# Guidance For Deploying Sap Abap Accelerator For Amazon Q Developer

> ABAP Accelerator is an MCP server that helps organizations create, test, document, and transform SAP ABAP code faster and with higher code accuracy.

- **Type:** MCP server
- **Install:** `agentstack add mcp-aws-solutions-library-samples-guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer`
- **Verified:** Pending review
- **Seller:** [aws-solutions-library-samples](https://agentstack.voostack.com/s/aws-solutions-library-samples)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT-0
- **Upstream author:** [aws-solutions-library-samples](https://github.com/aws-solutions-library-samples)
- **Source:** https://github.com/aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer
- **Website:** https://aws.amazon.com/blogs/awsforsap/introducing-abap-accelerator-for-ai-assisted-development

## Install

```sh
agentstack add mcp-aws-solutions-library-samples-guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# ABAP Accelerator MCP Server

Enterprise-grade Model Context Protocol (MCP) server for SAP ABAP development, enabling AI-powered coding assistance through Amazon Q Developer and Kiro.

## Table of Contents

- [Overview](#overview)
- [Deployment Options](#deployment-options)
- [Environment Guidance](#environment-guidance)
- [Option 1: Local Deployment (Without Docker)](#option-1-local-deployment-without-docker)
- [Option 2: Local Deployment (With Docker)](#option-2-local-deployment-with-docker)
- [Option 3: Central Deployment (ECS Fargate)](#option-3-central-deployment-ecs-fargate)
- [Environment Variables Reference](#environment-variables-reference)
- [Q Developer Configuration](#q-developer-configuration)
- [Kiro Configuration](#kiro-configuration)
- [ECS Fargate Deployment](#ecs-fargate-deployment)
- [OAuth Authentication Setup](#oauth-authentication-setup-for-principal-propagation)
- [SAP System Selection](#sap-system-selection)
- [SAP Port Configuration](#sap-port-configuration)
- [Available Tools](#available-tools)
- [Troubleshooting](#troubleshooting)
- [Security Recommendations](#security-recommendations)
  - [Authentication & Authorization](#authentication--authorization)
  - [Secrets Management](#secrets-management)
  - [Network Security](#network-security)
  - [Input Validation](#input-validation)
  - [Audit Logging](#audit-logging)
  - [Container Security](#container-security)
  - [Denial of Service Protection](#denial-of-service-protection)
  - [SAP System Security](#sap-system-security)
  - [Monitoring & Incident Response](#monitoring--incident-response)
  - [Compliance Considerations](#compliance-considerations)
  - [CA Private Key Protection](#ca-private-key-protection)
  - [SAP Trust Store & Certificate Rule Governance](#sap-trust-store--certificate-rule-governance)
  - [Code Change Control](#code-change-control)
  - [Identity Provider Hardening](#identity-provider-hardening)
  - [Intellectual Property & Data Loss Prevention](#intellectual-property--data-loss-prevention)
  - [Supply Chain Integrity](#supply-chain-integrity)
  - [DNS Rebinding Prevention](#dns-rebinding-prevention)
  - [Denial of Service Resilience](#denial-of-service-resilience)
  - [LLM Tool Safety & Human Oversight](#llm-tool-safety--human-oversight)
  - [Assumptions](#assumptions)
  - [Security Checklist for ECS Based Deployment](#security-checklist-for-ecs-based-deployment)
- [Configuration Comparison: Local vs ECS](#configuration-comparison-local-vs-ecs)
- [Code of Conduct](#code-of-conduct)
- [Support](#support)
- [Terms of Use](#terms-of-use)
- [Notices](#notices)
- [License](#license)

## Overview

The ABAP Accelerator provides 15 SAP development tools accessible via MCP protocol:
- Connection management and status checking
- ABAP object creation, retrieval, and modification
- Syntax checking and code activation
- ATC quality checks and unit testing
- Transport request management
- Migration analysis

## Deployment Options

| Option | Use Case | Authentication | Best For |
|--------|----------|----------------|----------|
| [1. Local (Without Docker)](#option-1-local-deployment-without-docker) | Development/testing | Interactive credentials | Quick testing, development |
| [2. Local (With Docker)](#option-2-local-deployment-with-docker) | Development/testing | Interactive credentials | Isolated environment, multi-system |
| [3. ECS Fargate](#option-3-ecs-fargate-deployment-with-principal-propagation) | Production/multi-user | Principal Propagation + OAuth | Enterprise, multi-user |

---

## Environment Guidance

The ABAP Accelerator is designed for specific SAP system types. Please follow this guidance when deploying:

| ✅ Intended | ❌ Not Recommended |
|-------------|-------------------|
| Development (DEV) | Production (PRD) |
| Sandbox (SBX) | Pre-production |
| Quality Assurance (QAS) | |
| Test (TST) | |
| Training | |
| Demo | |

**Important:** This tool provides direct access to ABAP development objects and should only be used in non-production environments. Production systems should follow established change management and transport processes.

---

# Option 1: Local Deployment (Without Docker)

Run the MCP server directly with Python on your local machine.

## Prerequisites

- Python 3.10+
- Network access to SAP system

## Setup

```bash
# Clone repository
git clone https://github.com/aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer.git
cd guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer

# Install dependencies
pip install -r requirements.txt

# Run the server
python src/aws_abap_accelerator/main.py
```

## Environment Variables

Create a `.env` file or set environment variables:

```bash
# SAP Connection
SAP_HOST=your-sap-host.example.com
SAP_INSTANCE_NUMBER=00
SAP_CLIENT=100
SAP_USERNAME=your_username
SAP_PASSWORD=your_password
SAP_LANGUAGE=EN
SAP_SECURE=true
# Server
SERVER_HOST=localhost
SERVER_PORT=8000
# SSL (optional)
SSL_VERIFY=true
# CUSTOM_CA_CERT_PATH=/path/to/ca-cert.pem
# Logging
LOG_LEVEL=INFO
```

## Q Developer / Kiro Configuration

```json
{
  "mcpServers": {
    "abap-accelerator": {
      "url": "http://localhost:8000/mcp"
    }
  }
}
```

---

# Option 2: Local Deployment (With Docker)

Run the MCP server in a Docker container for isolated, reproducible deployments.

## Prerequisites

- Docker installed
- Network access to SAP system

## Building the Docker Image

```bash
# Build for AMD64 (Windows/Linux x86)
docker build -f Dockerfile.simple -t abap-accelerator-enterprise:latest .

# Build for ARM64 (Mac M1/M2/M3)
docker buildx build --platform linux/arm64 -f Dockerfile.simple -t abap-accelerator-enterprise:latest .
```

## Deployment Scenarios

### Scenario A: Single SAP System

For connecting to a single SAP system with interactive credential input.

**Windows:**
```cmd
docker run -it -p 8000:8000 ^
  -e CREDENTIAL_PROVIDER=interactive ^
  -e ENABLE_PRINCIPAL_PR
For local multi-system deployments, you define SAP systems in a `sap-systems.yaml` file. This file contains only non-sensitive connection information - credentials are prompted interactively at container startup.

##### Step 1: Create sap-systems.yaml

Create the file anywhere on your local machine (e.g., `C:\projects\sap-config\sap-systems.yaml` on Windows or `~/sap-config/sap-systems.yaml` on Mac/Linux):

```yaml
# sap-systems.yaml - SAP System Configuration
# Only non-sensitive information stored here
# Credentials are prompted at container startup

systems:
  # Development System
  S4H-DEV:
    host: s4h-dev.company.com:44300    # Include port in host
    client: "100"                       # SAP client number (string)
    description: "S/4HANA Development"  # Optional description
  
  # QA System
  S4H-QAS:
    host: s4h-qas.company.com:44301
    client: "200"
    description: "S/4HANA QA System"
  
  # Production System (read-only recommended)
  S4H-PROD:
    host: s4h-prod.company.com:44302
    client: "300"
    description: "S/4HANA Production"
```

##### Step 2: Run Container with Config Mounted

Mount the config file to `/app/config/sap-systems.yaml` inside the container:

**Windows (Command Prompt):**
```cmd
docker run -it -p 8000:8000 ^
  -v C:\projects\sap-config\sap-systems.yaml:/app/config/sap-systems.yaml:ro ^
  -e CREDENTIAL_PROVIDER=interactive-multi ^
  -e ENABLE_PRINCIPAL_PROPAGATION=false ^
  abap-accelerator-enterprise:latest
```

**Windows (PowerShell):**
```powershell
docker run -it -p 8000:8000 `
  -v ${PWD}\sap-systems.yaml:/app/config/sap-systems.yaml:ro `
  -e CREDENTIAL_PROVIDER=interactive-multi `
  -e ENABLE_PRINCIPAL_PROPAGATION=false `
  abap-accelerator-enterprise:latest
```

**Mac/Linux:**
```bash
docker run -it -p 8000:8000 \
  -v $(pwd)/sap-systems.yaml:/app/config/sap-systems.yaml:ro \
  -e CREDENTIAL_PROVIDER=interactive-multi \
  -e ENABLE_PRINCIPAL_PROPAGATION=false \
  abap-accelerator-enterprise:latest
```

##### Step 3: Enter Credentials at Startup

The container will prompt for credentials for each system:
```
============================================================
  SAP CREDENTIALS INPUT (Stored in memory only)
============================================================

System: S4H-DEV (S/4HANA Development)
  Host: s4h-dev.company.com:44300
  Client: 100
  Username: DEVELOPER01
  Password: ********
  ✓ Credentials stored for S4H-DEV

System: S4H-QAS (S/4HANA QA System)
  Host: s4h-qas.company.com:44301
  Client: 200
  Username: DEVELOPER01
  Password: ********
  ✓ Credentials stored for S4H-QAS

============================================================
  All credentials stored. Starting MCP server...
============================================================
```

##### sap-systems.yaml Location Summary

| Location | Mount Path | Example |
|----------|------------|---------|
| Current directory | `-v $(pwd)/sap-systems.yaml:/app/config/sap-systems.yaml:ro` | `./sap-systems.yaml` |
| Specific path | `-v /path/to/sap-systems.yaml:/app/config/sap-systems.yaml:ro` | `/home/user/config/sap-systems.yaml` |
| Windows path | `-v C:\path\to\sap-systems.yaml:/app/config/sap-systems.yaml:ro` | `C:\Users\dev\sap-systems.yaml` |

**Important:** Always mount as read-only (`:ro`) for security.

### Option 3: Central Deployment (ECS Fargate)

For production multi-user deployments with Principal Propagation:

```bash
# ECS Task Definition environment variables
ENABLE_ENTERPRISE_MODE=true
ENABLE_PRINCIPAL_PROPAGATION=true
SERVER_HOST=0.0.0.0
SERVER_PORT=8000
AWS_REGION=us-east-1
DEFAULT_SAP_SYSTEM_ID=S4H-100
```

See [ECS Deployment Guide](#ecs-fargate-deployment) for complete setup.

---

## Environment Variables Reference

### Core Server Configuration

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `SERVER_HOST` | Yes | `0.0.0.0` | Server bind address |
| `SERVER_PORT` | Yes | `8000` | Server port |
| `LOG_LEVEL` | No | `INFO` | Logging level (DEBUG, INFO, WARNING, ERROR) |
| `CORS_ENABLED` | No | `false` | Enable CORS |
| `CORS_ALLOWED_ORIGINS` | No | `*` | CORS allowed origins |

### Credential Provider Options

| Variable | Value | Description |
|----------|-------|-------------|
| `CREDENTIAL_PROVIDER` | `interactive` | Prompt for single SAP system at startup |
| `CREDENTIAL_PROVIDER` | `interactive-multi` | Prompt for multiple systems from config file |
| `CREDENTIAL_PROVIDER` | `env` | Use SAP_* environment variables |
| `CREDENTIAL_PROVIDER` | `aws_secrets` | Use AWS Secrets Manager (production) |

### SAP Connection (for `env` credential provider)

| Variable | Required | Description |
|----------|----------|-------------|
| `SAP_HOST` | Yes | SAP system hostname |
| `SAP_INSTANCE_NUMBER` | Yes | SAP instance number (e.g., 00) |
| `SAP_CLIENT` | Yes | SAP client number (e.g., 100) |
| `SAP_USERNAME` | Yes | SAP username |
| `SAP_PASSWORD` | Yes | SAP password |
| `SAP_LANGUAGE` | No | SAP language (default: EN) |
| `SAP_SECURE` | No | Use HTTPS (default: true) |

### Enterprise Mode (ECS/Production)

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `ENABLE_ENTERPRISE_MODE` | Yes | `false` | Enable multi-tenancy and usage tracking |
| `ENABLE_PRINCIPAL_PROPAGATION` | Yes | `false` | Enable X.509 certificate authentication |
| `DEFAULT_SAP_SYSTEM_ID` | Recommended | - | Default SAP system when not specified |
| `DEFAULT_USER_ID` | Recommended | - | Default user identity |

### SSL/TLS Configuration

| Variable | Default | Description |
|----------|---------|-------------|
| `SSL_VERIFY` | `true` | Set to `false` to disable SSL verification (testing only) |
| `CUSTOM_CA_CERT_PATH` | - | Path to custom CA certificate for corporate CAs |

### OAuth Configuration (Optional)

| Variable | Required | Description |
|----------|----------|-------------|
| `ENABLE_OAUTH_FLOW` | No | Enable OAuth authentication flow |
| `OAUTH_ISSUER` | If OAuth | OIDC issuer URL |
| `OAUTH_AUTH_ENDPOINT` | If OAuth | Authorization endpoint |
| `OAUTH_TOKEN_ENDPOINT` | If OAuth | Token endpoint |
| `OAUTH_CLIENT_ID` | If OAuth | OAuth client ID |
| `OAUTH_CLIENT_SECRET` | No | OAuth client secret (for confidential clients) |
| `OAUTH_REDIRECT_URI` | No | OAuth callback URL |
| `SERVER_BASE_URL` | If OAuth | MCP server public URL |

---

## Q Developer Configuration

### Local Docker Deployment

Add to your Q Developer MCP configuration (`~/.aws/amazonq/mcp.json` or workspace `.amazonq/mcp.json`):

#### Single System
```json
{
  "mcpServers": {
    "abap-accelerator": {
      "url": "http://localhost:8000/mcp"
    }
  }
}
```

#### Multiple Systems
```json
{
  "mcpServers": {
    "abap-dev": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-DEV"
      }
    },
    "abap-qas": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-QAS"
      }
    }
  }
}
```

### ECS Fargate Deployment

```json
{
  "mcpServers": {
    "abap-accelerator": {
      "url": "https://your-alb-endpoint.com/mcp",
      "headers": {
        "x-sap-system-id": "S4H-100"
      }
    }
  }
}
```

### With OAuth Authentication

```json
{
  "mcpServers": {
    "abap-accelerator": {
      "url": "https://your-mcp-server.com/mcp",
      "headers": {
        "x-sap-system-id": "S4H-100"
      }
    }
  }
}
```
No authentication headers needed - OAuth flow opens browser automatically.

---

## Kiro Configuration

Add to your Kiro MCP configuration (`.kiro/settings/mcp.json`):

### Local Deployment
```json
{
  "mcpServers": {
    "abap-accelerator": {
      "url": "http://localhost:8000/mcp"
    }
  }
}
```

### Multiple Systems
```json
{
  "mcpServers": {
    "abap-dev": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-DEV"
      }
    },
    "abap-qas": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-QAS"
      }
    }
  }
}
```

### ECS/Remote Deployment
```json
{
  "mcpServers": {
    "abap-accelerator": {
      "url": "https://your-alb-endpoint.com/mcp",
      "headers": {
        "x-sap-system-id": "S4H-100"
      }
    }
  }
}
```

---

## ECS Fargate Deployment

### Credential Storage: Secrets Manager vs Parameter Store

When deploying on ECS Fargate, sensitive and non-sensitive configuration data are stored separately:

| Storage | What to Store | Why |
|---------|---------------|-----|
| **AWS Secrets Manager** | CA certificates, private keys, OAuth client secrets | Encrypted, access-controlled, audit logged |
| **AWS Parameter Store** | SAP endpoints, user mappings, non-sensitive config | Cost-effective, easy to update, version controlled |

#### AWS Secrets Manager (Sensitive Data)

Store these secrets in AWS Secrets Manager:

##### 1. CA Certificate (for Principal Propagation)

**Secret Name:** `abap-accelerator/ca-certificate`

```bash
# Create the secret
aws secretsmanager create-secret \
  --name abap-accelerator/ca-certificate \
  --description "CA certificate for ABAP Accelerator principal propagation" \
  --secret-string '{
    "ca_certificate": "",
    "ca_private_key": ""
  }' \
  --region us-east-1
```

**JSON Structure:**
```json
{
  "ca_certificate": "",
  "ca_private_key": ""
}
```

##### 2. OAuth Client Secret (for Principal Propagation with OAuth)

**Secret Name:** `abap-accelerator/oauth-client-secret`

```bash
aws secretsmanager create-secret \
  --name abap-accelerator/oauth-client-secret \
  --description "OAuth client secret for ABAP Accelerator principal propagation" \
  --secret-string '{"client_secret": "your-oauth-client-secret"}' \
  --region us-east-1
```

#### AWS Parameter Store (Non-Sensitive Configuration)

Store these configurations in AWS Systems Manager Parameter Store:

##### 1. SAP Endpoints Configuration

**Parameter Name:** `/abap-accelerator/sap-endpoints`

```bash
aws ssm put-parameter \
  --name /abap-accelerator/sap-endpoints \
  --desc

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aws-solutions-library-samples](https://github.com/aws-solutions-library-samples)
- **Source:** [aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer](https://github.com/aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer)
- **License:** MIT-0
- **Homepage:** https://aws.amazon.com/blogs/awsforsap/introducing-abap-accelerator-for-ai-assisted-development

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-aws-solutions-library-samples-guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer
- Seller: https://agentstack.voostack.com/s/aws-solutions-library-samples
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.