Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Coaspe/sap-abap-mcp --skill sap-abap-setupgit clone --depth 1 https://github.com/Coaspe/sap-abap-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/coaspe/sap-abap-mcp/sap-abap-setup)<a href="https://agentmods.dev/skills/coaspe/sap-abap-mcp/sap-abap-setup"><img src="https://agentmods.dev/badge/skills/coaspe/sap-abap-mcp/sap-abap-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/coaspe/sap-abap-mcp/sap-abap-setup"><img src="https://agentmods.dev/badge/skills/coaspe/sap-abap-mcp/sap-abap-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.01094 |
| Opus 5 | $0.00024 | $0.00547 |
| Sonnet 5 | $0.00010 | $0.00219 |
| Haiku 4.5 | $0.00005 | $0.00109 |
Grade A, and why
sap-abap-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SAP ABAP MCP setup
-
Detect Windows, macOS, or Linux. Use
npx.cmdon Windows andnpxon macOS or Linux. -
Tell the user to run this one-line command in a trusted terminal:
<npx> @coaspe/sap-abap-mcp@latest setup -
Explain that the wizard can create a new server or update an existing one. It labels the local connection alias as
Server nameand the endpoint asSAP URL. The Server name becomes theconnectionIdused by SAP tools. -
When the user asks to change or delete a saved server, direct them to the matching local command. The Server name may be omitted to choose from a list:
<npx> @coaspe/sap-abap-mcp@latest setup edit [<server-name>] <npx> @coaspe/sap-abap-mcp@latest setup remove [<server-name>] -
Explain that edit keeps the Server name fixed. Windows and macOS verify SAP before saving; Linux verifies when the matching password environment variable is available and otherwise prints the authentication steps again. Remove shows the selected server, defaults to
No, and deletes the saved SAP and abapGit credentials only after confirmation. -
Never ask for a password or token in chat, append it to the command, or proxy the hidden prompt. The user must enter it only at the wizard's local
SAP password:prompt. -
Wait for the user to confirm that the wizard finished. Then run
<npx> --yes --prefer-online @coaspe/sap-abap-mcp@latest profile list, and have the user select the exact Server name if more than one exists. Never infer or silently switch servers.
Windows and macOS
The wizard collects non-secret settings, shows a summary, requests the password through a hidden terminal prompt, verifies the SAP URL and credentials, and only then saves the server. Windows stores the password with DPAPI and macOS stores it in Keychain.
Authenticate on Linux
Linux reads SAP_ABAP_MCP_PASSWORD_<NORMALIZED_SERVER_NAME> and does not persist the password. The wizard saves only non-secret settings and prints the exact variable name, hidden input command, export command, and doctor command. For example, Server name DEV-100 uses SAP_ABAP_MCP_PASSWORD_DEV_100.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 62 lines · 48 tokens per session scan A d69fbf9a376d
sap-abap-setup is a skill published in the GitHub repository Coaspe/sap-abap-mcp (4 stars, last pushed 4d ago), licensed MIT. It adds 48 tokens to every session and 1,094 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
abap-clean-core
Apply SAP Clean Core extensibility principles whenever the user writes, reviews, refactors, or designs ABAP code for SAP S/4HANA — any deployment (Public Cloud, Private Cloud, on-premise). Use this skill any time the conversation involves ABAP extensions, custom Z-code, BAdIs, BAPIs, user exits, CDS views, RAP…
background-script-execution
What actually happens when you call snowexecutescript — the Scripted REST endpoint Serac auto-deploys on first use, the scheduled-job fallback, what scheduledjobpending means, and how to get output back when the call comes home empty.
csdm-modeling
Pick the right ServiceNow service class under the Common Service Data Model — business service, service offering, application service, business application — and point the CMDB tools at it without creating the records CSDM tells customers to migrate away from.
inbound-email
Handle email arriving at a ServiceNow instance — inbound email action ordering and stop-processing, the real syseventinemailaction column names, and reading sysemail when a message created no record.
mcp-tool-discovery
Find and call tools on this ServiceNow MCP server — the two meta-tools it starts with, why a missing session id makes every other tool unreachable, which queries actually match, and which advertised tools are not on the server at all.
cmdb-patterns
Create ServiceNow CIs and cmdbrelci relationships, walk upstream/downstream impact, detect orphan/stale CIs, and align discovered CIs with the proper sysclassname hierarchy.