使用说明

ABAP MCP Server

A Node.js Model Context Protocol (MCP) server that connects AI assistants to SAP ABAP systems via SAP's ADT REST APIs.
Built for Eclipse ADT + GitHub Copilot, but works with any MCP-compatible client (VS Code, Cursor, etc.).

Supports enterprise SSO-only environments with 5 pluggable authentication strategies including Kerberos/SPNEGO, OAuth 2.0, X.509 certificates, Browser SSO, and basic auth.

Features

15 ABAP development tools exposed via MCP — search, read/write code, run tests, query data, analyze dumps
Kerberos/SPNEGO support for corporate SSO systems (SAP Secure Login Client / Windows SSPI)
Dual MCP transport — Streamable HTTP (modern) and legacy SSE (fallback), both on a single /sse endpoint
Automatic CSRF token management and SAP session cookie handling
Login Web UI at /login for interactive OAuth and Browser SSO authentication
Health endpoint at /health to verify connectivity and auth status
stdio mode available for clients that spawn the server as a child process

Tools (15)

Category	Tool	Description
Search	`search_abap_objects`	Search for objects by name pattern with wildcards (programs, classes, tables, etc.)
Search	`search_abap_object_lines`	Full-text search within ABAP source code (grep-like)
Search	`find_where_used`	Where-used analysis for classes, methods, function modules, data elements
Code	`get_abap_object_lines`	Read source code with line numbers (supports line range)
Code	`get_abap_object_info`	Object metadata — package, author, creation date, transport
Code	`write_abap_source`	Write/update source code (auto lock/unlock)
Code	`abap_activate`	Activate one or more ABAP objects
Code	`get_version_history`	Version history with dates and authors
Testing	`run_unit_tests`	Execute ABAP Unit tests, returns pass/fail results
Testing	`run_atc_analysis`	Run ATC static code checks, returns findings with priorities
Data	`execute_data_query`	Execute freestyle ABAP SQL or preview table contents
Data	`get_abap_sql_syntax`	ABAP SQL quick reference (joins, aggregates, CDS, functions)
System	`analyze_abap_dumps`	List runtime dumps (ST22) — extracts error, call stack, source context
System	`get_sap_system_info`	System ID, release, kernel, database info
System	`manage_transport_requests`	List, create, or release transport requests (CTS)

Quick Start

Prerequisites

Node.js 18+
SAP system with ADT services enabled (ICF service /sap/bc/adt active)
Network access to the SAP server
One of: domain credentials (Kerberos), SAP username/password, OAuth client, X.509 cert, or browser SSO access

Install & Build

cd abap-mcp-server
npm install
npm run build

Configure

cp .env.example .env

Edit .env:

# SAP connection
SAP_BASE_URL=http://your-sap-server:8000
SAP_CLIENT=100
SAP_LANGUAGE=en

# Authentication (see Authentication section below)
AUTH_METHOD=kerberos          # or: basic, oauth, certificate, browser_sso, auto

# Server
SERVER_MODE=sse
SSE_PORT=3001

Run

# SSE mode (recommended for Eclipse ADT)
npm run start:sse

# stdio mode (for clients that spawn the process)
npm start

The server starts at http://localhost:3001:

Endpoint	Purpose
`/sse`	MCP endpoint (Streamable HTTP + legacy SSE)
`/login`	Interactive login UI (OAuth / Browser SSO)
`/health`	Health check with auth status (JSON)
`/auth/status`	Current authentication status
`/auth/validate`	Validate current session

Authentication

Five pluggable strategies. Set AUTH_METHOD in .env:

Method	`AUTH_METHOD` value	When to use
Kerberos/SPNEGO	`kerberos` or `spnego`	Corporate SSO with SAP Secure Login Client on Windows
Basic Auth	`basic`	Dev/sandbox systems with username + password
OAuth 2.0	`oauth`	SSO environments with OAuth configured in SAP (SOAUTH2)
X.509 Certificate	`certificate` or `cert`	Certificate-based mutual TLS systems
Browser SSO	`browser_sso` or `sso`	Any SSO mechanism (SAML, Kerberos) via cookie capture
Auto-detect	`auto` (default)	Tries basic → certificate → OAuth → browser SSO

Kerberos/SPNEGO (Recommended for Corporate SSO)

Uses Windows SSPI to obtain SPNEGO tokens from the current user's Kerberos TGT. Works seamlessly with SAP Secure Login Client — no passwords stored.

AUTH_METHOD=kerberos

# Optional — auto-detected from SAP_BASE_URL hostname
# KERBEROS_REALM=CORP.EXAMPLE.COM
# KERBEROS_SPN=HTTP/sapserver.corp.example.com@CORP.EXAMPLE.COM

Requirements:

Windows domain-joined machine
SAP Secure Login Client running (with valid Kerberos token)
SAP ICF service has SPNego authentication enabled

How it works:

Server starts → uses SSPI to get a SPNEGO token from your Kerberos TGT
Sends Authorization: Negotiate <token> to SAP
SAP returns MYSAPSSO2 session cookies → reused for all subsequent API calls
MCP tools are immediately available — fully automatic, no interactive login needed

Basic Auth

AUTH_METHOD=basic
SAP_USERNAME=developer
SAP_PASSWORD=your_password

OAuth 2.0

Requires an OAuth client configured in SAP (transaction SOAUTH2):

AUTH_METHOD=oauth
OAUTH_CLIENT_ID=your_client_id
OAUTH_CLIENT_SECRET=your_client_secret
OAUTH_SCOPE=SAP_ADT

Flow:

Start server → open http://localhost:3001/login
Click Start OAuth Login → redirected to SAP → SAML/SSO → authorized
SAP redirects back with authorization code → server exchanges for access token
Token auto-refreshes; MCP tools are now active

X.509 Client Certificate

AUTH_METHOD=certificate
CLIENT_CERT_PATH=./certs/client.pem
CLIENT_KEY_PATH=./certs/client-key.pem
CA_CERT_PATH=./certs/ca.pem              # optional
CLIENT_KEY_PASSPHRASE=optional_passphrase  # optional

Browser SSO / Cookie Capture

Works with any SSO mechanism. No SAP-side configuration needed.

AUTH_METHOD=browser_sso

Flow:

Start server → open http://localhost:3001/login
Log into SAP in your browser (SSO handles it)
Use the provided bookmarklet to capture your session cookies
Paste into the login page → MCP tools are now active

Eclipse ADT Setup

1. Start the Server

cd abap-mcp-server
npm run start:sse

2. Configure MCP in Eclipse

Open Window → Preferences → GitHub Copilot → Model Context Protocol
In Server Configurations, enter:

{
  "servers": {
    "abap-tools": {
      "url": "http://localhost:3001/sse"
    }
  }
}

Click Apply and Close

3. Verify

Open GitHub Copilot chat in Eclipse ADT and ask:

"What ABAP tools are available?"

Usage Examples

Search

"Search for all classes starting with ZCL_MATERIAL"
"Find all code that references BAPI_SALESORDER_CREATEFROMDAT2"
"Where is class ZCL_MY_HELPER used?"

Code

"Show me the source code of program ZSALES_REPORT"
"What's the metadata for table MARA?"
"Write this code to program ZTEST and activate it"
"Show the version history of class ZCL_MY_CLASS"

Testing & Quality

"Run unit tests for class ZCL_MY_CLASS"
"Run ATC analysis on program ZSALES_REPORT"

Data Queries

"Show me the first 10 rows from table MARA"
"SELECT matnr, maktx FROM makt WHERE spras = 'E' UP TO 20 ROWS"

System & Analysis

"Show me recent runtime dumps"
"Show dumps for user JSMITH from today"
"List my open transport requests"
"What SAP system am I connected to?"

Architecture

┌──────────────────┐    Streamable HTTP     ┌─────────────────────┐   ADT REST API   ┌─────────────┐
│  Eclipse ADT     │◄──────────── /sse ───►│  ABAP MCP Server    │◄────────────────►│  SAP System │
│  + GitHub        │    (or legacy SSE)     │  (Node.js/Express)  │  /sap/bc/adt/*   │  (ABAP)     │
│    Copilot       │                        │                     │                  │             │
├──────────────────┤    MCP Protocol        │  15 Tools           │                  │  ADT APIs:  │
│  or: VS Code     │                        │  ├─ Search (3)      │                  │  - Search   │
│  or: Cursor      │                        │  ├─ Code (5)        │                  │  - Source   │
│  or: any MCP     │                        │  ├─ Testing (2)     │                  │  - Tests    │
│    client        │                        │  ├─ Data (2)        │                  │  - ATC      │
└──────────────────┘                        │  └─ System (3)      │                  │  - Dumps    │
                                            │                     │                  │  - CTS      │
┌──────────────────┐   /login               │  Auth Strategies:   │                  └─────────────┘
│  Browser         │──────────────────────►│  ├─ Kerberos/SPNEGO │                        ▲
│  (for SSO login) │                        │  ├─ Basic Auth      │   SPNEGO / mTLS /     │
└──────────────────┘                        │  ├─ OAuth 2.0 PKCE  │   SAP cookies         │
                                            │  ├─ X.509 Cert      │────────────────────────┘
                                            │  └─ Browser SSO     │
                                            └─────────────────────┘

Multiple SAP Systems

Run multiple instances on different ports:

# Terminal 1 — Development
SAP_BASE_URL=http://dev-server:8000 SAP_CLIENT=100 SSE_PORT=3001 AUTH_METHOD=kerberos node dist/index.js

# Terminal 2 — Quality
SAP_BASE_URL=http://qa-server:8000  SAP_CLIENT=200 SSE_PORT=3002 AUTH_METHOD=kerberos node dist/index.js

Configure all in Eclipse ADT:

{
  "servers": {
    "abap-dev": { "url": "http://localhost:3001/sse" },
    "abap-qa":  { "url": "http://localhost:3002/sse" }
  }
}

Project Structure

abap-mcp-server/
├── src/
│   ├── index.ts              # Entry point — Express server, MCP transport, tool routing
│   ├── sap-client.ts         # SAP ADT HTTP client (CSRF, cookies, request/response)
│   ├── login-ui.ts           # Login web UI and auth routes
│   ├── auth/
│   │   ├── types.ts          # AuthStrategy interface
│   │   ├── basic.ts          # Basic Auth (username/password)
│   │   ├── oauth.ts          # OAuth 2.0 Authorization Code + PKCE
│   │   ├── kerberos.ts       # Kerberos/SPNEGO via Windows SSPI
│   │   ├── certificate.ts    # X.509 client certificate (mTLS)
│   │   ├── browser-sso.ts    # Browser SSO cookie capture
│   │   └── index.ts          # Auth barrel export
│   └── tools/
│       ├── search.ts         # search_abap_objects, search_abap_object_lines, find_where_used
│       ├── code.ts           # get/write source, activate, object info, version history
│       ├── testing.ts        # run_unit_tests, run_atc_analysis
│       ├── data-query.ts     # execute_data_query, get_abap_sql_syntax
│       └── analysis.ts       # analyze_abap_dumps, get_sap_system_info, manage_transport_requests
├── .env                      # Local configuration (not committed)
├── .env.example              # Configuration template
├── package.json
└── tsconfig.json

Configuration Reference

Variable	Default	Description
`SAP_BASE_URL`	`https://vhcala4hci:44300`	SAP system URL (HTTP or HTTPS)
`SAP_CLIENT`	`001`	SAP client number
`SAP_LANGUAGE`	`en`	Logon language
`SAP_SKIP_SSL`	`false`	Skip SSL verification (for self-signed certs)
`AUTH_METHOD`	`auto`	`auto`, `basic`, `oauth`, `kerberos`, `certificate`, `browser_sso`
`SAP_USERNAME`		SAP username (basic auth)
`SAP_PASSWORD`		SAP password (basic auth)
`OAUTH_CLIENT_ID`		OAuth 2.0 client ID
`OAUTH_CLIENT_SECRET`		OAuth 2.0 client secret
`OAUTH_SCOPE`	`SAP_ADT`	OAuth scope
`CLIENT_CERT_PATH`		Path to X.509 client certificate
`CLIENT_KEY_PATH`		Path to private key
`CA_CERT_PATH`		Path to CA certificate (optional)
`CLIENT_KEY_PASSPHRASE`		Private key passphrase (optional)
`KERBEROS_REALM`	(auto)	Kerberos realm (auto-detected from hostname)
`KERBEROS_SPN`	(auto)	Kerberos Service Principal Name
`SERVER_MODE`	`sse`	`sse` (HTTP server) or `stdio` (child process)
`SSE_PORT`	`3001`	HTTP server port

Troubleshooting

Issue	Solution
Connection refused	Ensure server is running and port matches Eclipse config
401 Unauthorized	Check credentials; for Kerberos, verify SAP Secure Login Client is running
403 Forbidden	CSRF token issue — usually resolves automatically on retry
406 Not Acceptable	Server handles ADT Accept headers automatically — update to latest build
SSL certificate error	Set `SAP_SKIP_SSL=true` or add the CA cert
Tools not appearing in Copilot	Restart Eclipse ADT after changing MCP config
Kerberos auth fails	Check: domain-joined? SAP Secure Login Client active? SPNego enabled in SAP ICF?
ICF service inactive	Ask Basis to activate `/sap/bc/adt` in SICF
SSO session expired	For Kerberos: restart server. For browser SSO: visit `/login`
OAuth redirect fails	Verify `OAUTH_CLIENT_ID` and callback URI in SOAUTH2
Port already in use	Change `SSE_PORT` in `.env` or kill orphaned node processes

Security

Credentials in .env — add to .gitignore (already excluded)
Server runs locally on localhost — no credentials sent externally
Kerberos/SPNEGO never stores passwords — uses Windows domain TGT
CSRF tokens auto-managed, session cookies kept in memory only
Restrict the SAP user's authorizations to ADT-relevant objects