MCP.Market

GuniWeb SAP MCP server

by guniweb·io.github.guniweb/guniweb-sap-mcp·v0.10.0·3 stars
No reviews yet

SAP S/4HANA and ECC: OData V2/V4, IDoc and RFC/BAPI for n8n and other MCP clients

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
Growing

3 stars979 downloads/wk

Reviews

Write one

Nobody has reviewed GuniWeb SAP MCP yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

GuniWeb SAP MCP tools (24, 7 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • sap_bapi_call
  • sap_bapi_commit

    Call BAPI_TRANSACTION_COMMIT on the SAME stateful connection used by a prior sap_bapi_call. Releases the session afterwards. When to use: - After one or more sap_bapi_call invocations that returned hasErrors=false When NOT to use: - If the prior sap_bapi_call returned hasErrors=true (commit would persist a faulty state \u2014 implicit rollback by letting the session idle is safer) - For non-BAPI R

  • sap_batchwrite action

    Execute multiple OData operations in a single batch request. Supports V2 (multipart/mixed) and V4 (JSON) batch formats automatically. Write operations sharing a changesetId run as one transaction (all succeed or all fail); in V2 a write without changesetId gets a changeset of its own. Returns per-operation status in the order of the operations -- individual failures are always reported, never hidd

  • sap_createwrite action

    Create a new entity in SAP. Pass entity data as a JSON string in the data parameter. Use sap_get_metadata with entityType first to discover required fields.

  • sap_deletewrite action

    Delete an entity from SAP. Provide the entity key. ETag handling is automatic.

  • sap_discover_services

    Discover all available OData services on the connected SAP system. Returns categorized services with search, category filtering, and pagination. Use this as the first step to explore what APIs are available before using sap_list_services or sap_get_metadata. **When to use:** - You need to find which SAP services are available on this system - You want to search services by name, domain, or version

  • sap_enable_tools

    Activate additional tool tiers for this session. Currently active: …. …

  • sap_function
  • sap_get_metadata
  • sap_idoc_discover

    Discover available IDoc types and segment structures from SAP. Returns IDoc type definitions with segment hierarchy and field metadata.

  • sap_idoc_list_received

    List IDocs received via webhook. Returns recently received IDocs from the in-memory store.

  • sap_idoc_sendwrite action

    Send an IDoc to SAP via HTTP/XML. Auto-constructs EDI_DC40 control record. Validates against segment metadata before sending -- blocks on validation failure.

  • sap_idoc_status

    Query IDoc processing status in SAP. Returns status code with human-readable description (50=received, 53=processed, 51=error).

  • sap_list_services

    Discover available entity sets in a specific SAP OData service. Requires a full OData service path \u2014 NOT a base URL. Common SAP OData services: /sap/opu/odata/sap/API_BUSINESS_PARTNER, /sap/opu/odata/sap/API_MATERIAL_DOCUMENT_SRV, /sap/opu/odata/sap/API_SALES_ORDER_SRV. Use test-connection first to verify SAP connectivity. **When to use:** - You need the raw list of OData services at a base U

  • sap_media_download

    Holt die Rohbytes einer SAP-Media-Entity \xFCber den $value-Pfad, z. B. den Inhalt eines Anhangs. Die Bytes kommen als resource/blob zur\xFCck, nicht als base64-Zeichenkette im JSON; dazu Dateiname, Content-Type und Gr\xF6\xDFe als Text. **Wann nicht:** f\xFCr die Metadaten eines Anhangs (Name, Gr\xF6\xDFe, Anleger) reicht sap_read auf dieselbe Entit\xE4t.

  • sap_media_uploadwrite action

    L\xE4dt eine Datei als Rohbytes in eine SAP-Media-Entity, z. B. einen Anhang in AttachmentContentSet (API_CV_ATTACHMENT_SRV). Der Dateiname geht als Slug-Kopfzeile hinaus, die Bytes in den Rumpf, die Antwort kommt als JSON. **Kopfzeilen:** objektbezogene Angaben wie BusinessObjectTypeName (Kundenauftrag: BUS2032), LinkedSAPObjectKey (zehnstellig mit f\xFChrenden Nullen) und DocumentInfoRecordDocTy

  • sap_nl_querywrite action

    Execute a structured OData query generated from natural language. Accepts structured filters (field/operator/value) and converts them to the correct OData V2 or V4 filter syntax automatically. Read-only: only performs queries, never creates, updates, or deletes data. **When to use:** - You have a natural language question about SAP data - You know the service URL and entity set (from sap://routing

  • sap_query

    Query SAP entities with filter, sort, pagination. Returns matching entities with count. Per D-03: each query option is a separate typed parameter. **When to use:** - You have an exact OData $filter string ready - You know the service URL and entity set - You need fine-grained control over $select, $expand, $orderby, $top, $skip **When NOT to use:** - You have a natural language question (use sap_n

  • sap_read

    Read a single entity or entity collection from SAP. Use key parameter for single entity, omit for collection. Supports $select and $expand. **When to use:** - You have a specific entity key and want one record - You need to read a single entity by its primary key **When NOT to use:** - You want to list/filter multiple entities (use sap_query) - You don't know the entity key (query first, then read

  • sap_rfc_call

    Invoke any RFC-enabled function module on the SAP backend. When to use: - Custom Z_* function modules (no BAPI commit needed) - Read-only RFC calls (RFC_READ_TABLE, etc.) When NOT to use: - For BAPIs that need transactional commit -> use sap_bapi_call + sap_bapi_commit instead - sap_rfc_call is STATELESS: it CANNOT participate in BAPI commit transactions. If you need BAPI_TRANSACTION_COMMIT after

  • sap_rfc_metadata

    Retrieve the IMPORT/EXPORT/CHANGING/TABLES/EXCEPTIONS interface of an RFC-enabled function module (via RFC_GET_FUNCTION_INTERFACE). When to use: - Before calling an unfamiliar RFC/BAPI to understand its parameters - To discover required vs optional fields, ABAP types (EXID), and DDIC references When NOT to use: - To search for function modules by name pattern -> use sap_rfc_search_functions Return

  • sap_rfc_search_functions

    Search for function modules by name pattern via RFC_FUNCTION_SEARCH. When to use: - Discover BAPIs/FMs by partial name (e.g. "BAPI_USER_*", "Z_*") When NOT to use: - To inspect the interface of a known function module -> use sap_rfc_metadata Wildcards (SAP-native, NOT glob): - `*` matches any sequence of characters - `+` matches a single character Patterns are case-folded to uppercase. Default lim

  • sap_updatewrite action

    Update an existing SAP entity. Provide the entity key and the fields to update as JSON strings. ETag handling is automatic.

  • test-connection

    Diagnose the connection to the configured SAP system stage by stage: DNS \u2192 TLS (including certificate chain) \u2192 authentication \u2192 client (Mandant) \u2192 service catalog. Reports the FIRST failing stage with a concrete next step, so a 401 no longer leaves you guessing between certificate, user and client. **When to use:** - Any SAP tool fails and you need to know which layer is at fau

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How GuniWeb SAP MCP compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 63% of 48,273 servers
Tools
24
the typical server has 7
Tools that change things
29%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,534 servers
Downloads a week
979
more than 95% of 11,915 servers with a package

What its tools let an agent do: 17 read · 7 change

Release history: 6 versions in the registry since 2026-09-07, latest 2026-10-15, typically one every 3 days.

Install GuniWeb SAP MCP in Claude Code, Cursor or VS Code

Runs npx -y guniweb-sap-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add guniweb-sap-mcp -- npx -y guniweb-sap-mcp
Add to Cursor

What the publisher says

From the GuniWeb SAP MCP repository's README, as published. We do not edit it. Read it on GitHub

GuniWeb SAP S/4HANA & ECC MCP Server

Designed for n8n, usable from any MCP host. Free to use — built and maintained by GuniWeb.

Connect n8n workflows to SAP S/4HANA and ECC via OData V2, V4, IDocs, and RFC/BAPI using the Model Context Protocol (MCP). Made for AI-assisted, human-governed workflows: the workflow author decides which SAP APIs are called and in what order; the LLM extracts, maps and fills in parameters. Writes are off by default and switched on explicitly, per server and per token.

graph LR
    n8n["n8n workflow<br/>AI-assisted, human-governed"] -->|MCP Protocol| MCP["guniweb-sap-mcp<br/>22 Tools &bull; 8 Auth Types"]
    MCP -->|"OData V2/V4<br/>IDoc XML<br/>RFC/BAPI"| SAP["SAP S/4HANA & ECC"]
    MCP -->|"OAuth2 / JWT"| BTP["SAP BTP"]
    BTP --> SAP

    style n8n fill:#4a90d9,color:#fff,stroke:#3a7bc8
    style MCP fill:#2d2d2d,color:#fff,stroke:#555
    style SAP fill:#1a6fb5,color:#fff,stroke:#0f5a9d
    style BTP fill:#e8a317,color:#fff,stroke:#c88d14

Features

OData & IDoc

  • OData V2 + V4 CRUD -- Read, query, create, update, delete with auto version detection
  • Deep Insert -- Create parent + child entities in one request
  • Function Imports (V2) & Actions/Functions (V4) -- Trigger SAP business logic
  • Batch Operations -- Multiple operations in a single $batch request
  • NL-to-OData Query -- Natural language queries converted to structured OData filters
  • IDoc Send & Receive -- HTTP/XML based, no RFC dependency

Discovery & Intelligence

  • Service Discovery -- Auto-discover OData services with 16 business domain categories
  • Progressive Metadata -- Service catalog -> entity sets -> properties -> query
  • Smart Query Routing -- Domain-based routing resources for LLM tool selection
  • Decision-Tree Tool Descriptions -- "When to use / When NOT to use" blocks guide LLMs

Governed tool visibility

  • 4-Tier Tool Registry -- Core / OData / IDoc / RFC tiers with on-demand activation
  • sapenabletools -- LLMs activate additional tool tiers at runtime, within the limits you set
  • Read-only by default (since 0.2.2) -- write tools require --allow-write
  • Per-token policy (0.3.0) -- readOnly and tool-tier ceilings per Bearer token, only ever more restrictive
  • IDoc / RFC auto-disable -- tools hidden when the corresponding configuration is missing
  • MCP Annotations -- readOnlyHint, destructiveHint, idempotentHint on all 22 tools

Authentication (8 Types)

graph TB
    subgraph Technical["Technical User Auth"]
        basic["basic<br/><i>Direct S/4HANA</i>"]
        userbasic["user-basic<br/><i>Personal SAP login per request</i>"]
        oauth2["oauth2<br/><i>BTP Client Credentials</i>"]
        apikey["apikey<br/><i>Sandbox / Testing</i>"]
    end
    subgraph Enterprise["Enterprise Auth (OIDC)"]
        ias["ias<br/><i>SAP IAS Token</i>"]
        xsuaa["xsuaa<br/><i>SAP XSUAA Token</i>"]
    end
    subgraph Principal["Principal Propagation<br/><i>End-user identity forwarded to SAP</i>"]
        btp["btp-principal<br/><i>JWT Bearer Exchange<br/>via Destination Service</i>"]
        saml["saml-bearer<br/><i>SAML 2.0 Assertion<br/>+ RSA-SHA256 Signing</i>"]
    end

    style Technical fill:#2a5f8f,color:#fff,stroke:#1a4f7f
    style Enterprise fill:#5b8c5a,color:#fff,stroke:#4b7c4a
    style Principal fill:#8b5e3c,color:#fff,stroke:#7b4e2c

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

GuniWeb SAP MCP: common questions

Is GuniWeb SAP MCP server safe?
Mostly: it is graded B (82/100). Read the GuniWeb SAP MCP safety report
How do I install GuniWeb SAP MCP?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does GuniWeb SAP MCP need an API key?
Yes. The registry entry asks for SAP_PASSWORD.
Is GuniWeb SAP MCP maintained?
The last commit was 18 days ago (2026-10-15). The latest release is v0.10.0.
How does GuniWeb SAP MCP compare with other MCP servers?
safety score 82/100 (higher than 63% of 48,273 servers); tools 24 (the typical server has 7); tools that change things 29% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.