ModelsAtlas
Explore
Atlas / MCP servers / ui5 / UI5 MCP Server

UI5 MCP ServerSAFE

mcp/ui5/mcp-server
MCP server by ui5 · agenticai · mcp · mcp server · Audited 2026-10-12
⚑ Report / re-scanSource ↗

The UI5 MCP server improves the developer experience when working with agentic AI and the UI5 framework.

Verdict
SAFE
Grade
B
Trust score
87 /100
Exposed tools
—
Transport
stdio
License
Apache-2.0
Stars
101
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol server for UI5 application development.

[](https://ui5-slack-invite.cfapps.eu10.hana.ondemand.com/) [](https://github.com/UI5/mcp-server?tab=coc-ov-file#readme) [](https://api.reuse.software/info/github.com/UI5/mcp-server) [](https://www.npmjs.com/package/@ui5/mcp-server) [](https://coveralls.io/github/UI5/mcp-server)

Description

The UI5 Model Context Protocol server offers tools to improve the developer experience when working with agentic AI tools.

Key Features

  • Helps with the creation of new UI5 projects when working with agentic AI tools
  • Supports the developer to detect and fix UI5-specific errors in the code
  • Provides additional UI5-specific information for agentic AI tools
[!TIP] Make sure to also check out our announcement blog post in the SAP Community!

Available Tools

  • create_integration_card: Scaffolds a new UI Integration Card.
  • create_ui5_app: Scaffolds a new UI5 application based on a set of templates.
  • get_api_reference: Fetches and formats UI5 API documentation.
  • get_guidelines: Provides access to UI5 development best practices.
  • get_integration_cards_guidelines: Provides access to UI Integration Cards development best practices.
  • get_project_info: Extracts metadata and configuration from a UI5 project.
  • get_typescript_conversion_guidelines: Pr
Read from source at commit a682d0ea700eOBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add mcp-server -- npx -y @ui5/[email protected]
03

Trust audit

SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (22)

LOWInventory / provenance · inv.binary · CWE-1104
docs/diagrams/architecture.graffle
architecture.graffle
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
test/lib/resources/documentation/snapshots/getDocumentation.ts.snap
getDocumentation.ts.snap
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
test/lib/tools/create_integration_card/snapshots/create_integration_card.integration.ts.snap
create_integration_card.integration.ts.snap
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
test/lib/tools/create_ui5_app/snapshots/create_ui5_app.integration.ts.snap
create_ui5_app.integration.ts.snap
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
test/lib/tools/get_api_reference/lib/snapshots/apiReferenceResources.ts.snap
apiReferenceResources.ts.snap
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.licensee.json
.licensee.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.nycrc
.nycrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.release-please-manifest.json
.release-please-manifest.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
test/expected/create_ui5_app/com.test.apiapp/.nycrc.json
.nycrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/docs/Documentation.ts:4
import {DocumentationIndexEntry} from "../../src/resources/documentation/getDocumentation.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/docs/getDocsIndex.ts:5
import {fileExists} from "../../src/utils.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/docs/getDocsIndex.ts:6
import {DocumentationIndexEntry} from "../../src/resources/documentation/getDocumentation.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/docs/getDocsRepository.ts:7
import {dirExists} from "../../src/utils.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/resources/documentation/getDocumentation.ts:3
import {fileExists, InvalidInputError, NotFoundError} from "../../utils.js";
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, @ui5/linter, @ui5/logger, @ui5/project, ajv, ajv-formats, async-mutex, ejs
Why it matters. 41 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
resources/template-card/package.json
http-server
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
resources/template-js/package.json
@ui5/cli, @ui5/middleware-code-coverage, eslint, eslint-plugin-jsdoc, globals, karma, karma-chrome-launcher, karma-coverage
Why it matters. 11 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
resources/template-ts/package.json
<% } %>@ui5/cli, @ui5/linter, babel-plugin-istanbul, eslint, typescript-eslint, globals, rimraf, typescript
Why it matters. 11 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
test/expected/create_integration_card/common/package.json
http-server
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOInventory / provenance · inv.oversize · CWE-1104
test/fixtures/api_json_files/openui5-1.120.30/sap.m.api.json
test/fixtures/api_json_files/openui5-1.120.30/sap.m.api.json
Why it matters. 6028274 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
test/fixtures/api_json_files/openui5-1.120.30/sap.ui.core.api.json
test/fixtures/api_json_files/openui5-1.120.30/sap.ui.core.api.json
Why it matters. 4044407 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha a682d0ea700efull audit observations/trust-audit/mcp-server/ui5__mcp-server.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12a682d0ea700eSAFEB87first audit
05

Questions

What is the @ui5/mcp-server MCP server?

The UI5 MCP server improves the developer experience when working with agentic AI and the UI5 framework.

Is @ui5/mcp-server safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does @ui5/mcp-server need?

No credential environment variables were found in its source, so it appears to need none.

How does @ui5/mcp-server run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as openui5-sample-app at 0.5.0.

How current is this page?

The grade is for one exact copy of the source (a682d0ea700e), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement