# abap-adt-mcp ABAP development from Claude and other MCP hosts: read and write source, transports, unit tests, ATC, dumps, debugger. Multi-system, with server-side guard rails. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 1.0.1 - **Author:** Willian Saez - **License:** MIT - **npm:** abap-adt-mcp - **Source:** https://github.com/williansaez/abap-adt-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-07T22:48:18.350Z - **Version scanned:** 1.0.1 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `atcCustomizing` — Retrieves ATC customizing information. - `atcQuickfixProposals` — List the quickfix proposals available at an ATC finding location. Pass the source URL and position from an atcWorklists finding. Apply a proposal with atcApplyQ - `atcApplyQuickfix` — Apply a deterministic quickfix at an ATC finding location: recomputes the proposals (see atcQuickfixProposals), applies the chosen one to the source and writes - `atcCheckVariant` — Retrieves information about an ATC check variant. - `atcSummary` — Aggregated view of an ATC result: totals by priority, by check and by object, top findings with location and quickfix availability. Pass runResultId from create - `createAtcRun` — Creates an ATC run. Flow: atcCustomizing (system check variant name) -> atcCheckVariant (returns a worklistId) -> createAtcRun -> atcWorklists (findings). Passi - `atcWorklists` — Retrieves ATC worklists. For runs covering many objects, use startIndex/maxItems to page through the findings-per-object list instead of retrieving it all at on - `atcUsers` — Retrieves a list of ATC users. - `atcExemptProposal` — Retrieves an ATC exemption proposal. - `atcRequestExemption` — Requests an ATC exemption. - `isProposalMessage` — Checks if a given object is a proposal message. - `atcContactUri` — Retrieves the contact URI for an ATC finding. - `atcChangeContact` — Changes the contact for an ATC finding. - `atcDocumentation` — Read the documentation of an ATC check/finding (what the check tests, why it matters, how to fix). Pass the documentation URI found in an ATC finding (atcWorkli - `login` — Authenticate with ABAP system - `logout` — Terminate ABAP session - `dropSession` — Clear local session cache - `classIncludes` — URLs of the includes of a class (main, definitions, implementations, testclasses, macros) to use with getObjectSource/editObjectSource as they are (no /source/m - `classComponents` — List class components (methods, attributes, types). For large classes, use startIndex/maxComponents to page through the top-level component list instead of retr - `apiReleaseState` — Release state of SAP objects for ABAP Cloud / Clean Core, from SAP's official cloudification repository (released, deprecated with successors, classicAPI, noAPI - `syntaxCheckCode` — ABAP syntax check of a source against the context of an existing object: url is the source URL of that object (…/source/main), required because the check resolv - `syntaxCheckCdsUrl` — Perform ABAP syntax check with CDS URL - `codeCompletion` — Get code completion suggestions - `findDefinition` — Find symbol definition - `usageReferences` — Find symbol references (system-wide "where used"). For widely-used symbols this can return hundreds/thousands of hits; use startIndex/maxItems to page through t - `syntaxCheckTypes` — Retrieves syntax check types. - `codeCompletionFull` — Performs full code completion. - `runClass` — Runs a class. - `codeCompletionElement` — Retrieves code completion element information. - `usageReferenceSnippets` — Retrieves usage reference snippets (source excerpts) for a list of usage references, e.g. from usageReferences. For large input lists the returned snippets can - `fixProposals` — Retrieves fix proposals. - `fixEdits` — Applies fix edits. - `fragmentMappings` — Retrieves fragment mappings. - `abapDocumentation` — ABAP keyword documentation (the F1 help) as plain text. Two ways to ask: (a) keyword: a statement or addition such as "SELECT SINGLE", "WITH PRIVILEGED ACCESS", - `annotationDefinitions` — Retrieves the CDS annotation catalog for the system. This can be large; use startIndex/maxItems to page through it instead of retrieving it all at once. - `ddicElement` — Retrieves information about a DDIC element. For complex objects the child element list (fields/associations/secondary objects) can be large; use startIndex/maxI - `ddicRepositoryAccess` — Accesses the DDIC repository. This can return a large list of object references; use startIndex/maxItems to page through it instead of retrieving it all at once - `packageSearchHelp` — Performs a package search help. - `getDomainProperties` — Read a DDIC domain: data type, length, decimals, output settings and fixed values / value table. Pass the domain URL (/sap/bc/adt/ddic/domains/zdom) and optiona - `setDomainProperties` — Write a DDIC domain (type, length, fixed values, value table…). Read it first with getDomainProperties, modify the returned properties/metaData objects and pass ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"abap-adt\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"abap-adt-mcp\"\n ],\n \"env\": {\n \"SAP_SYSTEMS\": \"\",\n \"MCP_HTTP_TOKEN\": \"\",\n \"SAP_PASSWORD\": \"\",\n \"SAP_OAUTH_CLIENT_SECRET\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `SAP_SYSTEMS` — Sap Systems (optional) - `MCP_HTTP_TOKEN` — Mcp Http Token (optional) - `SAP_PASSWORD` — Sap Password (optional) - `SAP_OAUTH_CLIENT_SECRET` — Sap OAuth Client Secret (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 4 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Moderate blast radius — holds an oauth grant; runs on your machine. - Floor 31, ceiling 31 (tier: moderate) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/abap-adt-mcp - Install plan: https://forgeregistry.com/api/v1/packages/abap-adt-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/abap-adt-mcp - HTML page: https://forgeregistry.com/registry/abap-adt-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.