@dozimple/abap Adt

GitHub Actions

DoZimple MCP server for SAP ABAP: multi-system, secure by design — code review, ATC, diagnosis and documentation for ECC and S/4HANA

Devops Developer Tools Documentation

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "dozimple-abap-adt": {4      "command": "npx",5      "args": [6        "-y",7        "@dozimple/[email protected]"8      ]9    }10  }11}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @dozimple/[email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add dozimple-abap-adt -- npx -y @dozimple/abap-adt@2.0.3

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "dozimple-abap-adt": {4      "command": "npx",5      "args": [6        "-y",7        "@dozimple/[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 2.0.3
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install @dozimple/abap Adt?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does @dozimple/abap Adt need an API key?

No required environment variable is listed on this record.

What transport does @dozimple/abap Adt use?

@dozimple/abap Adt runs locally over stdio.

When was @dozimple/abap Adt last checked?

Last checked 2026-10-28. DoZimple MCP server for SAP ABAP: multi-system, secure by design — code review, ATC, diagnosis and documentation for ECC and S/4HANA

From the publisher

Documentation

abap-adt-doZimple

English · Español

AI that works on your SAP system with the rules of a senior consultant.

An MCP server by DoZimple that gives AI agents — Claude Code, Kiro or any MCP client — secure, verifiable access to SAP ABAP systems: review code and transport requests, run ATC and ABAP Unit, diagnose incidents, query the official documentation and, where authorized, save changes in the right transport after a human confirms them.

45 tools · 9 functional groups · 3 guided flows · ECC 6.0 (NW 7.50) and S/4HANA

Features · Full tool reference · Security · Threat model · Parity with other SAP MCPs · DoZimple Transport Risk · Credits · Contact

What you can ask

“What does transport DEVK900123 really change, and which objects usually travel with it but are missing?”

“Run ATC on ZDEMO_REPORT, explain the P1 findings with their SAP note and propose the fix SAP offers.”

“Can I use COND on this 7.50 system? If not, rewrite the method with compatible syntax and validate it against SAP.”

“Last night's billing job failed: dumps, job log and application log, and tell me the probable cause.”

“Is this release of four transports ready for production? Explain it in business terms for the PMO.”

The agent picks the tools, chains them and answers with evidence. Every answer states which system it comes from, and a failure is never presented as an empty result or as success.

Why it is different

	Usual approach	abap-adt-doZimple
Systems	One per instance, no roles	Every system in the landscape, with a policy per role: DEV / QAS / PRD
Writes	Saves wherever SAP decides, or cannot write at all	Development only, explicit transport, preview and human confirmation; stops on another transport's CTS lock
Verification	abaplint or nothing	SAP's real syntax check, also on code not saved yet
Parameters	A misspelled parameter is silently ignored and the call runs anyway	Unknown parameters are rejected with the list of accepted ones: a misspelled `transprot` never runs without the transport you meant
Results on failure	Empty lists or misleading “OK”	Typed error saying what could not be checked and why
Releases	Hard-coded endpoints	Capabilities read from each system's ADT discovery
IDE	Often requires the IDE open	Standalone server, no IDE
Third parties	Dependencies mixed with credentials	Components isolated in their own process and filtered
Data	Whatever the SAP user can read goes to the model	Security and HR tables blocked (also through views and CDS); personal data masked on production-data systems

Overview

Group	What for	Tools
Code review and transports	Know what a transport really changes and what it may break, before releasing it.	6
Quality, ATC and remediation	Find, understand and fix findings with SAP's real syntax check and quick fixes.	6
Repository exploration	Read and understand any ABAP object and its relations, on ECC and S/4HANA.	17
Data queries	Query tables with ABAP SQL, read-only, with sensitive and personal data protected.	8
Incident diagnosis	One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG.	8
Read-only debugging	See where a program stops and what its values are, without changing anything and only in development.	5
SAP documentation	Answer from official documentation and check which syntax exists in each release.	7
Controlled writes	Save changes only in development, in the right transport, previewed and confirmed by a human.	10
DoZimple Transport Risk	Decide whether a whole release can go to QA or production, with the why in business terms.	7
Operations and growth	See what works on each system and decide the next tool with data.	4

Architecture

flowchart LR
  subgraph Client["MCP client (Claude Code, Kiro…)"]
    A[AI agent]
  end
  subgraph Srv["abap-adt-doZimple (stdio, no ports)"]
    R["Registry and policy<br/>system · role · capability · module<br/>confirmation · audit"]
    T["45 tools + 3 flows"]
    K[("OS keychain")]
    D["Docs component<br/>(isolated process)"]
  end
  subgraph SAP["SAP systems"]
    DEV["DEV — read and, if authorized, write"]
    QAS["QAS / PRD — read only"]
    TR["DoZimple Transport Risk<br/>(SAP component)"]
  end
  A <-->|MCP| R --> T
  T -->|ADT over HTTPS| DEV
  T -->|ADT over HTTPS| QAS
  T -->|ICF service| TR
  T --> D
  R -.credentials.-> K
  D -.filtered queries.-> W[(SAP documentation)]

Features by group

Summary per group; each tool's details — parameters, types, defaults, requirements and credits — are in the full reference (in Spanish).

Code review and transports

Know what a transport really changes and what it may break, before releasing it.

Tool	What it does	Access
`transport_diff`	What a transport changed (code diff). Code review of a transport: for each source object (programs, includes, classes, interfaces, function modules, CDS) compares the version recorded with that transport against the previous one and shows a unified diff.	read
`transport_contents`	Transport contents. Header, tasks (owner and status) and objects of a transport request, read from E070/E07T/E071.	read
`my_transports`	My transports. Transports of a user (by default the connection user): their own and those where they have a task, with tasks, status, target and objects; flags transports without a target and own tasks in someone else's transport.	read
`co_change`	What usually travels with this object? Looks at the transports that touched an object and counts which other objects travelled with it, most frequent first.	read
`inactive_objects`	Inactive objects. Objects saved but not activated by the connection user, with their transport.	read
`edit_preflight`	Before editing: which transport will it land in? Tells, BEFORE changing an object, which transport the change will end up in and why: CTS lock by another transport, local object ($TMP), repair (different original system), or free with your open transports. With the dz-transport-risk module it also compares the DEV source with QA and production (version drift).	read

Quality, ATC and remediation

Find, understand and fix findings with SAP's real syntax check and quick fixes.

Tool	What it does	Access
`run_atc`	Run ATC. Runs the ABAP Test Cockpit on an object or a transport and lists numbered findings (priority, line, check, message) with SAP's P1/P2/P3 totals.	read
`atc_quickfix`	SAP-proposed fixes. The fixes SAP offers (the same as Ctrl+1 in Eclipse) for an ATC finding or a line: create text symbol, extract constant, etc.	read
`api_release_state`	Is this API released? What is its successor? Release state of an SAP object (class, function module/BAPI, table, CDS…) by contract C0–C4 and its released successor, read from the system itself.	read
`sap_notes`	SAP notes in the system (SNOTE). Whether a note is downloaded in this system, its implementation and processing status, version, component and title, per note or filtered by status/component; no SAP portal or S-user needed.	read
`syntax_check`	SAP syntax check. SAP's real syntax check (not abaplint), also on code not saved yet.	read
`run_unit_tests`	Run ABAP Unit. Runs the ABAP Unit tests of a class or program (harmless and short only) and returns the result per method, with each failure in detail.	executes (DEV)

Repository exploration

Read and understand any ABAP object and its relations, on ECC and S/4HANA.

Tool	What it does	Access
`search_objects`	Search ABAP objects. Searches repository objects by name (supports * wildcards).	read
`get_source`	Read ABAP source. Reads the source of any object: program, include, class (and its includes), interface, function module (without knowing its group), CDS, table/structure, etc.	read
`object_context`	An object's whole context in one call. Type, package, responsible, CTS lock and transport, source size, recent versions, usages, drift against QA/production (transport-risk module) and the last remembered ATC run; depth 0–2. Replaces the search_objects → get_source → edit_preflight → where_used → object_versions chain.	read
`where_used`	Where used. Where-used list of an object: who references it, with package and owner.	read
`source_search`	Search text in source code. Searches a text or regex in the source of a package (with subpackages), a transport or a list of objects, and returns object, include, line and the matching line; reaches what where-used misses (dynamic calls, literals, Z code outside the reference index).	read
`object_versions`	Object versions. Version history of an object (date, author, transport).	read
`package_contents`	Package contents. Objects of a development package grouped by type, with subpackages (TADIR/TDEVC, any release).	read
`ddic_type_info`	Data element, domain or table type. Definition of a DDIC type: data element (domain, type, length, texts), domain (type, length, fixed values, value table) or table type (line type, key).	read
`ddic_plan`	Prepare dictionary objects (NW 7.50). Where ADT cannot create or change tables, structures, domains, data elements or table types: validates a specification of new objects and changes against the system and returns the instruction file a person runs in SE38 with the generator program. Read-only: it never modifies SAP.	read
`odata_model`	OData model (EDMX) from the dictionary. Generates an OData V2 model file (entity types, sets, associations, navigation) from DDIC tables, structures or views, with real types, lengths, keys and labels, to import into an SEGW project on ECC / NW 7.50. Read-only; creating the project, generating classes and registering the service stay manual.	read
`transaction_info`	What a transaction runs. Program, screen and parameters of a transaction (TSTC/TSTCP), with its text.	read
`function_modules`	Function modules of a group. Lists the function modules of a function group with their text and whether they are RFC or update modules; given a module, finds its group and siblings. Works with /XXX/ namespaces.	read
`text_elements`	Text symbols and selection texts. Reads the text symbols (TEXT-001…), selection texts or headings of a program, class or function group.	read
`enhancements`	Enhancements and BAdIs. Implementations of a BAdI (new and classic, active or not), source code enhancements implemented inside a program, class or function group (flagging those that overwrite standard code), or all enhancement implementations of a namespace by type.	read
`code_structure`	Structure and references of an object (local analysis). Parses the source locally with abaplint: classes with methods and visibility, interfaces, forms, tables read, functions, classes and includes used, metrics and unused private methods. Nothing runs on SAP.	read
`package_dependencies`	Package dependencies (local analysis). Dependency graph of a package or object list from their sources: tables, functions, classes and includes per object, internal vs external, most-used targets.	read
`unused_methods`	Unused methods (local analysis). Private or protected methods no statement of their own class calls, across the classes of a package or list; protected ones flagged separately.	read

Data queries

Query tables with ABAP SQL, read-only, with sensitive and personal data protected.

Tool	What it does	Access
`sql_query`	ABAP SQL query. Runs an ABAP SQL SELECT (WHERE, JOIN, ORDER BY, subqueries) through ADT data preview, with personal columns masked and row caps on production-data systems.	read
`table_contents`	Table contents. Rows of a table, view or CDS, with optional columns and filter.	read
`count_rows`	Count rows. Counts the rows of a table or view, with optional condition and grouping, without fetching data; same policy as sql_query.	read
`search_tables`	Search tables by description. Finds tables, structures and views by a word in their description or name; metadata only.	read
`foreign_keys`	Foreign keys of a table. Check tables a table uses and tables that use it as check table, field by field, with the JOIN condition ready for sql_query.	read
`elevate_access`	Elevate access to a data category. Temporary, human-confirmed access on one system to a protected category (security and roles, HCM master data, payroll, personal data in clear); expires by itself; every use is audited. SECRETOS is never elevated.	read
`elevation_status`	Active elevations. Which data categories are elevated now, with reason and minutes left.	read
`revoke_access`	Revoke an elevation. Closes an elevation early; audited.	read

Incident diagnosis

One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG.

Tool	What it does	Access
`dumps`	Dumps (ST22). Lists runtime dumps: date, error, program, user and short text.	read
`diagnose_message`	Diagnose a message. From a screen message (class and number, or the text as copied) to its texts, placeholders and the objects that raise it (ADT where-used).	read
`jobs`	Background jobs (SM37). Background jobs by name (supports *), user, status and date, with their steps (program and variant).	read
`application_log`	Application log (SLG1) headers. Application log headers (BALHDR) by object/subobject, external number, user and date, with error and warning counts.	read
`gateway_errors`	SAP Gateway errors (/IWFND/ERROR_LOG). Lists SAP Gateway (OData) errors: service, error, user, date.	read
`abap_traces`	ABAP traces (SAT). Recorded ABAP performance traces of a user: ABAP, system and database times; per trace, the hit list, the database accesses or the statements. Read-only: never activates or deletes traces.	read
`sql_traces`	SQL traces (ST05). Directory and state of the ST05 traces exposed by ADT (S/4HANA, NW ≥ 7.51). Read-only.	read
`system_messages`	System messages (SM02). Current or all system messages (text, client, server, validity, creator) from TEMSI/TEMSG.	read

Read-only debugging

See where a program stops and what its values are, without changing anything and only in development.

Tool	What it does	Access
`debug_breakpoints`	External breakpoints (debugger). Sets or clears external breakpoints for the connection user (object and line); only on development systems with test data, with confirmation.	executes (DEV)
`debug_listen`	Wait and attach to the debugger. Listens up to a timeout for a program of the connection user to stop at an external breakpoint, attaches and returns the stack and the variables of the current frame. Read-only; personal variables masked on masked-data systems; disabled with production data.	executes (DEV)
`debug_variables`	Debugger variables. With an attached session: values by name, components of a structure or table by id, and the stack.	executes (DEV)
`debug_step`	Debugger step. Into, over, return or continue; returns the stack and variables afterwards; closes the session when the program ends.	executes (DEV)
`debug_stop`	Close the debug session. Releases or terminates the debuggee, removes the listener and closes the session.	executes (DEV)

SAP documentation

Answer from official documentation and check which syntax exists in each release.

Tool	What it does	Access
`abap_feature_matrix`	Since which release does this syntax exist? Availability of each ABAP language feature per release (7.40 … 7.58, 2025).	local
`docs_search`	Search ABAP documentation. Searches the official ABAP keyword documentation (standard and cloud), Clean ABAP, the DSAG guide, ABAP cheat sheets and RAP samples, locally.	local
`docs_fetch`	Read a documentation page. Returns the full content of a document by the id docs_search gives.	local
`clean_core_objects`	Released objects catalog (Clean Core). Searches SAP's public catalog (abap-atc-cr-cv-s4hc, local) for released/deprecated objects by name or topic, with Clean Core level (A released … D all) and successors.	local
`clean_core_object`	Clean Core state of an SAP object. Release state, Clean Core level and successor of an SAP object according to the public catalog (local).	local
`abap_lint`	abaplint on a snippet. Runs abaplint locally (code never leaves the machine) on an ABAP snippet or source.	local
`docs_community_search`	Search SAP Community. Searches SAP Community (blogs and questions) by error message, class or concept.	local

Controlled writes

Save changes only in development, in the right transport, previewed and confirmed by a human.

Tool	What it does	Access
`create_object`	Create ABAP object. Creates a new program, include, class, interface, function group, function module, CDS view or access control and, on S/4 or NW ≥ 7.51, dictionary objects (table, structure, table type, data element, domain) and RAP objects (metadata extension, service definition, OData V2 binding, behavior definition) in a development system: explicit package and transport (never chosen by the server), master language of the system, optional initial source or properties checked before saving, preview and human confirmation.	writes (authorized DEV)
`write_source`	Save source to SAP. Replaces the FULL source of an existing object (or class include) in the given transport, after a preview with syntax check and diff and a human confirmation.	writes (authorized DEV)
`edit_source`	Edit a fragment of the source. Replaces specific fragments of an existing object's source without resending it whole (exact current text → new text), through the same preview, syntax check, diff, fingerprint, lock and transport as write_source.	writes (authorized DEV)
`push_sources`	Save several sources in one operation. Full sources of up to 20 existing objects (class includes included) in the same transport, with one consolidated preview (syntax and diff per object), one confirmation and a joint activation; failures reported per object.	writes (authorized DEV)
`write_ddic_properties`	Write domain or data element properties. Changes the properties of an existing domain (type, length, output, fixed values) or data element (domain or predefined type, labels, search help) through ADT on S/4 or NW ≥ 7.51, with a property diff preview, confirmation, explicit transport and activation.	writes (authorized DEV)
`revert_source`	Revert to an earlier version. Writes back an earlier version of an object (the last active one, the one before it, or a numbered one from object_versions) through the same preview, fingerprint, lock and transport as write_source; never reverts on its own.	writes (authorized DEV)
`change_package`	Change an object's package. Moves an existing object to another package and records it in the given transport (typically out of $TMP), like Eclipse's “Change Package Assignment”; the preview includes SAP's own validation and nothing is changed until confirmed.	writes (authorized DEV)
`activate`	Activate objects. Activates one object, a list, or all inactive objects of the connection user (optionally of one transport) together in a single SAP activation, which resolves mutual dependencies; never activates pending deletions.	writes (authorized DEV)
`write_text_elements`	Create or change text symbols. Adds or changes text symbols (or selection texts) of a program/class/group, merging with the existing ones: nothing not mentioned is deleted.	writes (authorized DEV)
`create_transport`	Create transport request. Creates a workbench request for an object's package BEFORE the first edit, so the change lands in the ticket's transport and not in a reused task.	writes (authorized DEV)

DoZimple Transport Risk

Decide whether a whole release can go to QA or production, with the why in business terms.

Tool	What it does	Access
`analyze_transport_risk`	Transport risk. Tells whether a transport (or a release of several, comma-separated) is safe to move to QA or production: unreleased tasks, import status, dependencies that don't travel, positional access, CTS locks, import queue.	read
`import_health`	Import health. Health of the imports into a target (QA or production): answers “how are the releases to production going?”.	read
`failure_ranking`	Objects that fail most on import. Ranking of objects by import failure history in a target.	read
`change_audit`	Change audit evidence. Evidence for a change management audit on a target: what went in, with which ticket, initiative and origin.	read
`object_transport_history`	Transport history of an object. Which transports touched an object, when, and which already reached the target.	read
`remote_source`	Source on the target. The source of an object AS IT IS in QA or production, read through TMS (like “Retrieve remote versions”).	read
`transport_source_check`	Transport code against the target. Compares the code of a transport's objects with the target: objects missing there (R3.4) and version drift — signatures, fields or parameters that differ and don't travel in the transport (R3.5).	read

Operations and growth

See what works on each system and decide the next tool with data.

Tool	What it does	Access
`sap_systems`	SAP systems and available tools. Lists the configured systems (role, writes, data class, modules) and, optionally, checks connectivity and which tools work on each.	local
`report_gap`	Record a missing tool. Records a need no tool covers (e.g. something you had to do manually in a transaction), to decide what to build next.	local
`close_gap`	Close a recorded gap. Marks a gap recorded with report_gap as resolved, with a note (a tool now covers it, or the note turned out to be wrong); nothing is deleted.	local
`usage_stats`	Tool usage and gaps. Summary of the local log: calls per tool, failure rate and type, systems, and the gaps recorded with report_gap.	local

Guided flows

They show up as commands in the MCP client (in Claude Code: /mcp__abap-adt-doZimple__<name>) and chain the tools with the working rules of a senior consultant.

Flow	What it does	Chain
`revisar_pase` — Review a transport before release	Full review of a transport: code, missing companions, locks and, with the risk module, its analysis.	transport_contents → transport_diff → inactive_objects → co_change + edit_preflight → analyze_transport_risk (if module) → three-layer report: business, consultant, Basis
`remediar_atc` — Remediate ATC findings of an object	ATC → documentation and SAP note → released successor → fix → syntax → save in the transport.	edit_preflight → run_atc (BEFORE) → explain + api_release_state + where_used/object_versions → CHANGE/INVESTIGATE/KEEP classification → atc_quickfix → syntax_check → write_source in the transport (with human OK) → run_atc (AFTER) and P1 reduction
`diagnosticar_ticket` — Diagnose an incident	Dumps, jobs, application log and Gateway errors around an incident.	dumps → jobs → application_log → gateway_errors → transaction_info / get_source / object_versions / transport_contents → probable cause with evidence and what could not be checked

DoZimple Transport Risk

The most valuable module for operations: before releasing, it tells whether a transport or a whole release can go to QA or production, and why not, in three layers — a business verdict for the PMO, what to review for the consultant, and release actions for Basis.

Whole releases, not single transports: what travels in one transport covers the others; it computes the import sequence and detects mutual dependencies and collisions between transports.
What breaks silently: positional access to structures that change, code and dictionary dependencies that don't travel and don't exist on the target, version drift.
The real state of the landscape: target import queue, CTS locks, transports of copies that drag other people's changes, import health and the objects that fail most.
Evidence for change management audits.

It works on any ABAP stack with CTS (ECC and S/4HANA) and is read-only on every system. It requires a proprietary DoZimple SAP component (ICF service in development and read-only RFCs on the targets), which is not distributed in this repository.

Want it in your landscape? → dozimple.cl

Security

Designed to pass a Security and Basis review without exceptions. Details: SECURITY.md and the threat model (STRIDE and OWASP Top 10 for LLM applications).

No network surface: stdio only; no ports are opened.
Credentials in the OS keychain (macOS Keychain or Linux Secret Service), never in files, logs or responses.
Policy per role: QA and production are never written; development only with explicit authorization.
core tool profile (default): at startup only the everyday tools are published (find, read, query, check, save and load_tools); the rest stay registered but disabled and are loaded per catalog group with load_tools(groups), which notifies the client with tools/list_changed. Fewer tokens per conversation and less tool confusion. "tools": { "profile": "expert" } or ABAP_DZ_PROFILE=expert publishes everything at startup. The only/except filter overrides the profile: what it excludes cannot be loaded.
Selective tool exposure: "tools": { "only": [...], "except": [...] } in systems.json, or ABAP_DZ_TOOLS (comma-separated) in a project's MCP client configuration. Entries are tool names, catalog groups (exploracion, escritura…) or access kinds (read, write, exec). The environment never widens what the configuration allows; an unpublished tool does not exist for the client. A typo is reported at startup.
Strict parameters: an unknown or misspelled parameter is an error listing the accepted ones, never silently ignored.
No write without human confirmation: a preview with SAP's syntax check and the real diff, confirmed through MCP elicitation or a single-use token bound to those exact arguments.
Hash-chained audit log of every write and execution, and of every business-data read (data_read: tables, masked columns, row count; never the values), fail-closed (no log, no write and no result), verifiable with npm run audit:verify.
Data categories with elevated access: security and roles, HCM master data, payroll and personal data in clear are read only under a temporary elevation the person confirms (elevate_access: system, category, minutes, reason), allowed per system in the configuration; every grant, use and revocation is an elevation_* audit event.
SAP credential material blocked in SQL queries, also through views and CDS, even if the SAP user is authorized. Validated against a real S/4HANA 2023 system, where standard views and CDS read USR02 without naming it.
Personal data masked and row caps on systems with production data.
Free SQL parsed, not pattern-matched: FROM, JOIN, subqueries and CTEs are resolved to base tables; a query whose sources cannot be determined (host variables, dynamic sources) is rejected. On production-data systems sql_query and table_contents read in two steps: preview of tables and cap, then human confirmation, like a write.
No customer data to the internet: online documentation search is off by default and, when enabled, every query with objects, transports, systems, users or customer names is blocked.
Third parties isolated in their own process with a minimal environment.
Controlled supply chain: 4 production dependencies pinned to exact versions, no install scripts, verified registry signatures, CycloneDX SBOM, audit and secret scanning on every commit and in CI.

Compatibility


SAP	ECC 6.0 / NetWeaver 7.50 and later, and S/4HANA on-premise or private cloud, through ADT (`/sap/bc/adt`). Tested live on S/4HANA 2023 (SAP_BASIS 7.58) and ECC 6.0 EHP8 (SAP_BASIS 7.50). Release-dependent features (e.g. API release state) are detected per system
MCP clients	Claude Code, Kiro and any MCP client over stdio
Platform	Node.js 22+. Credentials in the macOS Keychain, the Linux Secret Service or environment variables

Installation

Quick start

npm install -g --ignore-scripts @dozimple/[email protected]
abap-adt-dozimple init --client claude-code      # or claude-desktop · kiro · cursor · vscode

init asks for the system (id, URL, client, user, role), writes ~/.config/abap-adt-dozimple/systems.json with 600 permissions, stores the password in the OS secret store (the store itself prompts; nothing is written to a file) and registers the server in the chosen client without touching its other entries. --dry-run shows what it would do; --force replaces an existing system or entry; init --help lists every flag. Step by step, the same thing is:

From npm, step by step

Pinned to an exact version, without install scripts, like the project's own dependencies:

npm install -g --ignore-scripts @dozimple/[email protected]
PKG="$(npm root -g)/@dozimple/abap-adt"
mkdir -p ~/.config/abap-adt-dozimple && chmod 700 ~/.config/abap-adt-dozimple
cp "$PKG/config/systems.example.json" ~/.config/abap-adt-dozimple/systems.json   # systems, roles and permissions
chmod 600 ~/.config/abap-adt-dozimple/systems.json
sh "$PKG/scripts/set-password.sh" MY_DEV                                        # prompts; stored in the keychain
node "$PKG/dist/scripts/smoke.js" MY_DEV                                        # read-only validation

MCP client registration:

{ "mcpServers": { "abap-adt-doZimple": { "command": "abap-adt-dozimple" } } }

Every release is published from CI with npm provenance: npm view @dozimple/[email protected] dist.attestations shows the attestation, and the GitHub release carries the tarball, its Sigstore bundle (.sigstore.json), the same bundle as in-toto provenance (.intoto.jsonl) and the SBOM. To check it: gh attestation verify dozimple-abap-adt-2.1.0.tgz --repo <owner>/abap-adt-dozimple.

Team mode over HTTP (identity per person)

abap-adt-dozimple serve --host 127.0.0.1 --port 2235            # behind a TLS reverse proxy
abap-adt-dozimple serve --host 0.0.0.0 --cert srv.pem --key srv.key   # or with its own TLS

Streamable HTTP endpoint (/mcp). Every request carries the SAP identity of the person using it (Authorization: Basic user:password), and the server talks to SAP as that person: their user in connections, locks, transports and the audit log. Passwords live only in memory while the session lasts and are never written to disk; the server refuses to listen outside loopback without TLS. Sessions are capped and expire after inactivity (--max-sessions, --idle-minutes, or ABAP_DZ_HTTP_* variables). Client registration:

{ "mcpServers": { "abap-adt-doZimple": { "type": "http", "url": "https://sap-mcp.example/mcp", "headers": { "Authorization": "Basic <base64 user:password>" } } } }

From source

npm ci && npm run build
mkdir -p ~/.config/abap-adt-dozimple
cp config/systems.example.json ~/.config/abap-adt-dozimple/systems.json   # systems, roles and permissions (chmod 600)
scripts/set-password.sh MY_DEV                                           # prompts for the password; stored in the keychain
npm run smoke -- MY_DEV                                                  # read-only validation

MCP client registration:

{ "mcpServers": { "abap-adt-doZimple": { "command": "node", "args": ["/path/to/abap-adt-doZimple/dist/index.js"] } } }

SAP documentation group (optional): install mcp-sap-docs (Apache-2.0, abap variant) in a separate folder and declare how to start it in sidecars.docs of systems.json (see config/systems.example.json). It runs as an isolated process; online search stays off unless allowOnline.

See CONTRIBUTING.md. To contribute or extend: git config core.hooksPath .githooks (secret and customer-data scanner before every commit) and the nueva-tool guide — adding a tool means adding one file. Code comments and tool descriptions are in Spanish; contributions in English are welcome.

Credits

abap-adt-doZimple is built on other people's work, and says so: each tool lists its credits in the reference. Dependency: its code is used. Data: third-party content that is queried. Idea: a design studied and reimplemented without copying code. Algorithm: a published method.

Project	Author / holder	License	Type	Used in
abap-adt-api	Marcello Urbani	MIT	dependency	all (core), `transport_diff`, `transport_contents`, `my_transports`, `inactive_objects`, `edit_preflight` and 40 more
Model Context Protocol TypeScript SDK	Model Context Protocol	MIT	dependency	all (core)
mcp-sap-docs	Marian Zeis (marianfoo)	Apache-2.0	dependency	`abap_feature_matrix`, `docs_search`, `docs_fetch`, `clean_core_objects`, `clean_core_object`, `abap_lint` and 1 more
abaplint	Lars Hvam and contributors	MIT	dependency	`code_structure`, `package_dependencies`, `unused_methods`, `abap_lint`
zod	Colin McDonnell and contributors	MIT	dependency	all (core)
ABAP Keyword Documentation	SAP SE	© SAP SE	data	`docs_search`, `docs_fetch`
ABAP Cheat Sheets	SAP (SAP-samples)	Apache-2.0	data	`docs_search`
Clean ABAP (SAP Style Guides)	SAP	per repository	data	`docs_search`
DSAG ABAP-Leitfaden	DSAG e.V.	per repository	data	`docs_search`
ABAP Feature Matrix	Software-Heroes	© Software-Heroes	data	`abap_feature_matrix`
Released objects / Cloudification Repository (abap-atc-cr-cv-s4hc)	SAP	Apache-2.0	data	`clean_core_objects`, `clean_core_object`
SAP Community / SAP Help Portal	SAP SE and community authors	SAP terms	data	`docs_community_search`
ABAP Remote FS (vscode_abap_remote_fs)	Marcello Urbani	MIT	idea	`syntax_check`, `debug_breakpoints`, `debug_listen`, `debug_variables`, `debug_step`, `debug_stop` and 1 more
mcp-abap-adt	mario-andreschak	MIT	idea	`search_objects`, `get_source`, `package_contents`, `ddic_type_info`, `transaction_info`, `table_contents`
ARC-1	arc-mcp (Marian Zeis and contributors)	MIT	idea	`transport_diff`, `atc_quickfix`, `object_context`, `gateway_errors`
vibing-steampunk	oisee and contributors	MIT	idea	`co_change`, `api_release_state`, `source_search`, `enhancements`, `code_structure`, `package_dependencies` and 6 more
ABAPilot MCP connector (catálogo de tools)	Crimson Consulting SL (NicoHern)	MIT	idea	`count_rows`, `search_tables`, `foreign_keys`, `diagnose_message`
ABAP Accelerator for Amazon Q Developer	AWS Solutions Library Samples	MIT-0	idea	all (core), `my_transports`, `create_object`, `usage_stats`
An O(ND) Difference Algorithm and Its Variations (1986)	Eugene W. Myers	published algorithm	algorithm	`transport_diff`, `atc_quickfix`

Full dependency licenses: THIRD_PARTY_NOTICES.md. If you are the author of one of these projects and want to adjust how you are credited, reach us at dozimple.cl.

Are you using it?

Tell us where and what for: open a short "I'm using it" issue (country, SAP release, MCP client, kind of use; no company or system names needed). npm and GitHub only give us anonymous counters, and what you tell us is what decides the next tools.

About DoZimple

DoZimple — technology that connects operations, data and innovation. SAP consulting and development (ABAP, CDS, OData, RAP, Fiori), integration and SAP BTP, software and portals connected to the ERP, and applied artificial intelligence over controlled sources, with reproducible answers and human review.

This MCP server is an example of how we work: useful AI, with control, traceability and security by design. Let's talk → dozimple.cl

License

Apache-2.0 — © 2026 DoZimple. See also NOTICE. The DoZimple Transport Risk SAP component is proprietary and not part of this repository. SAP, ABAP and S/4HANA are trademarks of SAP SE; this project is not affiliated with SAP SE.

About the ADT protocol. The server uses the REST protocol of ABAP Development Tools, the same one Eclipse ADT uses. It is not a released SAP API (no stability contract, no SAP support for third-party clients), so the server checks each system's ADT discovery and reports what is missing instead of assuming it. It is meant to be used like an IDE: each person with their own named SAP user and developer license, never a shared technical user. Review how your SAP agreement treats developer tools and indirect access before rolling it out. Details in NOTICE.

@dozimple/abap Adt

GitHub Actions

DoZimple MCP server for SAP ABAP: multi-system, secure by design — code review, ATC, diagnosis and documentation for ECC and S/4HANA

Devops Developer Tools Documentation

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "dozimple-abap-adt": {4      "command": "npx",5      "args": [6        "-y",7        "@dozimple/[email protected]"8      ]9    }10  }11}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @dozimple/[email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add dozimple-abap-adt -- npx -y @dozimple/abap-adt@2.0.3

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "dozimple-abap-adt": {4      "command": "npx",5      "args": [6        "-y",7        "@dozimple/[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 2.0.3
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install @dozimple/abap Adt?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does @dozimple/abap Adt need an API key?

No required environment variable is listed on this record.

What transport does @dozimple/abap Adt use?

@dozimple/abap Adt runs locally over stdio.

When was @dozimple/abap Adt last checked?

Last checked 2026-10-28. DoZimple MCP server for SAP ABAP: multi-system, secure by design — code review, ATC, diagnosis and documentation for ECC and S/4HANA

From the publisher

Documentation

abap-adt-doZimple

English · Español

AI that works on your SAP system with the rules of a senior consultant.

45 tools · 9 functional groups · 3 guided flows · ECC 6.0 (NW 7.50) and S/4HANA

Features · Full tool reference · Security · Threat model · Parity with other SAP MCPs · DoZimple Transport Risk · Credits · Contact

What you can ask

“What does transport DEVK900123 really change, and which objects usually travel with it but are missing?”

“Run ATC on ZDEMO_REPORT, explain the P1 findings with their SAP note and propose the fix SAP offers.”

“Can I use COND on this 7.50 system? If not, rewrite the method with compatible syntax and validate it against SAP.”

“Last night's billing job failed: dumps, job log and application log, and tell me the probable cause.”

“Is this release of four transports ready for production? Explain it in business terms for the PMO.”

The agent picks the tools, chains them and answers with evidence. Every answer states which system it comes from, and a failure is never presented as an empty result or as success.

Why it is different

	Usual approach	abap-adt-doZimple
Systems	One per instance, no roles	Every system in the landscape, with a policy per role: DEV / QAS / PRD
Writes	Saves wherever SAP decides, or cannot write at all	Development only, explicit transport, preview and human confirmation; stops on another transport's CTS lock
Verification	abaplint or nothing	SAP's real syntax check, also on code not saved yet
Parameters	A misspelled parameter is silently ignored and the call runs anyway	Unknown parameters are rejected with the list of accepted ones: a misspelled `transprot` never runs without the transport you meant
Results on failure	Empty lists or misleading “OK”	Typed error saying what could not be checked and why
Releases	Hard-coded endpoints	Capabilities read from each system's ADT discovery
IDE	Often requires the IDE open	Standalone server, no IDE
Third parties	Dependencies mixed with credentials	Components isolated in their own process and filtered
Data	Whatever the SAP user can read goes to the model	Security and HR tables blocked (also through views and CDS); personal data masked on production-data systems

Overview

Group	What for	Tools
Code review and transports	Know what a transport really changes and what it may break, before releasing it.	6
Quality, ATC and remediation	Find, understand and fix findings with SAP's real syntax check and quick fixes.	6
Repository exploration	Read and understand any ABAP object and its relations, on ECC and S/4HANA.	17
Data queries	Query tables with ABAP SQL, read-only, with sensitive and personal data protected.	8
Incident diagnosis	One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG.	8
Read-only debugging	See where a program stops and what its values are, without changing anything and only in development.	5
SAP documentation	Answer from official documentation and check which syntax exists in each release.	7
Controlled writes	Save changes only in development, in the right transport, previewed and confirmed by a human.	10
DoZimple Transport Risk	Decide whether a whole release can go to QA or production, with the why in business terms.	7
Operations and growth	See what works on each system and decide the next tool with data.	4

Architecture

flowchart LR
  subgraph Client["MCP client (Claude Code, Kiro…)"]
    A[AI agent]
  end
  subgraph Srv["abap-adt-doZimple (stdio, no ports)"]
    R["Registry and policy<br/>system · role · capability · module<br/>confirmation · audit"]
    T["45 tools + 3 flows"]
    K[("OS keychain")]
    D["Docs component<br/>(isolated process)"]
  end
  subgraph SAP["SAP systems"]
    DEV["DEV — read and, if authorized, write"]
    QAS["QAS / PRD — read only"]
    TR["DoZimple Transport Risk<br/>(SAP component)"]
  end
  A <-->|MCP| R --> T
  T -->|ADT over HTTPS| DEV
  T -->|ADT over HTTPS| QAS
  T -->|ICF service| TR
  T --> D
  R -.credentials.-> K
  D -.filtered queries.-> W[(SAP documentation)]

Features by group

Summary per group; each tool's details — parameters, types, defaults, requirements and credits — are in the full reference (in Spanish).

Code review and transports

Know what a transport really changes and what it may break, before releasing it.

Tool	What it does	Access
`transport_diff`	What a transport changed (code diff). Code review of a transport: for each source object (programs, includes, classes, interfaces, function modules, CDS) compares the version recorded with that transport against the previous one and shows a unified diff.	read
`transport_contents`	Transport contents. Header, tasks (owner and status) and objects of a transport request, read from E070/E07T/E071.	read
`my_transports`	My transports. Transports of a user (by default the connection user): their own and those where they have a task, with tasks, status, target and objects; flags transports without a target and own tasks in someone else's transport.	read
`co_change`	What usually travels with this object? Looks at the transports that touched an object and counts which other objects travelled with it, most frequent first.	read
`inactive_objects`	Inactive objects. Objects saved but not activated by the connection user, with their transport.	read
`edit_preflight`	Before editing: which transport will it land in? Tells, BEFORE changing an object, which transport the change will end up in and why: CTS lock by another transport, local object ($TMP), repair (different original system), or free with your open transports. With the dz-transport-risk module it also compares the DEV source with QA and production (version drift).	read

Quality, ATC and remediation

Find, understand and fix findings with SAP's real syntax check and quick fixes.

Tool	What it does	Access
`run_atc`	Run ATC. Runs the ABAP Test Cockpit on an object or a transport and lists numbered findings (priority, line, check, message) with SAP's P1/P2/P3 totals.	read
`atc_quickfix`	SAP-proposed fixes. The fixes SAP offers (the same as Ctrl+1 in Eclipse) for an ATC finding or a line: create text symbol, extract constant, etc.	read
`api_release_state`	Is this API released? What is its successor? Release state of an SAP object (class, function module/BAPI, table, CDS…) by contract C0–C4 and its released successor, read from the system itself.	read
`sap_notes`	SAP notes in the system (SNOTE). Whether a note is downloaded in this system, its implementation and processing status, version, component and title, per note or filtered by status/component; no SAP portal or S-user needed.	read
`syntax_check`	SAP syntax check. SAP's real syntax check (not abaplint), also on code not saved yet.	read
`run_unit_tests`	Run ABAP Unit. Runs the ABAP Unit tests of a class or program (harmless and short only) and returns the result per method, with each failure in detail.	executes (DEV)

Repository exploration

Read and understand any ABAP object and its relations, on ECC and S/4HANA.

Tool	What it does	Access
`search_objects`	Search ABAP objects. Searches repository objects by name (supports * wildcards).	read
`get_source`	Read ABAP source. Reads the source of any object: program, include, class (and its includes), interface, function module (without knowing its group), CDS, table/structure, etc.	read
`object_context`	An object's whole context in one call. Type, package, responsible, CTS lock and transport, source size, recent versions, usages, drift against QA/production (transport-risk module) and the last remembered ATC run; depth 0–2. Replaces the search_objects → get_source → edit_preflight → where_used → object_versions chain.	read
`where_used`	Where used. Where-used list of an object: who references it, with package and owner.	read
`source_search`	Search text in source code. Searches a text or regex in the source of a package (with subpackages), a transport or a list of objects, and returns object, include, line and the matching line; reaches what where-used misses (dynamic calls, literals, Z code outside the reference index).	read
`object_versions`	Object versions. Version history of an object (date, author, transport).	read
`package_contents`	Package contents. Objects of a development package grouped by type, with subpackages (TADIR/TDEVC, any release).	read
`ddic_type_info`	Data element, domain or table type. Definition of a DDIC type: data element (domain, type, length, texts), domain (type, length, fixed values, value table) or table type (line type, key).	read
`ddic_plan`	Prepare dictionary objects (NW 7.50). Where ADT cannot create or change tables, structures, domains, data elements or table types: validates a specification of new objects and changes against the system and returns the instruction file a person runs in SE38 with the generator program. Read-only: it never modifies SAP.	read
`odata_model`	OData model (EDMX) from the dictionary. Generates an OData V2 model file (entity types, sets, associations, navigation) from DDIC tables, structures or views, with real types, lengths, keys and labels, to import into an SEGW project on ECC / NW 7.50. Read-only; creating the project, generating classes and registering the service stay manual.	read
`transaction_info`	What a transaction runs. Program, screen and parameters of a transaction (TSTC/TSTCP), with its text.	read
`function_modules`	Function modules of a group. Lists the function modules of a function group with their text and whether they are RFC or update modules; given a module, finds its group and siblings. Works with /XXX/ namespaces.	read
`text_elements`	Text symbols and selection texts. Reads the text symbols (TEXT-001…), selection texts or headings of a program, class or function group.	read
`enhancements`	Enhancements and BAdIs. Implementations of a BAdI (new and classic, active or not), source code enhancements implemented inside a program, class or function group (flagging those that overwrite standard code), or all enhancement implementations of a namespace by type.	read
`code_structure`	Structure and references of an object (local analysis). Parses the source locally with abaplint: classes with methods and visibility, interfaces, forms, tables read, functions, classes and includes used, metrics and unused private methods. Nothing runs on SAP.	read
`package_dependencies`	Package dependencies (local analysis). Dependency graph of a package or object list from their sources: tables, functions, classes and includes per object, internal vs external, most-used targets.	read
`unused_methods`	Unused methods (local analysis). Private or protected methods no statement of their own class calls, across the classes of a package or list; protected ones flagged separately.	read

Data queries

Query tables with ABAP SQL, read-only, with sensitive and personal data protected.

Tool	What it does	Access
`sql_query`	ABAP SQL query. Runs an ABAP SQL SELECT (WHERE, JOIN, ORDER BY, subqueries) through ADT data preview, with personal columns masked and row caps on production-data systems.	read
`table_contents`	Table contents. Rows of a table, view or CDS, with optional columns and filter.	read
`count_rows`	Count rows. Counts the rows of a table or view, with optional condition and grouping, without fetching data; same policy as sql_query.	read
`search_tables`	Search tables by description. Finds tables, structures and views by a word in their description or name; metadata only.	read
`foreign_keys`	Foreign keys of a table. Check tables a table uses and tables that use it as check table, field by field, with the JOIN condition ready for sql_query.	read
`elevate_access`	Elevate access to a data category. Temporary, human-confirmed access on one system to a protected category (security and roles, HCM master data, payroll, personal data in clear); expires by itself; every use is audited. SECRETOS is never elevated.	read
`elevation_status`	Active elevations. Which data categories are elevated now, with reason and minutes left.	read
`revoke_access`	Revoke an elevation. Closes an elevation early; audited.	read

Incident diagnosis

One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG.

Tool	What it does	Access
`dumps`	Dumps (ST22). Lists runtime dumps: date, error, program, user and short text.	read
`diagnose_message`	Diagnose a message. From a screen message (class and number, or the text as copied) to its texts, placeholders and the objects that raise it (ADT where-used).	read
`jobs`	Background jobs (SM37). Background jobs by name (supports *), user, status and date, with their steps (program and variant).	read
`application_log`	Application log (SLG1) headers. Application log headers (BALHDR) by object/subobject, external number, user and date, with error and warning counts.	read
`gateway_errors`	SAP Gateway errors (/IWFND/ERROR_LOG). Lists SAP Gateway (OData) errors: service, error, user, date.	read
`abap_traces`	ABAP traces (SAT). Recorded ABAP performance traces of a user: ABAP, system and database times; per trace, the hit list, the database accesses or the statements. Read-only: never activates or deletes traces.	read
`sql_traces`	SQL traces (ST05). Directory and state of the ST05 traces exposed by ADT (S/4HANA, NW ≥ 7.51). Read-only.	read
`system_messages`	System messages (SM02). Current or all system messages (text, client, server, validity, creator) from TEMSI/TEMSG.	read

Read-only debugging

See where a program stops and what its values are, without changing anything and only in development.

Tool	What it does	Access
`debug_breakpoints`	External breakpoints (debugger). Sets or clears external breakpoints for the connection user (object and line); only on development systems with test data, with confirmation.	executes (DEV)
`debug_listen`	Wait and attach to the debugger. Listens up to a timeout for a program of the connection user to stop at an external breakpoint, attaches and returns the stack and the variables of the current frame. Read-only; personal variables masked on masked-data systems; disabled with production data.	executes (DEV)
`debug_variables`	Debugger variables. With an attached session: values by name, components of a structure or table by id, and the stack.	executes (DEV)
`debug_step`	Debugger step. Into, over, return or continue; returns the stack and variables afterwards; closes the session when the program ends.	executes (DEV)
`debug_stop`	Close the debug session. Releases or terminates the debuggee, removes the listener and closes the session.	executes (DEV)

SAP documentation

Answer from official documentation and check which syntax exists in each release.

Tool	What it does	Access
`abap_feature_matrix`	Since which release does this syntax exist? Availability of each ABAP language feature per release (7.40 … 7.58, 2025).	local
`docs_search`	Search ABAP documentation. Searches the official ABAP keyword documentation (standard and cloud), Clean ABAP, the DSAG guide, ABAP cheat sheets and RAP samples, locally.	local
`docs_fetch`	Read a documentation page. Returns the full content of a document by the id docs_search gives.	local
`clean_core_objects`	Released objects catalog (Clean Core). Searches SAP's public catalog (abap-atc-cr-cv-s4hc, local) for released/deprecated objects by name or topic, with Clean Core level (A released … D all) and successors.	local
`clean_core_object`	Clean Core state of an SAP object. Release state, Clean Core level and successor of an SAP object according to the public catalog (local).	local
`abap_lint`	abaplint on a snippet. Runs abaplint locally (code never leaves the machine) on an ABAP snippet or source.	local
`docs_community_search`	Search SAP Community. Searches SAP Community (blogs and questions) by error message, class or concept.	local

Controlled writes

Save changes only in development, in the right transport, previewed and confirmed by a human.

Tool	What it does	Access
`create_object`	Create ABAP object. Creates a new program, include, class, interface, function group, function module, CDS view or access control and, on S/4 or NW ≥ 7.51, dictionary objects (table, structure, table type, data element, domain) and RAP objects (metadata extension, service definition, OData V2 binding, behavior definition) in a development system: explicit package and transport (never chosen by the server), master language of the system, optional initial source or properties checked before saving, preview and human confirmation.	writes (authorized DEV)
`write_source`	Save source to SAP. Replaces the FULL source of an existing object (or class include) in the given transport, after a preview with syntax check and diff and a human confirmation.	writes (authorized DEV)
`edit_source`	Edit a fragment of the source. Replaces specific fragments of an existing object's source without resending it whole (exact current text → new text), through the same preview, syntax check, diff, fingerprint, lock and transport as write_source.	writes (authorized DEV)
`push_sources`	Save several sources in one operation. Full sources of up to 20 existing objects (class includes included) in the same transport, with one consolidated preview (syntax and diff per object), one confirmation and a joint activation; failures reported per object.	writes (authorized DEV)
`write_ddic_properties`	Write domain or data element properties. Changes the properties of an existing domain (type, length, output, fixed values) or data element (domain or predefined type, labels, search help) through ADT on S/4 or NW ≥ 7.51, with a property diff preview, confirmation, explicit transport and activation.	writes (authorized DEV)
`revert_source`	Revert to an earlier version. Writes back an earlier version of an object (the last active one, the one before it, or a numbered one from object_versions) through the same preview, fingerprint, lock and transport as write_source; never reverts on its own.	writes (authorized DEV)
`change_package`	Change an object's package. Moves an existing object to another package and records it in the given transport (typically out of $TMP), like Eclipse's “Change Package Assignment”; the preview includes SAP's own validation and nothing is changed until confirmed.	writes (authorized DEV)
`activate`	Activate objects. Activates one object, a list, or all inactive objects of the connection user (optionally of one transport) together in a single SAP activation, which resolves mutual dependencies; never activates pending deletions.	writes (authorized DEV)
`write_text_elements`	Create or change text symbols. Adds or changes text symbols (or selection texts) of a program/class/group, merging with the existing ones: nothing not mentioned is deleted.	writes (authorized DEV)
`create_transport`	Create transport request. Creates a workbench request for an object's package BEFORE the first edit, so the change lands in the ticket's transport and not in a reused task.	writes (authorized DEV)

DoZimple Transport Risk

Decide whether a whole release can go to QA or production, with the why in business terms.

Tool	What it does	Access
`analyze_transport_risk`	Transport risk. Tells whether a transport (or a release of several, comma-separated) is safe to move to QA or production: unreleased tasks, import status, dependencies that don't travel, positional access, CTS locks, import queue.	read
`import_health`	Import health. Health of the imports into a target (QA or production): answers “how are the releases to production going?”.	read
`failure_ranking`	Objects that fail most on import. Ranking of objects by import failure history in a target.	read
`change_audit`	Change audit evidence. Evidence for a change management audit on a target: what went in, with which ticket, initiative and origin.	read
`object_transport_history`	Transport history of an object. Which transports touched an object, when, and which already reached the target.	read
`remote_source`	Source on the target. The source of an object AS IT IS in QA or production, read through TMS (like “Retrieve remote versions”).	read
`transport_source_check`	Transport code against the target. Compares the code of a transport's objects with the target: objects missing there (R3.4) and version drift — signatures, fields or parameters that differ and don't travel in the transport (R3.5).	read

Operations and growth

See what works on each system and decide the next tool with data.

Tool	What it does	Access
`sap_systems`	SAP systems and available tools. Lists the configured systems (role, writes, data class, modules) and, optionally, checks connectivity and which tools work on each.	local
`report_gap`	Record a missing tool. Records a need no tool covers (e.g. something you had to do manually in a transaction), to decide what to build next.	local
`close_gap`	Close a recorded gap. Marks a gap recorded with report_gap as resolved, with a note (a tool now covers it, or the note turned out to be wrong); nothing is deleted.	local
`usage_stats`	Tool usage and gaps. Summary of the local log: calls per tool, failure rate and type, systems, and the gaps recorded with report_gap.	local

Guided flows

They show up as commands in the MCP client (in Claude Code: /mcp__abap-adt-doZimple__<name>) and chain the tools with the working rules of a senior consultant.

Flow	What it does	Chain
`revisar_pase` — Review a transport before release	Full review of a transport: code, missing companions, locks and, with the risk module, its analysis.	transport_contents → transport_diff → inactive_objects → co_change + edit_preflight → analyze_transport_risk (if module) → three-layer report: business, consultant, Basis
`remediar_atc` — Remediate ATC findings of an object	ATC → documentation and SAP note → released successor → fix → syntax → save in the transport.	edit_preflight → run_atc (BEFORE) → explain + api_release_state + where_used/object_versions → CHANGE/INVESTIGATE/KEEP classification → atc_quickfix → syntax_check → write_source in the transport (with human OK) → run_atc (AFTER) and P1 reduction
`diagnosticar_ticket` — Diagnose an incident	Dumps, jobs, application log and Gateway errors around an incident.	dumps → jobs → application_log → gateway_errors → transaction_info / get_source / object_versions / transport_contents → probable cause with evidence and what could not be checked

DoZimple Transport Risk

Whole releases, not single transports: what travels in one transport covers the others; it computes the import sequence and detects mutual dependencies and collisions between transports.
What breaks silently: positional access to structures that change, code and dictionary dependencies that don't travel and don't exist on the target, version drift.
The real state of the landscape: target import queue, CTS locks, transports of copies that drag other people's changes, import health and the objects that fail most.
Evidence for change management audits.

Want it in your landscape? → dozimple.cl

Security

Designed to pass a Security and Basis review without exceptions. Details: SECURITY.md and the threat model (STRIDE and OWASP Top 10 for LLM applications).

No network surface: stdio only; no ports are opened.
Credentials in the OS keychain (macOS Keychain or Linux Secret Service), never in files, logs or responses.
Policy per role: QA and production are never written; development only with explicit authorization.
core tool profile (default): at startup only the everyday tools are published (find, read, query, check, save and load_tools); the rest stay registered but disabled and are loaded per catalog group with load_tools(groups), which notifies the client with tools/list_changed. Fewer tokens per conversation and less tool confusion. "tools": { "profile": "expert" } or ABAP_DZ_PROFILE=expert publishes everything at startup. The only/except filter overrides the profile: what it excludes cannot be loaded.
Selective tool exposure: "tools": { "only": [...], "except": [...] } in systems.json, or ABAP_DZ_TOOLS (comma-separated) in a project's MCP client configuration. Entries are tool names, catalog groups (exploracion, escritura…) or access kinds (read, write, exec). The environment never widens what the configuration allows; an unpublished tool does not exist for the client. A typo is reported at startup.
Strict parameters: an unknown or misspelled parameter is an error listing the accepted ones, never silently ignored.
No write without human confirmation: a preview with SAP's syntax check and the real diff, confirmed through MCP elicitation or a single-use token bound to those exact arguments.
Hash-chained audit log of every write and execution, and of every business-data read (data_read: tables, masked columns, row count; never the values), fail-closed (no log, no write and no result), verifiable with npm run audit:verify.
Data categories with elevated access: security and roles, HCM master data, payroll and personal data in clear are read only under a temporary elevation the person confirms (elevate_access: system, category, minutes, reason), allowed per system in the configuration; every grant, use and revocation is an elevation_* audit event.
SAP credential material blocked in SQL queries, also through views and CDS, even if the SAP user is authorized. Validated against a real S/4HANA 2023 system, where standard views and CDS read USR02 without naming it.
Personal data masked and row caps on systems with production data.
Free SQL parsed, not pattern-matched: FROM, JOIN, subqueries and CTEs are resolved to base tables; a query whose sources cannot be determined (host variables, dynamic sources) is rejected. On production-data systems sql_query and table_contents read in two steps: preview of tables and cap, then human confirmation, like a write.
No customer data to the internet: online documentation search is off by default and, when enabled, every query with objects, transports, systems, users or customer names is blocked.
Third parties isolated in their own process with a minimal environment.
Controlled supply chain: 4 production dependencies pinned to exact versions, no install scripts, verified registry signatures, CycloneDX SBOM, audit and secret scanning on every commit and in CI.

Compatibility


SAP	ECC 6.0 / NetWeaver 7.50 and later, and S/4HANA on-premise or private cloud, through ADT (`/sap/bc/adt`). Tested live on S/4HANA 2023 (SAP_BASIS 7.58) and ECC 6.0 EHP8 (SAP_BASIS 7.50). Release-dependent features (e.g. API release state) are detected per system
MCP clients	Claude Code, Kiro and any MCP client over stdio
Platform	Node.js 22+. Credentials in the macOS Keychain, the Linux Secret Service or environment variables

Installation

Quick start

npm install -g --ignore-scripts @dozimple/[email protected]
abap-adt-dozimple init --client claude-code      # or claude-desktop · kiro · cursor · vscode

From npm, step by step

Pinned to an exact version, without install scripts, like the project's own dependencies:

npm install -g --ignore-scripts @dozimple/[email protected]
PKG="$(npm root -g)/@dozimple/abap-adt"
mkdir -p ~/.config/abap-adt-dozimple && chmod 700 ~/.config/abap-adt-dozimple
cp "$PKG/config/systems.example.json" ~/.config/abap-adt-dozimple/systems.json   # systems, roles and permissions
chmod 600 ~/.config/abap-adt-dozimple/systems.json
sh "$PKG/scripts/set-password.sh" MY_DEV                                        # prompts; stored in the keychain
node "$PKG/dist/scripts/smoke.js" MY_DEV                                        # read-only validation

MCP client registration:

{ "mcpServers": { "abap-adt-doZimple": { "command": "abap-adt-dozimple" } } }

Team mode over HTTP (identity per person)

abap-adt-dozimple serve --host 127.0.0.1 --port 2235            # behind a TLS reverse proxy
abap-adt-dozimple serve --host 0.0.0.0 --cert srv.pem --key srv.key   # or with its own TLS

{ "mcpServers": { "abap-adt-doZimple": { "type": "http", "url": "https://sap-mcp.example/mcp", "headers": { "Authorization": "Basic <base64 user:password>" } } } }

From source

npm ci && npm run build
mkdir -p ~/.config/abap-adt-dozimple
cp config/systems.example.json ~/.config/abap-adt-dozimple/systems.json   # systems, roles and permissions (chmod 600)
scripts/set-password.sh MY_DEV                                           # prompts for the password; stored in the keychain
npm run smoke -- MY_DEV                                                  # read-only validation

MCP client registration:

{ "mcpServers": { "abap-adt-doZimple": { "command": "node", "args": ["/path/to/abap-adt-doZimple/dist/index.js"] } } }

Credits

Project	Author / holder	License	Type	Used in
abap-adt-api	Marcello Urbani	MIT	dependency	all (core), `transport_diff`, `transport_contents`, `my_transports`, `inactive_objects`, `edit_preflight` and 40 more
Model Context Protocol TypeScript SDK	Model Context Protocol	MIT	dependency	all (core)
mcp-sap-docs	Marian Zeis (marianfoo)	Apache-2.0	dependency	`abap_feature_matrix`, `docs_search`, `docs_fetch`, `clean_core_objects`, `clean_core_object`, `abap_lint` and 1 more
abaplint	Lars Hvam and contributors	MIT	dependency	`code_structure`, `package_dependencies`, `unused_methods`, `abap_lint`
zod	Colin McDonnell and contributors	MIT	dependency	all (core)
ABAP Keyword Documentation	SAP SE	© SAP SE	data	`docs_search`, `docs_fetch`
ABAP Cheat Sheets	SAP (SAP-samples)	Apache-2.0	data	`docs_search`
Clean ABAP (SAP Style Guides)	SAP	per repository	data	`docs_search`
DSAG ABAP-Leitfaden	DSAG e.V.	per repository	data	`docs_search`
ABAP Feature Matrix	Software-Heroes	© Software-Heroes	data	`abap_feature_matrix`
Released objects / Cloudification Repository (abap-atc-cr-cv-s4hc)	SAP	Apache-2.0	data	`clean_core_objects`, `clean_core_object`
SAP Community / SAP Help Portal	SAP SE and community authors	SAP terms	data	`docs_community_search`
ABAP Remote FS (vscode_abap_remote_fs)	Marcello Urbani	MIT	idea	`syntax_check`, `debug_breakpoints`, `debug_listen`, `debug_variables`, `debug_step`, `debug_stop` and 1 more
mcp-abap-adt	mario-andreschak	MIT	idea	`search_objects`, `get_source`, `package_contents`, `ddic_type_info`, `transaction_info`, `table_contents`
ARC-1	arc-mcp (Marian Zeis and contributors)	MIT	idea	`transport_diff`, `atc_quickfix`, `object_context`, `gateway_errors`
vibing-steampunk	oisee and contributors	MIT	idea	`co_change`, `api_release_state`, `source_search`, `enhancements`, `code_structure`, `package_dependencies` and 6 more
ABAPilot MCP connector (catálogo de tools)	Crimson Consulting SL (NicoHern)	MIT	idea	`count_rows`, `search_tables`, `foreign_keys`, `diagnose_message`
ABAP Accelerator for Amazon Q Developer	AWS Solutions Library Samples	MIT-0	idea	all (core), `my_transports`, `create_object`, `usage_stats`
An O(ND) Difference Algorithm and Its Variations (1986)	Eugene W. Myers	published algorithm	algorithm	`transport_diff`, `atc_quickfix`

Full dependency licenses: THIRD_PARTY_NOTICES.md. If you are the author of one of these projects and want to adjust how you are credited, reach us at dozimple.cl.

Are you using it?

About DoZimple

This MCP server is an example of how we work: useful AI, with control, traceability and security by design. Let's talk → dozimple.cl