🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In

abapilot

Package Overview
Dependencies
Maintainers
1
Versions
3
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

abapilot - npm Package Compare versions

Comparing version
1.0.1
 to
1.0.2
+121
-49
dist/index.js

@@ -9,9 +9,11 @@ #!/usr/bin/env node

*
* This connector contains no ABAPilot business logic. All operations
* are executed inside SAP, gated by the /ABAPILOT/CONFIG whitelist,
* the calling user's SAP authorizations, and logged to /ABAPILOT/AUDIT.
* This connector contains no business logic. Each tool maps 1:1 to a
* whitelisted endpoint of the ABAPilot dispatcher (SICF service). All
* operations execute inside SAP, gated by the customer-controlled
* endpoint whitelist, the calling user's SAP authorizations, and the
* audit log in the customer's own system.
*
* Configuration (environment variables):
* ABAPILOT_URL Full URL of the ABAPilot SICF endpoint
* e.g. https://sap-dev.example.com:8443/sap/bc/abapilot
* ABAPILOT_URL Base URL of the ABAPilot SICF service
* e.g. http://sap-dev.example.com:8000/sap/bc/ZABAPilot
* ABAPILOT_USER SAP user for the connection

@@ -26,3 +28,3 @@ * ABAPILOT_PASSWORD SAP password (or use ABAPILOT_TOKEN)

import { z } from "zod";
const VERSION = "1.0.0";
const VERSION = "1.0.2";
// ---------------------------------------------------------------------------

@@ -41,4 +43,4 @@ // Configuration

console.error("ABAPilot connector: ABAPILOT_URL is not set.\n" +
"Point it at your ABAPilot SICF endpoint, e.g.\n" +
" ABAPILOT_URL=https://<sap-host>:<port>/sap/bc/abapilot\n" +
"Point it at your ABAPilot SICF service, e.g.\n" +
" ABAPILOT_URL=http://<sap-host>:<port>/sap/bc/ZABAPilot\n" +
"A licensed ABAPilot backend is required: https://crimsonconsultingsl.com/abapilot/");

@@ -51,3 +53,11 @@ process.exit(1);

}
async function sapRequest(operation, params) {
function endpointUrl(path) {
const u = new URL(cfg.url);
u.pathname = u.pathname.replace(/\/+$/, "") + path;
if (cfg.client && !u.searchParams.has("sap-client")) {
u.searchParams.set("sap-client", cfg.client);
}
return u.toString();
}
async function sapRequest(path, payload) {
const headers = {

@@ -64,10 +74,9 @@ "Content-Type": "application/json",

}
if (cfg.client)
headers["sap-client"] = cfg.client;
const url = endpointUrl(path);
let res;
try {
res = await fetch(cfg.url, {
res = await fetch(url, {
method: "POST",
headers,
body: JSON.stringify({ operation, params }),
body: JSON.stringify(payload),
});

@@ -78,3 +87,3 @@ }

ok: false,
error: `Cannot reach the ABAPilot endpoint at ${cfg.url} — ` +
error: `Cannot reach the ABAPilot endpoint at ${url} — ` +
`check ABAPILOT_URL, network/VPN access to the SAP system, and that ` +

@@ -88,3 +97,3 @@ `the SICF service is active. (${e.message})`,

ok: false,
error: `SAP endpoint returned HTTP ${res.status}: ${text.slice(0, 500)}`,
error: `SAP endpoint ${path} returned HTTP ${res.status}: ${text.slice(0, 500)}`,
};

@@ -110,4 +119,7 @@ }

}
const up = (s) => (s ?? "").toUpperCase();
// ---------------------------------------------------------------------------
// MCP server and tools
// MCP server and tools — each tool maps 1:1 to a whitelisted ABAPilot
// endpoint. The connecting AI supplies the reasoning (which table, which
// WHERE clause); SAP supplies the data, under the user's authorizations.
// ---------------------------------------------------------------------------

@@ -118,43 +130,103 @@ const server = new McpServer({

});
server.tool("query_sap_data", "Run a natural-language query against live SAP data. The query is resolved " +
"inside the SAP system (tables and joins determined automatically, e.g. " +
"LFA1 + BSIK for vendor/invoice questions) and executes under the " +
"connecting user's own SAP authorizations. Results are read-only unless " +
"the backend is explicitly configured otherwise.", {
question: z
const WHERE_HINT = "WHERE uses ABAP operators: EQ NE GE LE GT LT LIKE IN, values in single " +
"quotes. Dates are YYYYMMDD. Numeric keys carry leading zeros " +
"(vendor 1000 = LIFNR EQ '0000001000', material = 18 digits). " +
"Example: \"MTART EQ 'FERT' AND ERSDA GE '20260101'\"";
server.tool("sap_read_table_data", "Query rows from an SAP table with optional WHERE filtering. Use " +
"sap_search_tables / sap_read_table_structure first if unsure of the " +
"table or field names. " + WHERE_HINT, {
table_name: z.string().describe("SAP table name, e.g. LFA1, EKKO, MARA"),
where_clause: z
.string()
.describe("The business question in natural language, e.g. " +
"'vendors with open invoices over 50000 EUR'"),
max_rows: z
.number()
.optional()
.describe("Maximum number of rows to return (default: backend setting)"),
}, async ({ question, max_rows }) => toResult(await sapRequest("query_sap_data", { question, max_rows })));
server.tool("abap_code_review", "Review ABAP source code against best practices (naming, performance, " +
"security, ECC/S4 compatibility). Provide either source code directly " +
"or the name of an object in the connected system.", {
source: z.string().optional().describe("ABAP source code to review"),
object_name: z
.describe("ABAP-style WHERE condition (see tool description)"),
max_rows: z.number().optional().describe("Maximum rows to return (default 100)"),
}, async ({ table_name, where_clause, max_rows }) => toResult(await sapRequest("/read_table_data", {
table_name: up(table_name),
where_clause: where_clause ?? "",
max_rows: max_rows ?? 100,
include_metadata: true,
})));
server.tool("sap_read_table_structure", "Get the field definitions of an SAP table or structure — names, types, " +
"lengths, key fields, descriptions. Call this before querying a table " +
"you are not sure about.", {
table_name: z.string().describe("SAP table or structure name, e.g. EKKO"),
}, async ({ table_name }) => toResult(await sapRequest("/read_table_structure", { table_name: up(table_name) })));
server.tool("sap_search_tables", "Search the SAP Data Dictionary for tables by keyword, matching table " +
"names and descriptions, e.g. 'vendor' finds LFA1/LFB1. Use this to " +
"discover the right table before querying.", {
keyword: z.string().describe("Search term, e.g. 'vendor', 'purchase'"),
max_results: z.number().optional().describe("Maximum results (default 20)"),
}, async ({ keyword, max_results }) => toResult(await sapRequest("/search_tables", {
keyword: up(keyword),
max_results: max_results ?? 20,
})));
server.tool("sap_read_code", "Read ABAP source code from the connected system — programs, classes, " +
"function groups, includes, interfaces.", {
object_type: z
.string()
.optional()
.describe("Name of an ABAP object in the connected system to review"),
}, async ({ source, object_name }) => toResult(await sapRequest("abap_code_review", { source, object_name })));
server.tool("abap_generate", "Generate ABAP code compatible with the connected system's release " +
"(ECC 6.0-safe syntax when connected to ECC).", {
specification: z
.string()
.describe("What the code should do, in natural language"),
.describe("Object type: PROG, CLAS, FUGR, INCL or INTF"),
object_name: z.string().describe("Object name, e.g. ZREPORT01, ZCL_MY_CLASS"),
}, async ({ object_type, object_name }) => toResult(await sapRequest("/read_code", {
object_type: up(object_type),
object_name: up(object_name),
})));
server.tool("sap_read_where_used", "Cross-reference lookup (like SE84): direction 'forward' answers 'what " +
"programs/classes use this object?', direction 'inverse' answers 'what " +
"does this program use?'.", {
object_name: z.string().describe("Object name, e.g. MARA, ZCL_MY_CLASS"),
object_type: z
.string()
.optional()
.describe("Target object type, e.g. report, class, function module"),
}, async ({ specification, object_type }) => toResult(await sapRequest("abap_generate", { specification, object_type })));
server.tool("abap_document", "Generate documentation for existing ABAP code — purpose, flow, " +
"dependencies. Useful for legacy custom code.", {
source: z.string().optional().describe("ABAP source code to document"),
object_name: z
.describe("TABL, VIEW, DTEL, DOMA, STRU, PROG, INCL, FUNC, CLAS or FUGR (default TABL)"),
direction: z
.string()
.optional()
.describe("Name of an ABAP object in the connected system to document"),
}, async ({ source, object_name }) => toResult(await sapRequest("abap_document", { source, object_name })));
.describe("'forward' (what uses X, default) or 'inverse' (what X uses)"),
max_results: z.number().optional().describe("Maximum results (default 100)"),
}, async ({ object_name, object_type, direction, max_results }) => toResult(await sapRequest("/read_where_used", {
object_name: up(object_name),
object_type: up(object_type) || "TABL",
direction: direction ?? "forward",
max_results: max_results ?? 100,
})));
server.tool("sap_syntax_check", "Validate ABAP source code against the connected system's syntax rules " +
"(release-accurate, e.g. ECC 6.0 restrictions) without saving anything.", {
source: z.array(z.string()).describe("ABAP source code as an array of lines"),
program_name: z
.string()
.optional()
.describe("Optional program name for context"),
}, async ({ source, program_name }) => toResult(await sapRequest("/syntax_check", {
source,
program_name: up(program_name),
})));
server.tool("sap_read_dumps", "Read ST22 ABAP runtime errors (short dumps). Dates are YYYYMMDD; " +
"defaults to today when no dates are given.", {
date_from: z.string().optional().describe("Start date YYYYMMDD"),
date_to: z.string().optional().describe("End date YYYYMMDD"),
user: z.string().optional().describe("Filter by SAP user"),
max_rows: z.number().optional().describe("Maximum rows (default 100)"),
}, async ({ date_from, date_to, user, max_rows }) => toResult(await sapRequest("/read_dumps", {
date_from: date_from ?? "",
date_to: date_to ?? "",
user: up(user),
max_rows: max_rows ?? 100,
})));
server.tool("sap_read_jobs", "Read SM37 background jobs — status, runtime, scheduling. Status codes: " +
"F=Finished, A=Aborted, R=Running, S=Scheduled, P=Ready. Dates YYYYMMDD.", {
date_from: z.string().optional().describe("Start date YYYYMMDD (default last 7 days)"),
date_to: z.string().optional().describe("End date YYYYMMDD"),
user: z.string().optional().describe("Filter by scheduling user"),
status: z.string().optional().describe("F, A, R, S or P"),
job_name: z.string().optional().describe("Job name prefix filter"),
max_rows: z.number().optional().describe("Maximum rows (default 100)"),
}, async ({ date_from, date_to, user, status, job_name, max_rows }) => toResult(await sapRequest("/read_jobs", {
date_from: date_from ?? "",
date_to: date_to ?? "",
user: up(user),
status: up(status),
job_name: up(job_name),
max_rows: max_rows ?? 100,
})));
// ---------------------------------------------------------------------------

@@ -161,0 +233,0 @@ // Start

+5
-196
LICENSE

@@ -1,191 +0,4 @@

The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License.
No rights beyond those granted by the applicable original license are conveyed for such contributions.
---
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to the Licensor for inclusion in the Work by the copyright
owner or by an individual or Legal Entity authorized to submit on behalf
of the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
---
MIT License
Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
Copyright (c) 2026 Crimson Consulting SL

@@ -202,2 +15,6 @@ Permission is hereby granted, free of charge, to any person obtaining a copy

This license applies to the ABAPilot MCP connector (this npm package) only.
The ABAPilot backend (ABAP transport, /ABAPILOT/ namespace) is a separate,
commercially licensed product of Crimson Consulting SL.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

@@ -210,9 +27,1 @@ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

SOFTWARE.
---
Creative Commons Attribution 4.0 International (CC-BY-4.0)
Documentation in this project (excluding specifications) is licensed under
CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
the full license text.
+1
-1
package.json
{
"name": "abapilot",
"version": "1.0.1",
"version": "1.0.2",
"description": "MCP connector for ABAPilot — AI access to SAP ECC and on-premise S/4HANA. Requires a licensed ABAPilot backend (/ABAPILOT/ namespace) in your SAP system.",

@@ -5,0 +5,0 @@ "mcpName": "io.github.NicoHern/abapilot-mcp",

+58
-136
README.md

@@ -1,153 +0,75 @@

# MCP Registry
# ABAPilot MCP Connector
The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.
Connects any MCP client — Claude, Claude Code, Cursor, ChatGPT — to a licensed
[ABAPilot](https://crimsonconsultingsl.com/abapilot/) backend running inside
your SAP system (ECC 6.0 through on-premise S/4HANA).
[**📤 Publish my MCP server**](docs/modelcontextprotocol-io/quickstart.mdx) | [**⚡️ Live API docs**](https://registry.modelcontextprotocol.io/docs) | [**👀 Ecosystem vision**](docs/design/ecosystem-vision.md) | 📖 **[Full documentation](./docs)**
This package is the free client-side connector. It contains no business logic:
every operation executes inside SAP, gated by the `/ABAPILOT/CONFIG` whitelist,
the calling user's own SAP authorizations, and logged to `/ABAPILOT/AUDIT`.
A licensed ABAPilot backend (delivered as an ABAP transport into the
`/ABAPILOT/` namespace) is required — [request a demo](https://crimsonconsultingsl.com/contact-crimson-consulting/).
## Development Status
<!-- mcp-name: io.github.NicoHern/abapilot-mcp -->
**2025-10-24 update**: The Registry API has entered an **API freeze (v0.1)** 🎉. For the next month or more, the API will remain stable with no breaking changes, allowing integrators to confidently implement support. This freeze applies to v0.1 while development continues on v0. We'll use this period to validate the API in real-world integrations and gather feedback to shape v1 for general availability. Thank you to everyone for your contributions and patience—your involvement has been key to getting us here!
## Quick start
**2025-09-08 update**: The registry has launched in preview 🎉 ([announcement blog post](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/)). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in [GitHub discussions](https://github.com/modelcontextprotocol/registry/discussions/new?category=ideas) or in the [#registry-dev Discord](https://discord.com/channels/1358869848138059966/1369487942862504016) ([joining details here](https://modelcontextprotocol.io/community/communication)).
Registry Working Group:
- **Tadas Antanavicius** (PulseMCP) [@tadasant](https://github.com/tadasant)
- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov)
- **Bob Dickinson** (TeamSpark) [@BobDickinson](https://github.com/BobDickinson)
- **Preeti (Pree) Dewani** (Ravenmail) [@pree-dew](https://github.com/pree-dew)
## Contributing
We use multiple channels for collaboration - see [modelcontextprotocol.io/community/communication](https://modelcontextprotocol.io/community/communication).
Often (but not always) ideas flow through this pipeline:
- **[Discord](https://modelcontextprotocol.io/community/communication)** - Real-time community discussions
- **[Discussions](https://github.com/modelcontextprotocol/registry/discussions)** - Propose and discuss product/technical requirements
- **[Issues](https://github.com/modelcontextprotocol/registry/issues)** - Track well-scoped technical work
- **[Pull Requests](https://github.com/modelcontextprotocol/registry/pulls)** - Contribute work towards issues
### Quick start:
#### Pre-requisites
- **Docker**
- **Go 1.24.x**
- **ko** - Container image builder for Go ([installation instructions](https://ko.build/install/))
- **golangci-lint v2.4.0**
#### Running the server
```bash
# Start full development environment
make dev-compose
```json
{
"mcpServers": {
"abapilot": {
"command": "npx",
"args": ["-y", "abapilot"],
"env": {
"ABAPILOT_URL": "http://<sap-host>:<port>/sap/bc/ZABAPilot",
"ABAPILOT_USER": "<sap-user>",
"ABAPILOT_PASSWORD": "<sap-password>",
"ABAPILOT_CLIENT": "100"
}
}
}
}
```
This starts the registry at [`localhost:8080`](http://localhost:8080) with PostgreSQL. The database uses ephemeral storage and is reset each time you restart the containers, ensuring a clean state for development and testing.
Add the block above to your MCP client configuration (e.g. Claude Desktop's
`claude_desktop_config.json`). Your SAP credentials go only to your SAP
system — never to us or to any third party.
**Note:** The registry uses [ko](https://ko.build) to build container images. The `make dev-compose` command automatically builds the registry image with ko and loads it into your local Docker daemon before starting the services.
## Tools
By default, the registry seeds from the production API with a filtered subset of servers (to keep startup fast). This ensures your local environment mirrors production behavior and all seed data passes validation. For offline development you can seed from a file without validation with `MCP_REGISTRY_SEED_FROM=data/seed.json MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=false make dev-compose`.
Each tool maps 1:1 to a whitelisted endpoint of the ABAPilot dispatcher in
your SAP system. The AI client supplies the reasoning; SAP supplies the data,
always under the connecting user's own authorizations.
The setup can be configured with environment variables in [docker-compose.yml](./docker-compose.yml) - see [.env.example](./.env.example) for a reference.
- `sap_read_table_data` — query SAP table rows with ABAP-style WHERE filtering
- `sap_read_table_structure` — field definitions, types and keys of a table
- `sap_search_tables` — find tables in the Data Dictionary by keyword
- `sap_read_code` — read ABAP source (programs, classes, function groups)
- `sap_read_where_used` — cross-reference lookup (what uses X / what does X use)
- `sap_syntax_check` — validate ABAP source against the system's release rules
- `sap_read_dumps` — ST22 runtime errors (short dumps)
- `sap_read_jobs` — SM37 background jobs, status and runtimes
<details>
<summary>Alternative: Running a pre-built Docker image</summary>
The available endpoints are controlled by the `/ABAPILOT/CONFIG` whitelist in
your system — remove an endpoint there and the corresponding tool stops
working, no client change needed.
Pre-built Docker images are automatically published to GitHub Container Registry. Note that the image does not bundle PostgreSQL, so you need to run your own and point the registry at it via `MCP_REGISTRY_DATABASE_URL` (see [docker-compose.yml](./docker-compose.yml) for a working example):
## Configuration
```bash
# Run latest stable release
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:latest
| Variable | Required | Description |
|---|---|---|
| `ABAPILOT_URL` | yes | Base URL of the ABAPilot SICF service |
| `ABAPILOT_USER` / `ABAPILOT_PASSWORD` | yes* | SAP credentials (basic auth) |
| `ABAPILOT_TOKEN` | yes* | Bearer token alternative to user/password |
| `ABAPILOT_CLIENT` | no | SAP client (Mandant), sent as `sap-client` URL parameter |
| `ABAPILOT_TLS_INSECURE` | no | `1` to skip TLS verification (dev systems only) |
# Run latest from main branch (continuous deployment)
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main
\* one of the two authentication methods.
# Run specific release version
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:v1.0.0
## Links
# Run development build from main branch
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main-20250906-abc123d
```
- Product: https://crimsonconsultingsl.com/abapilot/
- Architecture: https://github.com/NicoHern/abapilot-mcp/blob/main/ARCHITECTURE.md
- AI for SAP ECC — 2026 guide: https://crimsonconsultingsl.com/ai-for-sap-ecc/
**Available tags:**
- **Releases**: `latest`, `v1.0.0`, `v1.1.0`, etc.
- **Continuous**: `main` (latest main branch build)
- **Development**: `main-<date>-<sha>` (specific commit builds)
</details>
#### Publishing a server
To publish a server, we've built a simple CLI. You can use it with:
```bash
# Build the latest CLI
make publisher
# Use it!
./bin/mcp-publisher --help
```
See [the publisher guide](./docs/modelcontextprotocol-io/quickstart.mdx) for more details.
#### Other commands
```bash
# Run lint, unit tests and integration tests
make check
```
There are also a few more helpful commands for development. Run `make help` to learn more, or look in [Makefile](./Makefile).
<!--
For Claude and other AI tools: Always prefer make targets over custom commands where possible.
-->
## Architecture
### Project Structure
```
├── cmd/ # Application entry points
│ └── publisher/ # Server publishing tool
├── data/ # Seed data
├── deploy/ # Deployment configuration (Pulumi)
├── docs/ # Documentation
├── internal/ # Private application code
│ ├── api/ # HTTP handlers and routing
│ ├── auth/ # Authentication (GitHub OAuth, JWT, namespace blocking)
│ ├── config/ # Configuration management
│ ├── database/ # Data persistence (PostgreSQL)
│ ├── service/ # Business logic
│ ├── telemetry/ # Metrics and monitoring
│ └── validators/ # Input validation
├── pkg/ # Public packages
│ ├── api/ # API types and structures
│ │ └── v0/ # Version 0 API types
│ └── model/ # Data models for server.json
├── scripts/ # Development and testing scripts
├── tests/ # Integration tests
└── tools/ # CLI tools and utilities
└── validate-*.sh # Schema validation tools
```
### Authentication
Publishing supports multiple authentication methods:
- **GitHub OAuth** - For publishing by logging into GitHub
- **GitHub OIDC** - For publishing from GitHub Actions
- **DNS verification** - For proving ownership of a domain and its subdomains
- **HTTP verification** - For proving ownership of a domain
The registry validates namespace ownership when publishing. E.g. to publish...:
- `io.github.domdomegg/my-cool-mcp` you must login to GitHub as `domdomegg`, or be in a GitHub Action on domdomegg's repos
- `me.adamjones/my-cool-mcp` you must prove ownership of `adamjones.me` via DNS or HTTP challenge
## Community Projects
Check out [community projects](docs/community-projects.md) to explore notable registry-related work created by the community.
## More documentation
See the [documentation](./docs) for more details if your question has not been answered here!
© Crimson Consulting SL — connector released under MIT; the ABAPilot backend is a commercial product.