Sc4sap:mcp Setup

SC4SAP MCP Setup

Guides you through installing and configuring the abap-mcp-adt-powerup MCP server, which provides Claude Code with direct connectivity to your SAP system via ABAP Development Tools (ADT) REST APIs. The server exposes 150+ tools covering CRUD for ABAP objects (class, program, CDS, FM, table, etc.) plus runtime, transport, and data-preview operations.

abap-mcp-adt-powerup is the bridge between Claude Code and your SAP system. Without it, no SC4SAP skills can read or write ABAP objects. This skill walks you through cloning, configuring, and registering the server so all MCP tools become available.

Every response triggered by this skill MUST begin with [Model: · Dispatched: ] per [../../common/model-routing-rule.md](../../common/model-routing-rule.md) § Response Prefix Convention.

MCP server repository: https://github.com/babamba2/abap-mcp-adt-powerup.git Installed at: ${CLAUDE_PLUGIN_ROOT}/vendor/abap-mcp-adt/ (internal directory name kept short for path-length safety on Windows).

• Node.js 18+ installed
• Access to a SAP system with ADT service enabled (transaction SICF, service /sap/bc/adt active)
• SAP user with developer authorizations (SDEVELOP, STRANSPRT)
• Claude Code with MCP support

1. Automatic installation (recommended)

The MCP server is automatically installed into the plugin's vendor/abap-mcp-adt/ directory during setup: ``bash /sc4sap:setup # full setup wizard (includes MCP install) /sc4sap:setup mcp # MCP install only ` Or via npm: `bash npm run build # runs tsc + installs abap-mcp-adt into vendor/ ` This clones the repo, runs npm install, and builds it. The plugin's .mcp.json is pre-configured to launch bridge/mcp-server.cjs`, which delegates to the vendor-installed server.

1. Configure SAP connection

Create .sc4sap/sap.env in the plugin directory with your SAP credentials: ```env SAPURL=https://your-sap-host:44300 SAPCLIENT=100 SAPAUTHTYPE=basic SAPUSERNAME=your-user SAPPASSWORD=your-password SAPLANGUAGE=EN SAPSYSTEMTYPE=onprem TLSREJECT_UNAUTHORIZED=0

# --- Blocklist policy (optional) --- # Controls the row-extraction guard in mcp-abap-adt. Defaults to standard. # minimal — block only PII/credentials/banking # standard — minimal + Protected Business Data (ACDOCA, BKPF, VBAK, EKKO, ...) [default] # strict — standard + Audit/Security + Communication/Workflow # off — disable the guard entirely (NOT recommended) # MCPBLOCKLISTPROFILE=standard # MCPBLOCKLISTEXTEND=ZHRSALARY,ZCUSTOMERPII # MCPALLOWTABLE=ACDOCA ```

• SAP_URL: SAP system URL with HTTPS and ICM port (typically 44300 for HTTPS)
• SAP_CLIENT: SAP client number (3 digits, e.g., "100")
• SAP_AUTH_TYPE: basic for username/password, xsuaa for JWT (OAuth2)
• SAP_USERNAME / SAP_PASSWORD: SAP credentials with developer access
• SAP_LANGUAGE: Logon language (EN, DE, etc.)
• SAP_SYSTEM_TYPE: onprem for on-premise S/4HANA, cloud for BTP
• TLS_REJECT_UNAUTHORIZED: Set to 0 for self-signed certificates (dev only)
• MCP_BLOCKLIST_PROFILE (optional): minimal | standard | strict | off — risk tier for row-extraction guard. Leave unset for the safe default (standard).
• MCP_BLOCKLIST_EXTEND (optional): comma-separated extra names/patterns (always denied). Use for site-specific Z-tables containing sensitive data.
• MCP_ALLOW_TABLE (optional): comma-separated whitelist for an audited one-off bypass. Logged to stderr. Remove when not actively needed.

The bridge reads this file automatically on startup. Environment variables take precedence over file values.

1. Verify the connection

After restarting Claude Code (or reconnecting MCP via /mcp), run: `` /sc4sap:sap-doctor ` Or manually test by calling GetSession` — it should return your SAP system ID, client, and username.

1. Update the MCP server

To update to the latest version: ``bash node scripts/build-mcp-server.mjs --update ``

• 401 Unauthorized: Check SAP_USERNAME / SAP_PASSWORD in .sc4sap/sap.env; confirm the user is not locked (SU01).
• Connection refused: Verify SAP_URL host and ICM HTTPS port; check VPN if required.
• ADT service not found: Activate /sap/bc/adt in transaction SICF and ensure ICF is running.
• SSL certificate errors: Add the SAP system certificate to Node.js trust store (recommended), or temporarily set TLS_REJECT_UNAUTHORIZED=0 in sap.env (dev only — never in prod).
• No tools visible in Claude Code: Reconnect the MCP server via /mcp after editing sap.env. sap.env changes are NOT hot-reloaded. Check MCP server stderr logs under %LOCALAPPDATA%\claude-cli-nodejs\Cache\\mcp-logs-plugin-sc4sap-sap\.
• Blocklist refusal on a legitimate table: Run /sc4sap:sap-option to adjust MCP_BLOCKLIST_PROFILE or add the table to MCP_ALLOW_TABLE (audited bypass).
• vendor/abap-mcp-adt not built: Re-run node scripts/build-mcp-server.mjs (or --update to refresh).

• Never commit .sc4sap/sap.env (the dotenv file with SAP credentials) to version control. It is git-ignored by default.
• Use process-level environment variables to override sap.env values in CI/CD, so secrets never touch disk.
• Prefer a read-only SAP user for analysis-only workflows.
• TLS_REJECT_UNAUTHORIZED=0 is dev-only — never set in production. Install the SAP system certificate into Node.js trust store instead.
• The MCP server communicates only with the SAP host in SAP_URL. No outbound calls to third parties.
• Row-extraction on sensitive tables is gated by the blocklist policy above (MCP_BLOCKLIST_PROFILE, MCP_BLOCKLIST_EXTEND, MCP_ALLOW_TABLE). See common/data-extraction-policy.md.

When ARGUMENTS is check / verify / status (case-insensitive), run the vendor pin health check inline and report — do not print the full installation guide.

Execution:

1. Resolve plugin root (from CLAUDE_PLUGIN_ROOT env; fallback to cache path ~/.claude/plugins/cache/sc4sap/sc4sap//).
2. Run: node "/scripts/build-mcp-server.mjs" --check
3. Read the script's exit code and stdout/stderr.
4. Format the result for the user:

| Exit | Meaning | User message (follow conversation language) | |---|---|---| | 0 + pinned to ✓ on stdout | OK — vendor matches expected pin | ✅ abap-mcp-adt vendor verified · pinned to ` (truncate to first 12 chars) | | **0** + pin cannot be verified on stderr | WARN — launcher OK, .git stripped (packaged cache install) | ⚠️ Vendor launcher present, but pin cannot be verified (packaged cache lacks .git). Expected pin: . To force a verifiable reinstall: node scripts/build-mcp-server.mjs --update. | | **1** | FAIL — vendor missing | ❌ abap-mcp-adt not installed. Run: node scripts/build-mcp-server.mjs (or /sc4sap:setup mcp). | | **2** | FAIL — pin drift | ❌ abap-mcp-adt vendor drift detected (current HEAD ≠ pinned SHA). Run: node scripts/build-mcp-server.mjs --update`. |

Output format (single block):

MCP Vendor Health Check
=======================
Status:  
Pin:     
Current: 
Action:  

STOP after printing — do not fall through to the full installation guide.

Task: {{ARGUMENTS}}

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: babamba2
• Source: babamba2/superclaude-for-sap
• License: MIT

Install and usage instructions live in the source repository linked above.