SAP HANA连接器

git clone <repo-url>
cd sap-hana-mcp

# Configure SAP npm registry (required for @sap/hana-client)
npm config set @sap:registry https://npm.sap.com

pnpm install
pnpm build

# Generate a token + hash pair
TOKEN=$(openssl rand -hex 32)
HASH=$(echo -n "$TOKEN" | shasum -a 256 | cut -d' ' -f1)
echo "token: $TOKEN"
echo "hash:  sha256:$HASH"

{
  "mcpServers": {
    "sap-broker": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/sap-hana-mcp/dist/index.js"],
      "env": {
        "HANA_HOST": "your-hana-host.example.com",
        "HANA_PORT": "30015",
        "HANA_USER": "MCP_READER",
        "HANA_PASSWORD": "your_password",
        "HANA_SCHEMA": "YOUR_SCHEMA"
      }
    }
  }
}

claude mcp add sap-broker --transport stdio \
  --env HANA_HOST=your-hana-host.example.com \
  --env HANA_PORT=30015 \
  --env HANA_USER=your_user \
  --env HANA_PASSWORD=your_password \
  --env HANA_SCHEMA=YOUR_SCHEMA \
  -- node /path/to/sap-hana-mcp/dist/index.js

BROKER_TRANSPORT=http \
BROKER_HOST=127.0.0.1 \
BROKER_PORT=3000 \
BROKER_TLS=true \
BROKER_TLS_KEY=/opt/sap-broker/tls/key.pem \
BROKER_TLS_CERT=/opt/sap-broker/tls/cert.pem \
HANA_HOST=your-hana-host.example.com \
HANA_USER=MCP_READER \
HANA_PASSWORD=your_password \
node dist/index.js

Agent Request
    |
[1] Bearer Token Auth ────── Validate token, resolve profile + scopes
    |
[2] Scope Filtering ─────── Only tools matching caller scopes are visible
    |
[3] Approval Gate ────────── Write tools may require human approval
    |
[4] SQL Keyword Validator ── Block INSERT, UPDATE, DELETE, DROP, etc.
    |
[5] Query Parser ─────────── Single statement only (no injection)
    |
[6] Prefix Validation ────── Must start with SELECT, WITH, or EXPLAIN
    |
[7] Rate Limiter ─────────── Sliding window (30 req / 60s)
    |
[8] DB User Privileges ───── SELECT-only grants (recommended)
    |
[9] Result Limits ─────────── Row count and query timeout enforcement

INSERT, UPDATE, DELETE, MERGE, UPSERT, REPLACE
CREATE, ALTER, DROP, TRUNCATE, RENAME
GRANT, REVOKE, CALL, EXEC, EXECUTE
BEGIN, COMMIT, ROLLBACK, SAVEPOINT, SET
IMPORT, EXPORT, LOAD, UNLOAD

CREATE USER MCP_READER PASSWORD "YourSecurePassword";
GRANT SELECT ON SCHEMA YOUR_SCHEMA TO MCP_READER;
ALTER USER MCP_READER DISABLE PASSWORD LIFETIME;

pnpm dev      # stdio mode with hot reload
pnpm build    # compile TypeScript
pnpm start    # run production build

sap-hana-mcp/
├── src/
│   ├── index.ts              # Entry point, transport selection
│   ├── config.ts             # Environment configuration
│   ├── hana/
│   │   └── client.ts         # HANA connection & query execution
│   ├── sap/
│   │   ├── client.ts         # SAP Service Layer HTTP client
│   │   └── tools.ts          # Write tool implementations
│   ├── security/
│   │   ├── query-validator.ts # SQL injection prevention
│   │   ├── rate-limiter.ts   # Sliding window rate limiter
│   │   └── audit.ts          # Query audit logging
│   ├── auth/
│   │   ├── config.ts         # Broker config YAML loader
│   │   ├── tokens.ts         # Bearer token validation
│   │   └── scopes.ts         # Scope resolution
│   ├── server/
│   │   ├── context.ts        # Caller context model
│   │   ├── registry.ts       # Scope-aware tool registration
│   │   ├── stdio.ts          # Dev transport
│   │   └── http.ts           # Production HTTP transport
│   ├── tools/
│   │   ├── index.ts          # Read tool definitions & handlers
│   │   ├── format.ts         # Result formatting (table, CSV)
│   │   └── output.ts         # File output management
│   └── approval/
│       ├── service.ts        # Approval gate wrapper
│       ├── store.ts          # In-memory approval store
│       └── routes.ts         # Approval REST API
├── broker.config.yaml        # Scopes, profiles, tokens, approval rules
├── .env.example              # Environment variable template
├── package.json
└── tsconfig.json