AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
MCP verified MIT Self-run

Sap Api Policy Skill

mcp-marianfoo-sap-api-policy-skill · by marianfoo

Agent skill (npx skills) for evidence-based SAP API Policy alignment assessments — sourced, confidence-rated, never legal advice.

↗ Repository
— No reviews yet
0 installs
15 views
0.0% view→install

Install

$ agentstack add mcp-marianfoo-sap-api-policy-skill

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Sap Api Policy Skill? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

SAP API Policy Evidence Skill

An agent skill that assesses whether a given SAP API usage scenario aligns with the SAP API Policy (v.4.2026a + FAQ) and returns an evidence-based, sourced technical assessment with a confidence level — by gathering live evidence from official SAP sources (SAP Help, Business Accelerator Hub, SAP Notes, Architecture Center, released-object data) via MCP servers.

> Not legal advice, not a final SAP compliance decision. Only SAP, your contract, or SAP > support/account/legal can give a binding answer. This skill gets as close as the evidence allows, > labels its confidence, and routes legal/commercial/roadmap questions to SAP rather than answering > them.

Install

Cross-agent via the skills CLI (works with Claude Code, Cursor, Codex, and others):

# install just this skill (use your own owner/repo if you fork it)
npx skills add marianfoo/sap-api-policy-skill --skill sap-api-policy-evidence

# or install everything in the repo
npx skills add marianfoo/sap-api-policy-skill

# globally, across all projects
npx skills add -g marianfoo/sap-api-policy-skill --skill sap-api-policy-evidence

Manual install (no CLI): copy skills/sap-api-policy-evidence/ into your agent's skills directory (e.g. ~/.claude/skills/ for Claude Code) — see [MCPSETUP.md](MCPSETUP.md) → "Using the skill".

Prerequisite: the SAP MCP servers

The skill gathers evidence through SAP MCP servers — set them up once (most are npx-installable, SAP Docs has a hosted URL):

| Server | Install | Role | | --- | --- | --- | | SAP Docs | hosted URL or mcp-sap-docs | SAP Help, Architecture Center, released-object status | | SAP API Hub | npx -y sap-api-hub-mcp | prove Published-API status / version / specs | | SAP Notes | sap-note-search-mcp (node) | "not permitted" / deprecated / successor notes | | SAP Roadmap | npx -y sap-roadmap-mcp | future replacement APIs (planning only) | | ARC-1 | npx -y arc-1@latest | live-system release state / custom-API checks |

The three authenticated servers (API Hub, Roadmap, Notes) and their shared SAP login module live in one repo — sap-mcp-servers (npm workspaces) — but each is still published to npm individually, so the npx -y forms above work as-is.

Full setup (auth, MFA, portable config, per-client usage): [MCPSETUP.md](MCPSETUP.md). The skill degrades gracefully if some are missing and says which were unavailable; SAP API Hub + an authenticated SAP Notes session are what let assessments reach high confidence.

What it covers

Published-API vs internal/private status · "Documented Use" · third-party tools / iPaaS / RPA · agentic & generative-AI / MCP access · bulk extraction & replication · custom Z/Y OData & RFC/BAPI wrappers & Clean Core · ADT developer-tooling boundaries (FAQ Q33) · ODP-RFC and other "not permitted" interfaces · partner Integration Certification · RISE remediation · an inventory/scan mode ("which of these APIs are allowed?").

Example prompts

  • Decisive: "Is it allowed under SAP's API policy to extract data from our BW/4HANA into Snowflake

nightly via ODP-RFC through a third-party ETL tool?"

  • Should be aligned: "We sync ~500 Shopify orders/day into S/4HANA Cloud via the standard Sales

Order OData API using Boomi — OK under the 2026 API policy?"

  • Scan a list: "Which of these are OK to keep using: APISALESORDERSRV, RFCREAD_TABLE,

SDSALESDOCUMENTCREATE, ODP-RFC, I_SalesDocument?"

Repo layout

skills/sap-api-policy-evidence/   the skill — SKILL.md + references/ + agents/openai.yaml
evals/evals.json                  22 scenario evals (the test suite)
tests/skill_static_checks.py      contract checks (fixed labels, required refs, URLs)
MCP_SETUP.md                      MCP server setup + how to consume the skill
CLAUDE.md                         contributor/maintainer guide (how to edit + validate the skill)
.cursor/mcp.json.example          portable MCP client config — copy to .cursor/mcp.json and fill in

Validation

The skill was hardened over 6 eval iterations across 22 scenarios spanning every policy branch plus adversarial over/under-flag, legal-wall, and scan-mode probes. It returns a fixed verdict label (Likely aligned / Likely not aligned / Needs SAP confirmation / Not assessable from provided facts), a single confidence level, cited sources, and the non-legal disclaimer.

License

MIT — see [LICENSE](LICENSE).

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Integrations