claude-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claude-code (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for SAP ABAP — offline static analysis, ABAP Cloud readiness, and RAP scaffolding. No SAP system. No credentials. Works on ABAP source wherever your AI agent works: a git checkout, an abapGit export, a code review, CI.
Built on abaplint (the open-source ABAP parser/linter) and the Model Context Protocol. TypeScript, 100% local — the server makes zero network calls and reads no user files: sources go in as text, findings come back as structured JSON. (The released-API list and abaplint's rule data are package-bundled assets that ship inside the install — no network, no user filesystem, at runtime.)
Every other ABAP MCP server is either a bridge to a live SAP system (ADT/RFC — needs credentials, a system, and trust) or a documentation search. But AI coding agents spend most of their time where the files are — editing abapGit repos, reviewing diffs, generating code — long before anything reaches a system. This server gives agents the missing feedback loop at that layer:
lint_abap (+ focus packs)check_cloud_readiness (A–D)compare_abapcheck_released_apiscaffold_rap_boget_abap_outline (+ Mermaid)# Claude Code
claude mcp add abap-mcp -- npx -y abap-mcp
# or any MCP client (.mcp.json / mcp.json):
{
"mcpServers": {
"abap-mcp": { "command": "npx", "args": ["-y", "abap-mcp"] }
}
}From a clone instead:
npm install && npm run build
claude mcp add abap-mcp -- node /path/to/abap-mcp/dist/cli.jsThen ask your agent things like "lint this class against ABAP Cloud", "is zold_report cloud-ready?", or "scaffold a RAP BO for entity Booking on table zbooking, draft enabled".
Every tool is also a subcommand, so it works in terminals and CI where no MCP client exists:
npx abap-mcp lint src/ # lint files or whole directories
npx abap-mcp lint src/ --focus Performance # themed pass: Performance | Security | Styleguide
npx abap-mcp lint src/ --rules-file org.json # your org's abaplint rule pack, same engine
npx abap-mcp readiness src/ --fail-below 80 # repo-level ABAP Cloud readiness, scored + graded A–D
npx abap-mcp compare old/ new/ # rework verdict: findings resolved/introduced, grade movement
npx abap-mcp scaffold --entity Travel --table ztravel --key travel_id --out ./out
npx abap-mcp outline src/zcl_monster.clas.abap # navigate big objects (--mermaid for a diagram)
npx abap-mcp released MARA I_Product # released-API status + CDS successor
npx abap-mcp explain exit_or_check # rule rationaleDirectories are walked recursively (abapGit naming), batched automatically, and readiness merges batches into one scored, categorized repo report. Exit codes are CI-friendly (1 on error findings / failed threshold).
[docs/COOKBOOK.md](docs/COOKBOOK.md) — practical recipes: the fix-until-clean loop, PR review without a transport, whole-repo migration triage, CI gates, per-persona use cases. [examples/claude-code/](examples/claude-code/) — drop-in agentic workflows: an abap-code-reviewer subagent, an abap-cloud-migrator sweep loop (readiness score as the loop condition), per-repo .mcp.json, and a GitHub Actions quality gate for abapGit repos.
| Tool | What it does |
|---|---|
lint_abap | abaplint static analysis over ABAP/CDS/BDEF sources → structured findings with rule docs links. Presets: style (default, snippet-friendly), full, syntax-only; per-rule overrides for org rule packs; focus lens (Performance / Security / Styleguide) for themed reviews. |
check_cloud_readiness | Dual-parse diff (classic baseline vs Cloud): statements that are valid today but illegal in ABAP Cloud become categorized blockers (dynpro, list output, native SQL, …) with a transparent score and a density-banded A–D tech-debt grade; code broken at the baseline is reported separately, not counted as migration work. Also surfaces a separate, dated released-API cross-check (releasedApiFindings): direct access to non-released classic tables and deprecated-API usage found in the source, with CDS successor hints — informational, not folded into the score. |
compare_abap | Before/after verdict on a rework: lint findings resolved vs introduced (matched by content, so moved code isn't noise), blocker/score/grade movement, and classes/methods/FORMs added or removed. The objective referee for refactors and AI rewrites. |
check_released_api | Looks up objects (tables, CDS views, function modules, classes, …) in SAP's bundled Cloudification snapshot → released / deprecated / not-released per object, plus a curated CDS successor for common classic tables. The released-API half of readiness, offline. |
scaffold_rap_bo | Generates the canonical RAP managed-BO stack (root view, behavior definition strict(2) + optional draft, behavior class + handler locals, projection, metadata extension, OData V4 service definition) plus suggested table DDL, activation order and next steps. |
list_abap_rules | Browse abaplint's ~180 rules (filter by text or tag). |
explain_abap_rule | One rule in depth — rationale (often Clean ABAP), examples, docs URL. |
format_abap | Offline pretty-printer (keyword case + indentation). |
get_abap_outline | Classes/methods/visibility/interfaces/FORMs of a source — navigate big objects without reading them whole. Optional Mermaid classDiagram output for instant structure visuals. |
removed. Released-API coverage is now partial and offline: check_released_api and the releasedApiFindings in readiness reflect SAP's published Cloudification list as of the bundled snapshot date — they cover tables and function modules referenced in your source, not every API, and are only as current as the snapshot. A target system's own released-API list (ATC check API_RELEASE_STATE_CHECK / SAP_CP_READINESS) remains authoritative; treat an "absent from the list" result as "not released as of the snapshot", not as proof.
abaplint at Cloud level before they're returned (the generator and the linter share one parser). Behavior/service definitions are outside abaplint's checked surface — they are golden-tested canonical templates, and ADT activation is the final arbiter. Each generated file is labeled validated: "abaplint" | "template".
surface is a parser over strings you explicitly pass. (The released-API snapshot and abaplint's rule data are package-bundled assets imported from the install, not fetched or read from your disk.) For linting whole directories, use the abaplint CLI in CI, or the mcp-kit wrap-abaplint recipe this server grew out of.
npm install
npm run check # typecheck + 149 tests + build — the CI gate
node dist/cli.js # stdio MCP server
npx @modelcontextprotocol/inspector --cli node dist/cli.js --method tools/listTool descriptions are CI-graded (a rubric test enforces verb-first names, when-to-use, non-goals, described params, worked examples — the mcp-kit discipline; the full mcp-kit lint scores all nine tools 100/100).
The decision log — why offline, why abaplint, why a dual-parse readiness diff, why the scaffolder validates its own output, what was deliberately left out — lives in docs/DESIGN.md.
underneath every tool here (MIT).
Cloudification Repository (object release list), Apache-2.0. The bundled released-API snapshot (src/data/released-apis.json, snapshot 2026-06-10) is a compact transform of that data, redistributed under Apache-2.0 with attribution; see docs/DESIGN.md and scripts/build-released-api-index.mjs for the pipeline.
follows (typed tool specs, transport discipline, description lint).
MIT © Akshay Palimkar. Not affiliated with or endorsed by SAP SE. "SAP", "ABAP" and "RAP" are trademarks of SAP SE; this is an independent open-source tool for developers working with them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.