ARC-1 MCP
ARC-1: an MCP server for SAP ABAP systems, safe by default, with reading, code edits, transports and checks through ADT.
- 262 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Reads source code and, with flags enabled, changes objects, transports and data in the SAP system.
- SAP credentials and access keys are held on the server side.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/arc-1Detects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Reads source code and, with flags enabled, changes objects, transports and data in the SAP system.
- SAP credentials and access keys are held on the server side.
This is third-party code. Review the repository files before installing.
What it does
ARC-1 connects Claude, GitHub Copilot, Copilot Studio and any MCP client to SAP systems through the ADT REST API. The server installs as an npm package, deploys on SAP BTP or in your own network and adapts to the system: it detects BTP or on-premise, the ABAP version and available features. Instead of two hundred fine-grained tools it gives 12 by purpose: `SAPRead` reads source code, methods and CDS, `SAPSearch` searches objects and text, `SAPWrite` creates and edits source code, `SAPActivate` activates objects, `SAPTransport` manages CTS transports and `SAPDiagnose` runs syntax checks, ABAP Unit and ATC. By default the server only reads: free SQL, table preview, transport and Git writes are off and enabled with `SAP_ALLOW_*` flags. Writes can be limited to packages and actions denied through the `SAP_DENY_ACTIONS` list. Access works through an API key, OIDC, OAuth 2.0 or XSUAA, forwarding the user identity into SAP.
Who it is for. ABAP developers and SAP teams who analyse and edit code in ADT together with an assistant and require access limits.
Good fit when
- An assistant reads one class method and shows where it is called.
- Before an edit the impact of a change on CDS views and tables is worked out.
- A new object is created in the `$TMP` package and activated with its dependencies.
- A team deploys a shared server on BTP with user identity propagation.
Not a fit when
- SAP policy does not allow ADT API use through third-party channels, so settle it with SAP before adopting.
- Writes to production packages are needed and there are no `--allowed-packages` limits.
- Broad SQL and table preview with personal data is needed without a separate administrator decision.
Example request
Show the source of the calculate_total method of class ZCL_ORDER and find all places where it is called.MCP
- Transport
- stdio, http
- Authentication
- API key
Environment variables
SAP_URLrequired- SAP system URL, for example http://host:50000.
SAP_USERrequired- SAP user.
SAP_PASSWORDrequired, secret- SAP user password.
SAP_CLIENT- SAP client number, defaults to 100.
Limitations
It needs the SAP address, user, password and client (`SAP_URL`, `SAP_USER`, `SAP_PASSWORD`, `SAP_CLIENT`). The documentation warns separately that ADT APIs are internal under SAP policy and advises clarifying with SAP whether such a channel is allowed even for development and tests. Free SQL (`SAP_ALLOW_FREE_SQL=true`) and table preview (`SAP_ALLOW_DATA_PREVIEW=true`) are off and expose business data, and enabled writes are restricted to `$TMP`. In shared technical user mode the user identity is not propagated to SAP.
How to disable. Remove the arc-1 entry from the MCP configuration and stop the server (the process or the Cloud Foundry app). Revoke the password and API keys in SAP and in the server settings.
FAQ
How do I connect ARC-1?
Run the `arc-1` package through `npx` as a stdio server with `SAP_URL`, `SAP_USER` and `SAP_PASSWORD`. For a shared server deploy it on BTP Cloud Foundry with XSUAA.
How do I allow writes?
Writes are off by default. Enable them with `--allow-writes`, limit packages with `--allowed-packages "Z*,$TMP"` and open transports with the separate `--allow-transport-writes`.
Why are 12 tools better than hundreds?
Each tool covers an intent: read, search, write, activate, navigate, transport. The schema is smaller, the model gets confused less and descriptions adapt to the system.
Which sign-in methods are supported?
API key, OIDC or JWT (Entra ID, Keycloak), local OAuth 2.0 for BTP, XSUAA and per-user identity through the Destination Service with Cloud Connector.
How does it differ from mcp-abap-adt?
ARC-1 focuses on default safety, access roles, BTP deployment and enterprise sign-in. The idea of MCP for ADT is shared, and the authors cite mcp-abap-adt as an inspiration.
Discussion
No questions or reviews yet.
Related
MCP serversmcp-abap-adt opens SAP ECC, S/4HANA and BTP ABAP repositories to an agent: analysis, creation and editing of objects through ADT.
MCP server to SAP ABAP through ADT: an agent reads code of programs, classes, tables and CDS and searches objects in the system
An MCP server for SAP ABAP: an agent finds objects, reads and edits sources, checks syntax and handles transports through ADT
vsp is an ADT to MCP bridge: an agent reads and writes ABAP code, runs tests and drives the SAP debugger with no server install
CAP MCP Server: an assistant for SAP CAP projects
CAP MCP Server
An SAP MCP server that searches the CDS model and CAP docs embeddings locally so an agent writes more accurate app code
1C AI MCP: 1C:Naparnik API bridge
1C AI MCP
A FastMCP Docker server with 12 tools for BSL code analysis and documentation search through the 1С:Naparnik API (code.1c.ai)
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| ARC-1 (this card) | no | API key | 262 | |
| mcp-abap-adt | no | OAuth | 106 | opens ABAP repositories to an agent through ADT; ARC-1 adds default safety, roles and BTP deployment |
| MCP SAP GUI | no | not required | 146 | drives a SAP GUI screen on Windows; ARC-1 works through the ADT REST API with no UI |
README in short
The project documentation lives at docs.arc-1-mcp.com and includes a quickstart, a security review and a tool reference. The server caches objects it reads and revalidates them by ETag.