SAS Viya

SAS Viya MCP Server

A Model Context Protocol (MCP) server for executing SAS code, training AutoML projects, scoring models and so much more for SAS Viya environments.

Features

• 115 tools across 11 selectable tiers, spanning the Analytics Life Cycle on SAS Viya
• Interactive views (MCP Apps) for data, SAS logs and glossary editing in clients that render them — Claude, ChatGPT, Microsoft 365 Copilot, VS Code, Cursor
• Prompt Templates for improving your SAS Code
• OAuth2 authentication with PKCE flow
• HTTP-based MCP server compatible with MCP clients

Articles & Videos

Here you can find getting articles on how to use and integrate the SAS MCP Server in different tools and what to build with it:

• From REST APIs to AI Agents: Why the SAS Viya MCP Server Matters
• Connecting GitHub Copilot to SAS Viya with the SAS Viya MCP Server
• Bring Your Own Key: SAS Viya MCP Server with GitHub Copilot CLI
• Putting the SAS Viya MCP Server to Work in GitHub Copilot
• Connecting Claude Code CLI to SAS Viya with the SAS Viya MCP Server
• Putting the SAS Viya MCP Server to Work in Claude Code CLI
• Integration with SAS Retrieval Agent Manager (RAM)
• Five Industry Use Cases using the SAS Viya MCP Server as Videos

Getting Started

Prerequisites

• Required
• Python 3.12+
• uv 0.8+
• SAS Viya environment with compute service
• Which tools work on which Viya release (LTS 2024.09 to Stable 2026.10): see COMPATIBILITY.md
• Setup the Viya environment for MCP
• See configuration.md

• Optional
• Docker: refer to container setup
• Kubernetes: sample manifests (Contour or nginx) and a Helm chart in deploy/

Installation

1. Clone the repository:

git clone <repository-url>

cd sas-mcp-server

1. Install dependencies

uv sync

NOTE: This will by default create a virtual environment called .venv in the project's root directory.

If for some reason the virtual environment is not created, please run uv venv and then re-run uv sync.

Run uv sync again after each git pull, with every MCP client that uses this checkout closed. The stdio client configurations below start the server with uv run --no-sync, so they never sync .venv themselves: on Windows, a sync while another copy of the server is running fails on its locked .exe and the server does not start (see TROUBLESHOOTING.md).

Usage

1. Configure environment variables:

cp .env.sample .env

Edit .env and set

VIYA_ENDPOINT=https://your-viya-server.com

1. Start the MCP server (see Choosing a deployment mode below):

Option A: HTTP mode (pre-run the server, connect from MCP client)

uv run app

The server will be available at http://localhost:8134/mcp by default. Authentication is handled via OAuth2 PKCE flow in the browser.

Option B: Stdio mode (MCP client starts the server on demand)

Authenticate once. Two equivalent options:

# Option B1 — if you have the SAS Viya CLI installed:

sas-viya auth loginCode

Option B2 — built-in helper, no external CLI needed (Viya 2022.11+):

uv run sas-mcp-login

Both flows write an access token to a local cache (~/.sas/credentials.json and ~/.sas-mcp-server/credentials.json respectively); the stdio server reads whichever it finds. When the token expires, re-run the same command.

Then configure your MCP client to launch the server directly (see below).

Option C: Docker / Podman (containerized deployment)

Pull the pre-built image from GitHub Container Registry:

docker pull ghcr.io/sassoftware/sas-mcp-server:latest

docker run -e VIYA_ENDPOINT=https://your-viya-server.com -p 8134:8134 ghcr.io/sassoftware/sas-mcp-server:latest

Or build locally from source:

docker build -t sas-mcp-server .

docker run -e VIYA_ENDPOINT=https://your-viya-server.com -p 8134:8134 sas-mcp-server

Available image tags:

• latest — most recent tagged release
• . . (e.g. 1.0.0) — specific release
• . (e.g. 1.0) — latest patch of a minor release
• edge — tip of main (unreleased, for testing)
• sha- — pinned to a specific commit

Programmatic clients with a pre-existing Viya token

If your caller already holds a Viya access token (e.g. an automation script that obtained one via the SAS Viya CLI), start the HTTP-mode server with ALLOW_RAW_BEARER=true and pass the token directly:

curl -H "Authorization: Bearer $VIYA_TOKEN" http://localhost:8134/mcp ...

The server validates the token against Viya's JWKS and uses it upstream as-is, bypassing the MCP JWT swap. The default OAuth2 PKCE flow keeps working alongside — both client types share the same /mcp endpoint.

If your Viya APIs are intentionally exposed without auth (for example, a local/dev Compute API endpoint), set VIYA_AUTH=false to bypass all SASLogon/OAuth flows in both HTTP and stdio modes. In this mode the server sends upstream requests without an Authorization header.

If your compute deployment does not expose /compute/contexts and only supports a fixed session, set COMPUTE_SESSION_ID= . The compute tools will use that session directly instead of creating context-backed sessions.

Choosing a deployment mode

Quick guidance:

• Starting out or exploring? Use stdio — one sas-viya auth loginCode or uv run sas-mcp-login, then your MCP client manages the server lifecycle.
• Need secure, interactive auth? Use HTTP — no stored passwords, each user authenticates via browser.
• Deploying for a team or on a server? Use Docker — portable, no Python dependency on the host, easy to integrate with orchestrators.
• Running it for a whole organisation? Use Kubernetes — sample manifests and a Helm chart are in deploy/, including the routing the OAuth flow needs for either Contour (the chart's default, and the only one that can mount the server under a path prefix on an existing hostname) or ingress-nginx.
• Using Gemini CLI? Use stdio — Gemini CLI does not support HTTP mode or browser-based OAuth. See Gemini CLI configuration.
• Integrating with Microsoft 365 Copilot? Use Kubernetes (or any remote HTTPS deployment) — Copilot declarative agents only reach remotely hosted MCP servers. A ready-to-sideload agent package and walkthrough are in examples/m365-copilot/.
• Adding it to a Microsoft Copilot Studio agent? Same remote HTTPS deployment, plus MCP_TOOL_RENAME=catalog_=infocat_ — Copilot Studio's agent runtime fails on tool names that start with catalog_. The steps are in examples/copilot-studio/.
• Not sure which Microsoft route fits? examples/microsoft-copilot.md compares the declarative agent and the Copilot Studio agent, and shows the settings for one deployment that serves both.
• Installing from a client's server catalogue? That path runs the published container in stdio mode (app-stdio), not as an HTTP server, so it authenticates from your ~/.sas token cache — which has to be mounted into the container at /app/.sas.

Limiting exposed tools (tiers)

Tools are grouped into numbered tiers. By default the server exposes all of them; set MCP_TIERS to expose only a subset — handy for keeping a client's tool list small and focused, or hiding capabilities a deployment shouldn't offer. Accepts ranges and comma lists (e.g. MCP_TIERS=0-4 or MCP_TIERS=0,1,6,7); unset means all tiers.

# Example: expose only compute/discovery/data-ops and reporting

MCP_TIERS=0-3 uv run app

Read-only mode

Set MCP_READ_ONLY=true to expose only tools that neither change server-side state nor cause server-side work — 57 of the 115 tools. Withheld tools are never registered, so they are absent from the client's tool list entirely: the model cannot see them, so it cannot attempt them.

This is a filter over the tiers, not a tier of its own — the read/write split cuts across every tier (Tier 3 has both get_report and delete_report). The two settings compose:

# Every read tool, all tiers

MCP_READ_ONLY=true uv run app

Read tools of the reporting and decisioning tiers only

MCP_TIERS=3,7 MCP_READ_ONLY=true uv run app

The definition is strict: a tool qualifies only if it can neither write nor start work. Beyond the obvious create/update/delete tools, that withholds:

| cancel_job, reset_compute_session | Destroy som