Atlas / MCP servers / fr0ster / @mcp-abap-adt/adt-clients

@mcp-abap-adt/adt-clientsCAUTION

Name: @mcp-abap-adt/adt-clients
Author: fr0ster

mcp/fr0ster/mcp-abap-adt-clients

MCP server by fr0ster · Audited 2026-10-11

⚑ Report / re-scan Source ↗

ADT clients for SAP ABAP systems - Read-only, CRUD, and Management operations

Verdict

CAUTION

Grade

Trust score

86 /100

Exposed tools

11 11r · 0w · 0d

Transport

—

License

LGPL-3.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://stand-with-ukraine.pp.ua)

TypeScript clients for SAP ABAP Development Tools (ADT).

Upgrading from 22.x? 23.0.0 makes this package interpret nothing: every member answers the document SAP sent unless you give it a reading when you build it, and judges nothing unless you pass analyse with the call. Every reading and verdict it used to apply is a strategy in @mcp-abap-adt/adt-strategies. The connection contract moved to @mcp-abap-adt/interfaces-adt-connection. docs/usage/MIGRATION-23.md has the replacing code for every removed behaviour. From 18.x? Read docs/usage/MIGRATION-19.md first: 19.0.0 is where members became one endpoint call each.

Features

✅ Client API – simplified interface for common operations:
AdtClient – high-level CRUD API; one member, one ADT request
AdtExecutor – execution API via IExecutor contracts (class/program, with profiling)
AdtRuntimeClient – runtime operations (traces, logs, dumps, ATC check runs)
AbapDebugger, AmdpDebugger, MemorySnapshots – the ABAP and AMDP debuggers and memory snapshots, each on connections the caller opens
AdtClientsWS – realtime WebSocket facade for event-driven workflows
AdtAbapGitClient – standalone client for SAP-official ADT-integrated abapGit (/sap/bc/adt/abapgit/*); available on cloud and modern on-prem (ABAP Platform 2022+)
✅ ABAP Unit test support – run and manage ABAP Unit tests (class and CDS view tests)
✅ Stateful session management – maintains sap-adt-connection-id across operations
✅ Lock registry – persistent .locks/active-locks.json with CLI tools for recovery
✅ TypeScript-first – full type safety with comprehensive interfaces
✅ **Response

Read from source at commit 62e81dc728faOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add adt-strategies --env NODE_TLS_REJECT_UNAUTHORIZED=${NODE_TLS_REJECT_UNAUTHORIZED} --env SAP_AUTH_TYPE=${SAP_AUTH_TYPE} --env SAP_JWT_TOKEN=${SAP_JWT_TOKEN} --env SAP_PASSWORD=${SAP_PASSWORD} -- npx -y @mcp-abap-adt/[email protected]

claude-desktop

{
  "mcpServers": {
    "adt-strategies": {
      "command": "npx",
      "args": [
        "-y",
        "@mcp-abap-adt/[email protected]"
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "${NODE_TLS_REJECT_UNAUTHORIZED}",
        "SAP_AUTH_TYPE": "${SAP_AUTH_TYPE}",
        "SAP_JWT_TOKEN": "${SAP_JWT_TOKEN}",
        "SAP_PASSWORD": "${SAP_PASSWORD}"
      }
    }
  }
}

Exposed tools (11)

11 read · 0 write · 0 destructive.

Tool	Risk	Description
`TEST_MCP`	read	workflow field
`ZCL_AC_LOAN_DEMO`	read	Runnable demo of the loan register
`ZCL_AC_LOAN_ITEM`	read	One book loan
`ZCL_AC_LOAN_POLICY_STD`	read	Standard loan policy: 14 days, 5 per day late
`ZCL_AC_LOAN_REGISTER`	read	Loan register: issue, take back, count open
`ZIF_AC_LOAN_POLICY`	read	Loan policy: due dates and fines
`ZMC`	read	d
`ZT`	read	D
`zac_shr_pkg`	read	Test
`zok_test`	read	A & B
`zp`	read	d

Trust audit

CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (1 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (19)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

scripts/probe-domain-create-payload.ts

probe-domain-create-payload.ts

Why it matters. member named after an attack tool

Fix. remove or justify