ABAPilot connects any AI assistant to your SAP system through MCP – with an endpoint whitelist, a full audit log and SAP authorizations always having the final say. Built for legacy ECC too, and for business users, not only developers.
Open-source connector: npx -y abapilot
A pure ABAP add-on in the /ABAPILOT/ namespace, exposed through a single SICF node. No middleware servers to run inside your landscape.
If identity, credentials or whitelist can't be verified, the call is denied. No silent fallbacks.
X.509 client certificates mapped via CERTRULE remove stored SAP passwords entirely; or keep secrets in Azure Key Vault.
Use Copilot, Claude, GPT or a fully local model via Ollama – your data path stays under your control.
Designed for auditors and Basis teams first.
Only the functions you enable in /ABAPILOT/CONFIG are callable. Everything else is blocked.
Every call – who, what, when, result – recorded in /ABAPILOT/AUDIT inside SAP.
Standard SAP authorizations are enforced on every request. The AI never gets more than the user's role allows.
Installed as a regular transport with one SICF service. Easy to review, easy to remove.
Ask questions about users, roles, changes and controls, with evidence traced to the audit log.
Find duplicates, gaps and inconsistencies in master data in plain language.
Let finance, purchasing or sales teams query SAP from Teams or Copilot – no SAP GUI needed.
Explain short dumps, find root causes and suggest fixes in seconds.
Read code, tables and objects from your AI coding assistant, governed like every other call.
ABAPilot runs on classic SAP ECC as well as S/4HANA on-premise – no ADT or cloud prerequisites. It complements SAP's official ADT-based MCP server: theirs targets development on modern releases; ABAPilot adds governed access for business users and legacy systems.
Per SAP system, annual licence. The MCP connector is open source (MIT); the ABAP backend is licensed. Proofs of concept available.
Contact usNo. It runs on SAP ECC and S/4HANA on-premise.
A pure ABAP add-on in the /ABAPILOT/ namespace and one SICF node, delivered as a standard transport.
Only whitelisted endpoints are callable, and standard SAP authorization checks apply to every call. Everything is logged in /ABAPILOT/AUDIT.
Any MCP-capable client: Microsoft Teams, M365 Copilot, Copilot Studio, desktop assistants, and local models via Ollama.
Users sign in with Entra ID SSO. The connection to SAP uses credentials from Azure Key Vault or X.509 certificates (CERTRULE), failing closed if anything can't be verified.
The connector (npx -y abapilot) is MIT-licensed. The SAP backend is licensed per system.