# Sc4sap:mcp Setup

> Guide to install and configure the abap-mcp-adt-powerup MCP server for SAP ADT connectivity

- **Type:** Skill
- **Install:** `agentstack add skill-babamba2-superclaude-for-sap-mcp-setup`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [babamba2](https://agentstack.voostack.com/s/babamba2)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [babamba2](https://github.com/babamba2)
- **Source:** https://github.com/babamba2/superclaude-for-sap/tree/main/skills/mcp-setup

## Install

```sh
agentstack add skill-babamba2-superclaude-for-sap-mcp-setup
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SC4SAP MCP Setup

Guides you through installing and configuring the `abap-mcp-adt-powerup` MCP server, which provides Claude Code with direct connectivity to your SAP system via ABAP Development Tools (ADT) REST APIs. The server exposes 150+ tools covering CRUD for ABAP objects (class, program, CDS, FM, table, etc.) plus runtime, transport, and data-preview operations.

`abap-mcp-adt-powerup` is the bridge between Claude Code and your SAP system. Without it, no SC4SAP skills can read or write ABAP objects. This skill walks you through cloning, configuring, and registering the server so all MCP tools become available.

Every response triggered by this skill MUST begin with `[Model:  · Dispatched: ]` per [`../../common/model-routing-rule.md`](../../common/model-routing-rule.md) § Response Prefix Convention.

MCP server repository: https://github.com/babamba2/abap-mcp-adt-powerup.git
Installed at: `${CLAUDE_PLUGIN_ROOT}/vendor/abap-mcp-adt/` (internal directory name kept short for path-length safety on Windows).

- Node.js 18+ installed
- Access to a SAP system with ADT service enabled (transaction SICF, service `/sap/bc/adt` active)
- SAP user with developer authorizations (S_DEVELOP, S_TRANSPRT)
- Claude Code with MCP support

1. **Automatic installation (recommended)**
   The MCP server is automatically installed into the plugin's `vendor/abap-mcp-adt/` directory during setup:
   ```bash
   /sc4sap:setup          # full setup wizard (includes MCP install)
   /sc4sap:setup mcp      # MCP install only
   ```
   Or via npm:
   ```bash
   npm run build          # runs tsc + installs abap-mcp-adt into vendor/
   ```
   This clones the repo, runs `npm install`, and builds it. The plugin's `.mcp.json` is pre-configured to launch `bridge/mcp-server.cjs`, which delegates to the vendor-installed server.

2. **Configure SAP connection**
   Create `.sc4sap/sap.env` in the plugin directory with your SAP credentials:
   ```env
   SAP_URL=https://your-sap-host:44300
   SAP_CLIENT=100
   SAP_AUTH_TYPE=basic
   SAP_USERNAME=your-user
   SAP_PASSWORD=your-password
   SAP_LANGUAGE=EN
   SAP_SYSTEM_TYPE=onprem
   TLS_REJECT_UNAUTHORIZED=0

   # --- Blocklist policy (optional) ---
   # Controls the row-extraction guard in mcp-abap-adt. Defaults to `standard`.
   #   minimal  — block only PII/credentials/banking
   #   standard — minimal + Protected Business Data (ACDOCA, BKPF, VBAK, EKKO, ...)  [default]
   #   strict   — standard + Audit/Security + Communication/Workflow
   #   off      — disable the guard entirely (NOT recommended)
   # MCP_BLOCKLIST_PROFILE=standard
   # MCP_BLOCKLIST_EXTEND=ZHR_SALARY,ZCUSTOMER_PII
   # MCP_ALLOW_TABLE=ACDOCA
   ```
   - `SAP_URL`: SAP system URL with HTTPS and ICM port (typically 44300 for HTTPS)
   - `SAP_CLIENT`: SAP client number (3 digits, e.g., "100")
   - `SAP_AUTH_TYPE`: `basic` for username/password, `xsuaa` for JWT (OAuth2)
   - `SAP_USERNAME` / `SAP_PASSWORD`: SAP credentials with developer access
   - `SAP_LANGUAGE`: Logon language (EN, DE, etc.)
   - `SAP_SYSTEM_TYPE`: `onprem` for on-premise S/4HANA, `cloud` for BTP
   - `TLS_REJECT_UNAUTHORIZED`: Set to `0` for self-signed certificates (dev only)
   - `MCP_BLOCKLIST_PROFILE` *(optional)*: `minimal` | `standard` | `strict` | `off` — risk tier for row-extraction guard. Leave unset for the safe default (`standard`).
   - `MCP_BLOCKLIST_EXTEND` *(optional)*: comma-separated extra names/patterns (always denied). Use for site-specific Z-tables containing sensitive data.
   - `MCP_ALLOW_TABLE` *(optional)*: comma-separated whitelist for an audited one-off bypass. Logged to stderr. Remove when not actively needed.

   The bridge reads this file automatically on startup. Environment variables take precedence over file values.

3. **Verify the connection**
   After restarting Claude Code (or reconnecting MCP via `/mcp`), run:
   ```
   /sc4sap:sap-doctor
   ```
   Or manually test by calling `GetSession` — it should return your SAP system ID, client, and username.

4. **Update the MCP server**
   To update to the latest version:
   ```bash
   node scripts/build-mcp-server.mjs --update
   ```

- **401 Unauthorized**: Check `SAP_USERNAME` / `SAP_PASSWORD` in `.sc4sap/sap.env`; confirm the user is not locked (SU01).
- **Connection refused**: Verify `SAP_URL` host and ICM HTTPS port; check VPN if required.
- **ADT service not found**: Activate `/sap/bc/adt` in transaction SICF and ensure ICF is running.
- **SSL certificate errors**: Add the SAP system certificate to Node.js trust store (recommended), or temporarily set `TLS_REJECT_UNAUTHORIZED=0` in `sap.env` (dev only — never in prod).
- **No tools visible in Claude Code**: Reconnect the MCP server via `/mcp` after editing `sap.env`. `sap.env` changes are NOT hot-reloaded. Check MCP server stderr logs under `%LOCALAPPDATA%\claude-cli-nodejs\Cache\\mcp-logs-plugin-sc4sap-sap\`.
- **Blocklist refusal on a legitimate table**: Run `/sc4sap:sap-option` to adjust `MCP_BLOCKLIST_PROFILE` or add the table to `MCP_ALLOW_TABLE` (audited bypass).
- **`vendor/abap-mcp-adt` not built**: Re-run `node scripts/build-mcp-server.mjs` (or `--update` to refresh).

- Never commit `.sc4sap/sap.env` (the dotenv file with SAP credentials) to version control. It is git-ignored by default.
- Use process-level environment variables to override `sap.env` values in CI/CD, so secrets never touch disk.
- Prefer a read-only SAP user for analysis-only workflows.
- `TLS_REJECT_UNAUTHORIZED=0` is **dev-only** — never set in production. Install the SAP system certificate into Node.js trust store instead.
- The MCP server communicates only with the SAP host in `SAP_URL`. No outbound calls to third parties.
- Row-extraction on sensitive tables is gated by the blocklist policy above (`MCP_BLOCKLIST_PROFILE`, `MCP_BLOCKLIST_EXTEND`, `MCP_ALLOW_TABLE`). See `common/data-extraction-policy.md`.

When `ARGUMENTS` is `check` / `verify` / `status` (case-insensitive), run the vendor pin health check inline and report — do not print the full installation guide.

**Execution**:
1. Resolve plugin root (from `CLAUDE_PLUGIN_ROOT` env; fallback to cache path `~/.claude/plugins/cache/sc4sap/sc4sap//`).
2. Run: `node "/scripts/build-mcp-server.mjs" --check`
3. Read the script's exit code and stdout/stderr.
4. Format the result for the user:

| Exit | Meaning | User message (follow conversation language) |
|---|---|---|
| **0** + `pinned to  ✓` on stdout | OK — vendor matches expected pin | ✅ abap-mcp-adt vendor verified · pinned to `` (truncate to first 12 chars) |
| **0** + `pin cannot be verified` on stderr | WARN — launcher OK, `.git` stripped (packaged cache install) | ⚠️ Vendor launcher present, but pin cannot be verified (packaged cache lacks `.git`). Expected pin: ``. To force a verifiable reinstall: `node scripts/build-mcp-server.mjs --update`. |
| **1** | FAIL — vendor missing | ❌ abap-mcp-adt not installed. Run: `node scripts/build-mcp-server.mjs` (or `/sc4sap:setup mcp`). |
| **2** | FAIL — pin drift | ❌ abap-mcp-adt vendor drift detected (current HEAD ≠ pinned SHA). Run: `node scripts/build-mcp-server.mjs --update`. |

**Output format** (single block):
```
MCP Vendor Health Check
=======================
Status:  
Pin:     
Current: 
Action:  
```

STOP after printing — do not fall through to the full installation guide.

Task: {{ARGUMENTS}}

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [babamba2](https://github.com/babamba2)
- **Source:** [babamba2/superclaude-for-sap](https://github.com/babamba2/superclaude-for-sap)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-babamba2-superclaude-for-sap-mcp-setup
- Seller: https://agentstack.voostack.com/s/babamba2
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.