Public source · 2026Back to work

SAP CPI MCP

22 tools across the integration lifecycle

An enterprise MCP server for SAP Cloud Integration: inventory packages and iFlows, export source, deploy, read runtime logs and drill into failures — all inside an AI conversation.

hand-in-sap-integrationsuiteMCPSAP BTPIntegration SuiteCPI / iFlowTypeScriptPublic source · actively maintained
AI agent to SAP Integration Suite through 22 MCP tools, with iFlow and MPL log verificationSAP CPI / MCPLIVEAI AGENTIntent + plandesign / dev / testMCP SERVERSAP CPI MCP22 tools · 17 readSAP BTPIntegration SuiteiFlow · MPL · ODataPACKAGEInventoryread onlyIFLOWSourceedit / deployMPLLogsruntime proofSECURITYMetadatano secretsWRITEGatedallow flagDEPLOY → MPL VERIFYNO SECRET EXPORT

The problem

CPI delivery is consumed by web logins, package hunting, iFlow edits, packaging, deployment waits and MPL log reading. Cross-environment troubleshooting is especially fragmented.

Approach

  • Wrap CPI OData and admin APIs into 22 dedicated MCP tools: 17 read-only by default, 5 write/deploy tools gated behind SAP_ALLOW_WRITE.
  • Design, dev and test subagents are confined to docs, source and tests respectively, forming a design–build–verify loop.
  • After deployment, read MPL logs and ErrorInformation so “deployed” becomes “verified at runtime”.

What is inside

  • 22 tools spanning packages, iFlows, configuration, deployment, logs, security-material metadata and runtime diagnosis.
  • Write tools are not registered by default; only SAP_ALLOW_WRITE=true opens deployment and start/stop to AI.
  • Passwords, client secrets and private keys are never exported — only names and metadata of security materials.
  • Audit logging, structured parameter validation, sane pagination defaults and a single-file memory threshold.

Deploy it yourself

terminal / quickstarthand-in-sap-integrationsuite

Prerequisites

Node.js 20+, an SAP BTP Integration Suite tenant, and an OAuth client with the required roles.

  1. Clone, run npm install, copy .env.example and fill in the tenant URL and OAuth client identifiers.
  2. Start with SAP_ALLOW_WRITE=false and use read-only tools to inventory packages, iFlows and runtime state.
  3. Only enable write access when deployment is needed, and keep audit logs plus the MPL verification step.

This tool touches enterprise systems. Use a test tenant or least-privilege client, and never paste credentials, tenant URLs or personal data from logs into an issue.

Next projectHR Workstation — An AI workspace for HR workflows
Next step

A system to ship, or a workflow to improve?

Tell me the current state, the outcome you need and your timeline. I reply within 24–48 hours and start with whether it is worth doing — and the fastest path.