abap2UI5 MCP Server

What the code does

We read the source, 5 d ago · rules 995398eba69f

A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.

          fs.writeFileSync(file, args.xml || args.abap_source);

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

    const srv = spawn(cmd, args, {

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    const file = path.join(dir, fileName);

  const child = spawn(process.execPath, [WORKER], {

   * npm reads a project .npmrc from the directory it runs in, and the

      entries = fs.readdirSync(dir, { withFileTypes: true });

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add mcp-server -- npx -y @abap2ui5/mcp-server

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@abap2ui5/mcp-server"
      ]
    }
  }
}

[mcp_servers.mcp-server]
command = "npx"
args = ["-y", "@abap2ui5/mcp-server"]

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@abap2ui5/mcp-server"
      ]
    }
  }
}

{
  "servers": {
    "mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@abap2ui5/mcp-server"
      ]
    }
  }
}

Optional settings from the registry entry, left out of the block above: AI_VIEW_CHECK_HOME (Checkout or install of @abap2ui5/linter (validate_view, fix_view, screenshot_view). Default: the peer npm installs beside the server. A set value is authoritative), A2UI5_HOME (abap2UI5 framework checkout (app_guide, api_reference, pitfalls; backend when present). Default: ../abap2UI5, else the GitHub mirror and the npm runtime), SAMPLES_CONTROLS_HOME (samples-controls checkout (capabilities, examples, generation_rules, scope_of, UI5 for screenshots). Default: ../samples-controls, else the GitHub mirror), SAMPLES_HOME (abap2UI5/samples checkout, one of the catalogues examples searches. Default: ../samples, else the GitHub mirror), SAMPLES_STACK_HOME (abap2UI5/samples-stack checkout (OData, RAP, APC, launchpad samples). Default: ../samples-stack, else the GitHub mirror), APP_TEMPLATE_HOME (abap2UI5/app-template checkout that scaffold_app serves and add_agent_setup executes. Default: ../app-template, else the GitHub mirror), DOCS_HOME (abap2UI5/docs checkout that docs_search reads. Default: ../docs, else the GitHub mirror), ABAP_CLOUD_GUI_HOME (abap2UI5-addons/abap-cloud-gui checkout (with npm ci done) whose report2cloud converter migrate_report runs. Default: ../abap-cloud-gui; no mirror), POPUPS_HOME (abap2UI5-addons/popups checkout whose popups migrate_report with deploy: true writes into the dev sandbox beside the converted class. Default: .deps/popups of the abap-cloud-gui checkout, ../popups beside it, then its build/popups), OPENUI5_SRC (OpenUI5 source checkout scope_of reads the JSDoc from (via samples-controls). Default: ../fork-openui5 next to samples-controls), A2UI5_MCP_WORKSPACE (Where the npm backend installs, the dev sandbox lives and a framework clone lands. Default: ~/.abap2ui5-mcp), A2UI5_MCP_BACKEND (Which backend runs the apps: npm (the @abap2ui5/node-runtime package, even beside a checkout) or clone (clone the framework). Default: decided per call), A2UI5_MCP_RUNTIME_VERSION (Pin the @abap2ui5/node-runtime release (X.Y.Z) the npm backend installs. Default: the registry's latest), A2UI5_MCP_PORT (Port of the local backend run_app boots against. Default: 3000), A2UI5_MCP_UI (Whether app_start/app_describe/app_act declare their MCP Apps screen (ui://abap2ui5/app-screen): auto (default - when the client advertises the io.modelcontextprotocol/ui extension), on, off), A2UI5_MCP_APP_FORMAT (The default answer format of the app tools: snapshot (default) or adaptive-card (the snapshot plus an Adaptive Card 1.5 as an embedded resource, for card-rendering hosts)), A2UI5_MCP_OFFLINE (Set to 1 for no network: no UI5 CDN fallback, no GitHub mirror, no registry lookup), A2UI5_MCP_REMOTE (Set to 0 to switch off the read-only GitHub mirror used when no checkout is found), A2UI5_MCP_REMOTE_DIR (Cache directory of the GitHub mirror. Default: <tmp>/abap2ui5-mcp-remote), A2UI5_MCP_REMOTE_TTL_MS (How long a mirrored copy is used before it is refreshed, in milliseconds. Default: one day), A2UI5_MCP_UI5_CACHE_MB (How many MB of UI5 answers from the CDN (sdk.openui5.org) run_app and interact_app keep in memory across calls, so a second boot does not download them again. 0 switches the cache off. Default: 64), A2UI5_MCP_RENDER_PAGES (Pages (Chromium tabs) of validate_view's warm render gate, which concurrent calls queue on. Default: 2 (1 to 8)), A2UI5_MCP_CHROMIUM (Chromium binary for run_app and interact_app. Default: CHROMIUM_BIN, Playwright's managed browser, then a system chromium), A2UI5_MCP_SCREENSHOT_DIR (Where run_app and interact_app write their PNGs (the newest 50 are kept) and build_backend its log. Default: <tmp>/abap2ui5-mcp-screenshots), A2UI5_MCP_PREBUILT_URL (Where build_backend mode prebuilt downloads the backend from. Default: the framework's release asset), A2UI5_MCP_LINT_WORKER (Set to 0 to run every lint as a fresh abaplint process. Default: a long-lived worker keeps @abaplint/core with the framework parsed and lints a deploy in milliseconds (the CLI runs whenever the worker cannot stand in for it)), A2UI5_MCP_LINT_IDLE_MS (How long the warm lint worker (about 300 MB with the framework parsed) is kept without a request before it exits, in milliseconds; the next lint starts a fresh one. 0 keeps it for the server's life. Default: 10 minutes), A2UI5_MCP_LINT_TIMEOUT_MS (Hard timeout of the abaplint run, in milliseconds. Default: 5 minutes), A2UI5_MCP_SCOPE_TIMEOUT_MS (Hard timeout of scope_of, in milliseconds. Default: 5 minutes), A2UI5_MCP_BUILD_TIMEOUT_MS (Hard timeout of a build, the prebuilt download and the npm install, in milliseconds. Default: 30 minutes), A2UI5_MCP_UNIT_TIMEOUT_MS (Hard timeout of the ABAP Unit runner, in milliseconds. Default: 10 minutes), A2UI5_MCP_SYSTEM_URL (Switches on the SYSTEM MODE: the app tools against this real SAP system instead of the sandbox loop. The launch URL, e.g. https://host:44300/sap/bc/z2ui5?app_start={class}&sap-client=100), A2UI5_MCP_SYSTEM_USER (System mode: the SAP user the app tools log on with (Basic authentication)), A2UI5_MCP_SYSTEM_PASSWORD (System mode: the password of A2UI5_MCP_SYSTEM_USER. Or A2UI5_MCP_SYSTEM_PASSWORD_CMD, to keep it out of the configuration), A2UI5_MCP_SYSTEM_PASSWORD_CMD (System mode: a shell command that prints the password (a keychain lookup) - instead of A2UI5_MCP_SYSTEM_PASSWORD), A2UI5_MCP_SYSTEM_INSECURE_TLS (System mode: set to 1 to accept a certificate that cannot be verified. NODE_EXTRA_CA_CERTS with the CA is the better fix), GITHUB_TOKEN (Optional token sent to api.github.com only, to raise the rate limit of the docs tree listing (GH_TOKEN is read too)).