…

Output parameters:

- `appPath` (string)
- `changes` (array)
- `message` (string)
- `parameters` (object)
- `status` (string)
- `timestamp` (string)

### `generate_fiori_app_odata` (~750 tokens)

Creates (generates) a new SAP Fiori UI application either within an existing CAP project or standalone. ALWAYS read ALL of the following instructions carefully before calling this tool.

        🚨 CRITICAL - READ SCHEMA FIRST 🚨
        Before calling this tool, you MUST:
        1. Examine the inputSchema below to understand the EXACT structure required
        2. The input MUST match the schema type 'GeneratorConfigOData' with these TOP-LEVEL properties:
           - floorplan (must be: 'FE_LROP', 'FE_OVP', 'FE_ALP', 'FE_WORKLIST', 'FE_FEOP', 'FE_FPM', 'FF_SIMPLE', required)
           - project (object, required)
           - service (object, optional)
           - entityConfig (object, optional)
        3. DO NOT create properties like "config", or any other structure - use ONLY the properties defined in inputSchema

        Steps:
        1. Construct the tool arguments.
           - **IMPORTANT** ALWAYS use the app config schema defined by the type 'GeneratorConfigOData' to create the input structure. NEVER create an input in any other format.
           - The input MUST use the exact property names defined in the inputSchema: floorplan, project, service, entityConfig.
           - **ONLY** if the Service Center MCP is NOT available and the user provided a SAP system reference or URL with a **service path**, you **MUST** first call 'download_odata_service_metadata'.
           - If the Service Center MCP is available and the user provided a **service name or technical service id**, you **MUST** call the Service Center MCP server tool to retrieve the metadata and properties required for the service property of the input. 
           - Use the data returned to provide the required values (host, servicePath, client, destination, metadataFilePath) directly in the service property of the input.
           - If the Service Center MCP was used both host and destination **MUST** be passed in the service property of the input.
           - If Fiori MCP 'download_odat…

Input parameters:

- `entityConfig` (object)
- `floorplan` (required)
- `project` (object, required)
- `service` (object)

### `generate_fiori_app_cap` (~142 tokens)

Creates (generates) a new SAP Fiori UI application within an existing CAP project.
                    To populate parameters, you **MUST** use the ***CDS MCP*** to search the model for service definitions, entities, associations, and UI annotations.
                    As a fallback, only if no such tool is available, manually read and parse all .cds files in the projectPath.
                    The configuration **MUST** be a valid JSON object matching the tool's inputSchema and based on the project files.

Input parameters:

- `entityConfig` (object)
- `floorplan` (required)
- `project` (object, required)
- `service` (object)

### `list_functionality` (~261 tokens)

\**(Step 1 of 3) — Use this to modify an existing SAP Fiori application.**
                    Returns the complete list of supported modification operations for a given application, including:
                    adding or deleting pages, creating controller extensions, and changing any Fiori Elements manifest property.
                    This is the **first mandatory step** for modifying an existing app and requires a valid absolute path to a SAP Fiori application.
                    You MUST use a functionalityId from this tool's output in 'get_functionality_details' (Step 2).
                    You MUST NOT use a functionalityId as a tool name.
                    Do not guess or assume functionalityIds — only use what this tool returns.
                    **Note: If the target application is not known, use 'list_fiori_apps' first.**
                    **Note: To generate a new app, use 'generate_fiori_app_odata' or 'generate_fiori_app_cap' instead.**
                    If the functionality list does not cover your goal, use 'search_docs' as a fallback.

Input parameters:

- `appPath` (string, required): Path to the root folder of the Fiori application (where package.json and ui5.yaml reside) if one exists or to the current directory. Path should be an absolute path.

Output parameters:

- `applicationPath` (string)
- `functionalities` (array)

### `get_functionality_details` (~126 tokens)

\**(Step 2 of 3)**
                    Gets the required parameters and detailed information for a specific functionality to modify an existing SAP Fiori application.
                    You MUST provide a functionalityId obtained from 'list_functionality' (Step 1).
                    The output of this tool is required for the final step 'execute_functionality' (Step 3).

Input parameters:

- `appPath` (string, required): Path to the Fiori application if one exists or to the current directory. Path should be an absolute path.
- `functionalityId` (required): The ID of the functionality to get details for

Output parameters:

- `description` (string)
- `examples` (array)
- `functionalityId`: Identifier to pass as the `functionalityId` parameter when calling `get_functionality_details` or `execute_functionality`
- `impact` (string)
- `name` (string)
- `pageName` (string)
- `parameters` (object)
- `prerequisites` (array)
- `technicalDescription` (string)

### `execute_functionality` (~126 tokens)

\**(Step 3 of 3)**
                    Executes a specific functionality to modify an existing SAP Fiori application with provided parameters.
                    This is the **final step** of the workflow and performs the actual modification.
                    You MUST provide the exact parameter information obtained from get_functionality_details (Step 2).

Input parameters:

- `appPath` (string, required): Path to the Fiori application if one exists or to the current directory. Path should be an absolute path.
- `functionalityId` (required): The ID of the functionality to execute
- `parameters` (object, required): Parameters for the functionality execution

Output parameters:

- `appPath` (string)
- `changes` (array)
- `functionalityId`
- `message` (string)
- `parameters`
- `status` (string)
- `timestamp` (string)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/sap-fiori-mcp-server/sap-ux-fiori-mcp-server#diagnostics

## Score history

- 2026-08-03: 38
- 2026-08-02: 71
- 2026-08-01: 56
- 2026-07-31: 55
- 2026-07-30: 41
- 2026-07-29: 41
- 2026-07-28: 41
- 2026-07-27: 79
- 2026-07-26: 59

## Links

- npm package: https://www.npmjs.com/package/@sap-ux/fiori-mcp-server
- Socket report: https://socket.dev/npm/package/@sap-ux/fiori-mcp-server
- Repository: https://github.com/SAP/open-ux-tools
- Changelog RSS feed: https://verifymcp.io/servers/sap-fiori-mcp-server/sap-ux-fiori-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sap-fiori-mcp-server/sap-ux-fiori-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sap-fiori-mcp-server/sap-ux-fiori-mcp-server