Abap Adt MCP

abap-adt-mcp

Let Claude read, write, test and check ABAP code on your SAP systems.

English · Português (Brasil) · Deutsch · Project site

You type a sentence in Claude. You get back an activated class, green unit tests and a transport number. abap-adt-mcp is the server in between: a Model Context Protocol server that gives Claude Desktop, Claude Code, VS Code or any other MCP host the same ADT services Eclipse uses, on every SAP system you configure, S/4HANA Cloud and on-prem alike. 173 tools, one process, and guard rails the server enforces itself: a destination marked read-only refuses every write before it reaches SAP, whatever the host approves.

See it in motion. The project site has seven short films, the setup in three steps and what to ask the model.

Before you connect a production system

- The model acts as your SAP user and can do nothing Eclipse would refuse you. What it reads (source, dumps, table rows where you open them) is sent to the model.

- A destination without a policy block is writable in every package your user may edit; table data stays closed until you open it.

- Recommended: development and test systems only. If a production destination must exist, give it the PRD policy of step 4: the server enforces it before any SAP call, whatever the host approves, so a careless prompt cannot write where the policy forbids it (For administrators).

See it work

That is the whole idea. You type a sentence. The model picks the tools, the server locks the object, writes, activates and unlocks it, and the unit tests come back green with a transport number attached. Ask for the same change on a production system and the answer is policyDenied before a single SAP call goes out: the guard rails live in the server, not in the chat window.

Seven short films show this and the single jobs behind it, a short dump traced to its line, an ATC run with its quickfixes, a transport review, a class created with its test, an ABAP Cloud readiness check. They are on the project site.

Table of contents

• See it work
• Setup
• What to ask the model
• For administrators
• Authentication
• S/4HANA Cloud versus on-prem
• Other ways to install
• Configuration
• Tool catalog
• Compared with SAP's official ADT MCP Server
• SAP API Policy
• Troubleshooting
• Testing and contributing
• Credits
• License

Setup

Three prerequisites:

• Node.js 22.12 or newer (22 or 24 LTS) from nodejs.org. On a managed laptop the ticket to IT is one line: "Please install Node.js LTS (22 or newer)"; nothing else needs installing.
• Access to the SAP system, the same as for Eclipse ADT: on S/4HANA Cloud the developer business role (SAP_BR_DEVELOPER in the standard delivery); on-prem, ask your Basis team for the /sap/bc/adt service in SICF and the usual ADT authorizations.
• A Chromium browser (Chrome, Edge or Brave) for the browser login (authType: sso, the default); not needed for basic, oauth or sso2.

1. Describe your SAP systems

Create the folder .abap-adt-mcp in your home directory and the file systems.json inside it, one entry per system (a "destination"):

• Windows: the folder is C:\Users\ \.abap-adt-mcp. Paste the JSON into Notepad and in Save As set "Save as type" to "All files" and the name to systems.json, otherwise Notepad saves systems.json.txt and the server finds nothing.
• macOS: the folder is /Users/ /.abap-adt-mcp (Finder, Shift-Cmd-G, ~); any editor.

{

"DEV": { "url": "https://myXXXXXX.s4hana.cloud.sap", "client": "080", "authType": "sso", "default": true, "policy": { "allowedPackages": ["ZFIN"] } } }

• DEV is your name for the system and the word you will use in chats; "default": true lets you omit it.
• url: the address you open the launchpad or Eclipse with, without a path.
• client: the client your SSO session logs on to (About in the launchpad's user menu shows it). A wrong client shows up later as "not authorized" on objects you can open in Eclipse.
• authType defaults to sso: a browser window opens once for the login, like Eclipse ADT. Other modes: Authentication.
• policy.allowedPackages: the packages the model may write to, exact names or patterns (ZFIN, Z*). Leave it out and every package you can edit in Eclipse is writable; start with one.

Production and on-prem systems come in step 4, after the first successful call.

2. Register the server in your host

The package is on npm as abap-adt-mcp; npx fetches it. Claude Desktop, no terminal: first block. Claude Code: one command. VS Code, Cursor and others: pointer below. Every entry passes the server two settings: SAP_SYSTEMS_FILE (where systems.json is) and MCP_TOOLSETS=focused, which publishes the 114 everyday development tools instead of all 173 so the tool schemas do not eat the chat's context (drop it when you need the debugger, traces, abapGit, RAP or refactoring).

Claude Desktop, no terminal needed:

1. Settings > Developer > Edit Config opens the folder that holds claude_desktop_config.json; open the file in Notepad or any editor. If Settings has no Developer tab, your Claude Desktop is managed by IT: ask them to add the entry below.
2. If the file already contains "mcpServers", add only the "abap-adt-mcp" entry inside it; if it is empty, paste the whole block.
3. Replace with your user name (macOS: /Users/ /.abap-adt-mcp/systems.json). The forward slashes in the Windows path are deliberate: JSON needs \\ for every backslash, forward slashes need nothing.
4. Quit and reopen the app.

{

"mcpServers": { "abap-adt-mcp": { "command": "npx", "args": ["-y", "abap-adt-mcp"], "env": { "SAP_SYSTEMS_FILE": "C:/Users/ /.abap-adt-mcp/systems.json", "MCP_TOOLSETS": "focused" } } } }

Claude Code, one line in a terminal (-s user registers the server for every project, not only the current folder):

claude mcp add -s user abap-adt-mcp -e SAP_SYSTEMS_FILE=$HOME/.abap-adt-mcp/systems.json -e MCP_TOOLSETS=focused -- npx -y abap-adt-mcp

The same on Windows PowerShell:

claude mcp add -s user abap-adt-mcp -e SAP_SYSTEMS_FILE=$env:USERPROFILE\.abap-adt-mcp\systems.json -e MCP_TOOLSETS=focused -- npx -y abap-adt-mcp

VS Code with GitHub Copilot: the same entry in .vscode/mcp.json under a top-level servers key instead of mcpServers; docs/HOSTS.md has the file as tested, with ${input:} for secrets.

• Cursor, Cline, Windsurf, the Copilot CLI and Eclipse: docs/HOSTS.md.
• Keep the key abap-adt-mcp: it is the name the host shows, the prefix of every tool, and what this project's agent skills look for.

3. Say hello

Open a new chat and type (replace DEV with the key you chose; the class is standard SAP, so the prompt is read-only and safe on any system):

List my SAP systems, log in to DEV and show me the source of class CL_ABAP_CHAR_UTILITIES.

A browser window opens for the SSO login (tick "stay signed in" and later logins are silent); the model then calls listSystems, searchObject and getObjectSource, and the reply names your destinations and ends with the class source. The host asks before running a tool you have not approved permanently: that dialog is a courtesy of the host, the policy block is the guarantee. If the server does not appear in the host, Troubleshooting names the log to read.

Two things worth knowing before the first edit:

• A write the policy forbids comes back as a refusal, not as a silent no-op: kind: "policyDenied", Policy: setObjectSource blocked on destination PRD (readOnly).
• Every change the model makes is on your transport and in the object's version history: objectDiff and revisions show it, and nothing leaves DEV without a transport release you approve.

4. Add production and on-prem systems

The same file with a production entry and an on-prem entry (systems.example.json has every option):

{

"DEV": { "url": "https://myXXXXXX.s4hana.cloud.sap", "client": "080", "authType": "sso", "default": true, "policy": { "allowedPackages": ["Z*"] } }, "PRD": { "url": "https://myYYYYYY.s4hana.cloud.sap", "client": "100", "authType": "sso", "policy": { "readOnly": true, "allowDataPreview": false, "deniedTools": ["exportPackageSources"] } }, "ONPREM": { "url": "https://sap.example.com:44300", "client": "100", "authType": "basic", "user": "DEVELOPER", "password": "${env:ONPREM_PASSWORD}", "policy": { "allowedPackages": ["Z*", "$*"] }, "tls": { "ca": "/etc/ssl/corp-ca.pem" } } }

• If a production destination must exist, PRD is its minimum policy: readOnly refuses every write, whatever the model is asked; allowDataPreview: false keeps table data closed even where the environment opens it for other destinations; deniedTools closes exportPackageSources, the one read that copies whole packages to disk.
• ${env:VAR} reads a secret from the environment, so it never sits in the file; add the variable where the host starts the server: -e ONPREM_PASSWORD=... on claude mcp add (or export it in the shell that starts Claude Code), a "ONPREM_PASSWORD": "..." line in the env block of Claude Desktop, which does not pass your shell environment on. A file with an inline password must be readable by you only (chmod 600 ~/.abap-adt-mcp/systems.json on macOS and Linux; on Windows your profile folder is already private); an SSO-only file needs nothing.
• tls.ca names a corporate CA certificate. Verification can be relaxed per destination only (insecureTls: true, announced at startup), never for the whole process.
• An older on-prem system (SAP_BASIS below 7.51, such as SAP ERP 6.0 EHP7 or EHP8) reads fine over HTTP but cannot keep a lock between requests, so writes fail. Give its entry "transport": "rfc" and an rfc block, and install the SAP NetWeaver RFC SDK, which you download from SAP with your own S-user because SAP does not allow it to be bundled. docs/RFC.md has the