Atlas / MCP servers / fr0ster / ABAP ADT

ABAP ADTBLOCK

Name: ABAP ADT
Author: fr0ster

mcp/fr0ster/abap-adt-1

MCP server by fr0ster · abap · abap cloud · adt · Audited 2026-10-07

⚑ Report / re-scan Source ↗

MCP server for SAP BTP ABAP Cloud and On-Premise ECC/S/4HANA ABAP ADT with full CRUD, JWT/XSUAA, and service-key auth.

Verdict

BLOCK

Grade

Trust score

67 /100

Exposed tools

46 44r · 2w · 0d

Transport

sse · stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://stand-with-ukraine.pp.ua)

mcp-abap-adt is an MCP server for ABAP ADT in SAP ECC/S/4HANA (on-premise) and SAP BTP ABAP Cloud systems. It gives agents controlled access to real ABAP repositories through ADT, so analysis and changes are grounded in system data instead of assumptions. It is built for AI-assisted pair programming (AIPNV: AI Pairing, Not Vibing), not autopilot vibe coding.

Primary workflows:

Deep ABAP analysis: where-used, object metadata, repository navigation, object structure, semantic analysis, dependency and impact exploration.
High-level ABAP development: rapid CRUD and iterative updates for RAP and classic ABAP artifacts (classes, interfaces, function groups/modules, programs, DDIC, CDS/view/service artifacts), validated through ADT flows.

Why teams use it:

Full CRUD (not read-only): create, read, update, and delete ABAP artifacts
Works with On-Premise (ECC/S/4HANA) and ABAP Cloud (BTP) systems
Legacy systems (BASIS < 7.50) are not supported at present: that support is parked on the parked/legacy-support branch until it can be tried against a live legacy system
Four authentications: basic (HTTP or RFC), SNC (passwordless, RFC), JWT with browser login (service key, ABAP or XSUAA) and JWT you already hold
Multiple transports: stdio, HTTP, SSE
Several installation variants: the full server (@mcp-abap-adt/core) or the compact one (@mcp-abap-adt/compact), each connecting to the system over HTTP, RFC or SNC — see Installation variants
Rich tool surface for ABAP objects, metadata, transports, and search

**Authorization & Destina

Read from source at commit bbd7744e23c0OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add core -- npx -y @mcp-abap-adt/[email protected]

Exposed tools (46)

44 read · 2 write · 0 destructive.

Tool	Risk	Description
`ActivateBehaviorDefinition`	write	Activate a RAP behavior definition. Use after CreateBehaviorDefinition or UpdateBehaviorDefinition if the object remains inactive.
`ActivateClass`	read	Activate an ABAP class. Use after CreateClass or UpdateClass if the object remains inactive.
`ActivateDataElement`	read	Activate an ABAP data element. Use after CreateDataElement or UpdateDataElement if the object remains inactive.
`ActivateDdl`	read	Activate a CDS view. Use after CreateDdl or UpdateDdl if the object remains inactive.
`ActivateDomain`	read	Activate an ABAP domain. Use after CreateDomain or UpdateDomain if the object remains inactive.
`ActivateFunctionGroup`	read	Activate an ABAP function group. Use after CreateFunctionGroup or UpdateFunctionGroup if the object remains inactive.
`ActivateFunctionModule`	read	Activate an ABAP function module. Use after UpdateFunctionModule if the object remains inactive.
`ActivateInterface`	read	Activate an ABAP interface. Use after CreateInterface or UpdateInterface if the object remains inactive.
`ActivateMetadataExtension`	read	Activate a CDS metadata extension. Use after CreateMetadataExtension or UpdateMetadataExtension if the object remains inactive.
`ActivateProgram`	read	Activate an ABAP program. Use after CreateProgram or UpdateProgram if the object remains inactive.
`ActivateServiceBinding`	read	Activate an ABAP service binding. Use after CreateServiceBinding or UpdateServiceBinding if the object remains inactive.
`ActivateServiceDefinition`	write	Activate an ABAP service definition. Use after CreateServiceDefinition or UpdateServiceDefinition if the object remains inactive.
`ActivateStructure`	read	Activate an ABAP structure. Use after CreateStructure or UpdateStructure if the object remains inactive.
`ActivateTable`	read	Activate an ABAP table. Use after CreateTable or UpdateTable if the object remains inactive.
`Closure`	read	d
`NotTheToolName`	read	Not a tool definition at all — just something with a name.
`Report`	read	d
`StubMultiItem`	read	returns multi-item content
`StubReturnsIsError`	read	returns an isError result
`StubThrowsAxios`	read	throws an AxiosError with a response body
`StubThrowsMcpError`	read	throws an SDK McpError, as an external handler group might
`StubThrowsPlainError`	read	throws a plain Error
`WhoAmI`	read	reports the context
`WithContext`	read	d
`ZADT_BLD_PKG03`	read	x
`ZCHILD_A`	read	Child A
`ZCHILD_B`	read	Child B
`ZCL_PLACEHOLDER`	read	placeholder
`ZD`	read	x
`ZDT_X`	read	x
`ZFG_X`	read	MARKER_FG
`ZFM_X`	read	x
`ZI_X_DDLX`	read	x
`ZMC`	read	new desc
`ZMCP_SHR_FGRP`	read	after
`ZMCP_SHR_PKG`	read	x
`ZMY_MSGS`	read	My messages
`ZP`	read	after
`ZPACKAGE_PLACEHOLDER`	read	placeholder
`ZST_X`	read	x
`ZVW_X`	read	x
`Z_X`	read	x
`zmcp_bld_crt_dom`	read	x
`zmcp_bld_crt_dtel`	read	x
`zmy_msgs`	read	My messages
`zp`	read	x

Trust audit

BLOCKgrade D · trust 67/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (1 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

scripts/capture-adt-corpus.ts:838

const testConfig = yaml.load(fs.readFileSync(testConfigPath, 'utf-8')) as any;

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

backups/shared-ZADT_BLD_PKG03.yaml:31

codeBase64: bWFuYWdlZCBpbXBsZW1lbnRhdGlvbiBpbiBjbGFzcyB6YnBfbWNwX3Nocl9pX3Jvb3QgdW5pcXVlOwpzdHJpY3QgKCAyICk7CgpkZWZpbmUgYmVoYXZpb3IgZm9yIFpNQ1BfU0hSX0lfUk9PVApwZXJzaXN0ZW50IHRhYmxlIHptY3Bfc2hyX3J0YWJs

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

backups/shared-ZADT_BLD_PKG03.yaml:47

codeBase64: Q0xBU1MgemJwX21jcF9zaHJfaV9yb290IERFRklOSVRJT04NCiAgUFVCTElDDQogIENSRUFURSBQVUJMSUMgLg0KDQogIFBVQkxJQyBTRUNUSU9OLg0KICBQUk9URUNURUQgU0VDVElPTi4NCiAgUFJJVkFURSBTRUNUSU9OLg0KRU5EQ0xBU1MuDQoN

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

backups/shared-ZADT_BLD_PKG03.yaml:65

codeBase64: Q0xBU1Mgem1jcF9ibGRfY2xzdXRfbDEgREVGSU5JVElPTg0KICBQVUJMSUMNCiAgQ1JFQVRFIFBVQkxJQyAuDQoNCiAgUFVCTElDIFNFQ1RJT04uDQogIFBST1RFQ1RFRCBTRUNUSU9OLg0KICBQUklWQVRFIFNFQ1RJT04uDQpFTkRDTEFTUy4NCg0K

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

backups/shared-ZADT_BLD_PKG03.yaml:79

codeBase64: QEVuZFVzZXJUZXh0LmxhYmVsIDogJ1NoYXJlZCBDRFMgdmlldyBmb3IgQ0RTIHVuaXQgdGVzdCcKQEFjY2Vzc0NvbnRyb2wuYXV0aG9yaXphdGlvbkNoZWNrIDogI05PVF9SRVFVSVJFRApkZWZpbmUgdmlldyBlbnRpdHkgWk1DUF9CTERfQ0RTVl9I

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

backups/shared-ZADT_BLD_PKG03.yaml:93

codeBase64: QEVuZFVzZXJUZXh0LmxhYmVsIDogJ1NoYXJlZCBjb25zdW1wdGlvbiBwcm9qZWN0aW9uJwpAQWNjZXNzQ29udHJvbC5hdXRob3JpemF0aW9uQ2hlY2sgOiAjTk9UX1JFUVVJUkVECmRlZmluZSByb290IHZpZXcgZW50aXR5IFpNQ1BfU0hSX0NfUk9P

LOWInventory / provenance · inv.hidden_file · CWE-1104

.sdd-report.md

.sdd-report.md

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

src/__tests__/integration/readOnly/.keep

.keep

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

src/handlers/system/high/.keep

.keep

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/__tests__/integration/globalSetup.ts:38

return yaml.load(content);

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/__tests__/integration/helpers/configHelpers.ts:257

(yaml.load(fs.readFileSync(chosen, 'utf8')) as Record<string, unknown>) ||

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/__tests__/integration/helpers/configHelpers.ts:274

cachedConfig = (yaml.load(configContent) as Record<string, unknown>) || {};

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/__tests__/integration/helpers/configHelpers.ts:284

(yaml.load(templateContent) as Record<string, unknown>) || {};

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

compact/src/__tests__/compactCapabilitySplit.test.ts:22

const REPO = resolve(__dirname, '../../..');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

compact/src/__tests__/compactProgramIsOnprem.test.ts:26

join(__dirname, '../../../compact-readonly/src/handlers'),

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

compact/src/__tests__/compactProgramIsOnprem.test.ts:27

join(__dirname, '../../../compact-modify/src/handlers'),

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

compact/src/__tests__/compactSurface.test.ts:43

readFileSync(join(__dirname, '../../tests/fixtures/surface.json'), 'utf8'),

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

server/src/__tests__/destinationRouting.test.ts:13

jest.mock('../../../src/lib/connectionFactory', () => ({

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/installation/platforms/INSTALL_LINUX.md:420

Server will be available at: `http://127.0.0.1:4100/sse`

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/installation/platforms/INSTALL_MACOS.md:364

Server will be available at: `http://127.0.0.1:4100/sse`

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/installation/platforms/INSTALL_WINDOWS.md:363

Server will be available at: `http://127.0.0.1:4100/sse`

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

server/src/__tests__/destinationRouting.test.ts:110

resolve({ server: srv, baseUrl: `http://127.0.0.1:${port}` });

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

server/src/__tests__/healthEndpoint.test.ts:28

resolve({ server: srv, baseUrl: `http://127.0.0.1:${port}` });

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

server/src/__tests__/tlsServer.test.ts:44

{ rejectUnauthorized: false },

Why it matters. certificate verification is disabled

Fix. leave verification on

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

compact-modify/package.json

@mcp-abap-adt/lib, typescript, @types/node

Why it matters. 3 dependency range(s) float

Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha bbd7744e23c0full audit observations/trust-audit/mcp-server/fr0ster__abap-adt-1.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-07	`bbd7744e23c0`	BLOCK	D	67	first audit

Questions

What is the ABAP ADT MCP server?

MCP server for SAP BTP ABAP Cloud and On-Premise ECC/S/4HANA ABAP ADT with full CRUD, JWT/XSUAA, and service-key auth.

What tools does ABAP ADT expose?

46 in total: 44 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is ABAP ADT safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (67/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does ABAP ADT need?

It reads AUTH_BROKER_PATH, DEBUG_AUTH_BROKER, DEBUG_AUTH_LOG, DEBUG_AUTH_PROVIDERS, DEBUG_AUTH_STORES, MCP_BROWSER_AUTH_PORT, MCP_TLS_KEY, SAP_AUTH_TYPE, SAP_JWT_TOKEN, SAP_PASSWORD, SAP_REFRESH_TOKEN and SAP_UAA_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does ABAP ADT run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @mcp-abap-adt/core at 17.1.0.

How current is this page?

The grade is for one exact copy of the source (bbd7744e23c0), read on 2026-10-07. The repository is watched and re-audited when it changes.

Source	fr0ster/mcp-abap-adt
npm	`@mcp-abap-adt/core@17.1.0`
Transports	sse · stdio · streamable-http
Credentials it reads	`AUTH_BROKER_PATHDEBUG_AUTH_BROKERDEBUG_AUTH_LOGDEBUG_AUTH_PROVIDERSDEBUG_AUTH_STORESMCP_BROWSER_AUTH_PORTMCP_TLS_KEYSAP_AUTH_TYPESAP_JWT_TOKENSAP_PASSWORDSAP_REFRESH_TOKENSAP_UAA_CLIENT_SECRET`
License	Apache-2.0
Activity	pushed 1d ago