pyrfc-mcp

MCP server exposing SAP RFC-enabled function modules (BAPIs/RFCs) to AI agents through a discovery-first interface, built on SAP's pyrfc connector — plus automatic ABAP source reading (ADT when reachable, transparent RFC fallback otherwise, see docs/adt_rfc_integration_plan.md).

It is deny-by-default: discovering an RFC does not authorize calling it. Function allowlists, mutating-name deny rules, sensitive-table guards, result limits, and connection-affine transactions remain enforced at the server.

Try it without SAP

The supported demo backend uses deterministic synthetic RFC metadata and business records. It exercises the real discovery, validation, authorization, result-limiting, and MCP tool layers; only the final SAP transport is replaced.

python -m pip install pyrfc-mcp
rfc-mcp doctor --demo --connect
rfc-mcp --demo

No SAP account, PyRFC installation, or SAP NW RFC SDK is needed for demo mode. Configure an MCP client with the included .mcp.json.example to explore it immediately.

Setup

See docs/setup.md for the SAP NW RFC SDK + Python 3.11 prerequisites (required before real SAP calls work) and docs/architecture.md for the layer overview, including the read/write policy model, the generic-table-reader guard, and audit logging.

For a real system, install the proprietary SDK prerequisites, then:

uv sync --extra dev
copy .env.example .env    # fill in connection + policy settings
uv run rfc-mcp doctor     # validates config and native dependencies, no SAP call
uv run rfc-mcp doctor --connect  # explicitly performs a live SAP ping
uv run pytest             # unit tests, synthetic backend, no SAP needed
uv run mcp dev src/rfc_mcp/mcp/server.py

Real SAP connectivity additionally requires the proprietary SAP NW RFC SDK and the archived/yanked pyrfc==3.3.1 connector. Read the support warning and installation steps in docs/setup.md before running uv sync --extra sap or the smoke test.

doctor intentionally redacts connection and credential values. It does not contact SAP unless --connect is present, and it also supports --json for automation.

Tools

• search_rfc_functions(pattern, group=None, limit=50)
• get_rfc_function_interface(function_name)
• call_rfc_function(function_name, parameters, mode="read"|"write", transaction_id=None)
• commit_rfc_transaction(transaction_id, wait=False)
• rollback_rfc_transaction(transaction_id)
• read_abap_source(object_type, object_name, function_group=None) — one tool, no transport choice exposed to the caller; see docs/architecture.md.

ABAP knowledge skill

.claude/skills/sap-abap/ vendors the third-party sap-abap Claude Skill so an agent using this server also has accurate ABAP language knowledge on hand. It's licensed separately (GPL-3.0, its own LICENSE/NOTICE.md) from the rest of this project — see below.

Scope

Foundation, connection layer, discovery, execution, and MCP integration are built and tested, including a deny-by-default read/write policy, a table-level guard against the generic-table-reader injection surface (RFC_READ_TABLE et al.), fail-closed RFC response limits, and audit logging of every policy decision and call outcome. Not built: multi-tenant auth/RBAC beyond the single server-wide policy, rate limiting, metrics/tracing, and deployment packaging — see docs/architecture.md's "Out of scope" section for what’s deliberately deferred and why.

Write calls return an opaque transaction_id. Reuse it for related writes, then pass it to commit or rollback. This pins the entire SAP LUW to one RFC connection; abandoned transactions expire and roll back automatically.

Security posture

• Reads and writes are denied unless their function names match explicit allowlists. The example configuration only permits discovery, source reading, and the harmless STFC_CONNECTION smoke test.
• MCP tool annotations describe read/write risk for capable clients, but are advisory metadata—not an authorization boundary. Server policy and the SAP service account's S_RFC/table authorizations remain mandatory.
• Stdio credentials come from the environment and are never placed in MCP tool arguments. Do not expose the server over HTTP without implementing the MCP authorization specification and deployment-level rate limiting.
• RFC results are rejected rather than silently truncated when their cumulative nested table rows or serialized UTF-8 JSON size exceed RFC_MCP_RESULT_MAX_TABLE_ROWS or RFC_MCP_RESULT_MAX_SERIALIZED_BYTES. These limits protect MCP consumers; they cannot reduce work already performed inside SAP.
• See SECURITY.md for reporting and deployment guidance.

License

MIT (see LICENSE), with one carved-out exception: .claude/skills/sap-abap/ is vendored third-party content under GPL-3.0 — see its own LICENSE and NOTICE.md. Including that directory does not place the rest of the project under GPL-3.0.