SAP MCP Server: Connecting AI to S/4HANA and ECC

What is an MCP server for SAP?

An MCP server for SAP is the bridge between an AI assistant and your SAP system (S/4HANA, ECC, S/4HANA Cloud). Via the open Model Context Protocol, the server provides specifically selected SAP functions, usually OData services or CDS views, as tools. Not "everything", but exactly what you approve.

SAP is the acid test for any MCP integration: authorisation objects, client separation, document flow, value and quantity flows. A well-built MCP server respects this architecture and does not work around SAP. It calls released interfaces like any other application system would, just triggered by a language model.

MCP does not replace SAP standard processes. It puts a query layer in front of them that suits analyses, document research and information requests.

SAP API Policy 2026: What SAP Allows for AI Agents

Since 27 April 2026, SAP has prohibited, in clause 2.2.2 of its API Policy, the use of its interfaces by AI systems that plan or select API calls themselves, unless access runs through a route recognised by SAP. An AI assistant that decides via MCP which SAP tool to call falls exactly under this description.

According to SAP's accompanying FAQ, the policy applies to cloud solutions as well as the on-premise portfolio, expressly including S/4HANA Private Cloud (RISE) and all line-of-business solutions. In clause 3 of the policy, SAP reserves the right to monitor API use and to throttle, suspend or terminate it in case of violations.

SAP expressly recognises these routes for AI agents:

• MCP Gateway in SAP Integration Suite
• SAP MCP server via Joule Studio on the BTP
• Agent2Agent (A2A) via the SAP Agent Gateway

And custom MCP servers? The FAQ (question 56) allows customers and partners to run their own or third-party MCP servers if the entire use is compatible with the contract, documentation and API Policy. Responsibility for setup, operation and maintenance then lies entirely with the operator; SAP gives no support or stability commitment for it. The SAP Architecture Center describes this case as "Pattern 1" and ties it to a governance checklist (see below). SAP expressly presents its own managed MCP infrastructure as an alternative to running third-party MCP servers in production and strongly recommends using published APIs only.

What is not covered: According to the FAQ (question 40), rule-based processes that execute fixed API calls without planning by a language model are not covered by clause 2.2.2. The remaining rules of the policy apply to them, such as the requirement to use published APIs.

How users see it: The German-speaking SAP User Group (DSAG) called on 29 April 2026 for more transparency, realistic transition periods and early clarification of ongoing AI pilot projects. According to the DSAG's understanding, the policy is initially meant to apply mainly to new customers and contracts. How SAP will proceed with renewals of existing contracts was still open at that time (DSAG press release).

Three routes to SAP data in AI assistants

In practice, three variants remain that can be justified. Which one fits depends on your SAP licensing situation, your platform and how freely the AI should ask questions.

SAP data in Microsoft Copilot

Microsoft Copilot Studio can integrate custom MCP servers as tools. The connection uses Streamable HTTP, and the login options are OAuth 2.0 (for example with Entra ID on behalf of the user) or an API key (Microsoft Learn). Four points are decisive for SAP projects:

• Reachability: Copilot Studio runs in the Microsoft cloud. An MCP server in the company network is connected as a custom connector via the on-premises data gateway or a Power Platform VNet. Microsoft has no dedicated documentation for MCP over the gateway; practical reports assume a stateless server. We check this first in the pilot.
• Rights of the individual user: Copilot passes a token of the signed-in user to the MCP server. How this becomes an SAP access with exactly this user's rights is decided by the authorisation concept (see below).
• Joule and Copilot: Coupling SAP Joule with Microsoft 365 Copilot requires an SAP BTP account with SAP Cloud Identity Services (Microsoft Learn) and, according to Microsoft, does not currently extend to self-built Copilot agents (Microsoft Learn).
• Governance: In Copilot Studio, MCP tools depend on the connector's data policy. If your IT blocks the connector, all the server's tools are blocked. This approval belongs early in the plan.

Use cases: what can an SAP MCP server do in concrete terms?

We always start with read-only use cases. They deliver value quickly and are easiest to justify to IT, internal audit and SAP.

1. Order and delivery status "Where does the order from Müller GmbH stand?" The tool reads the order, delivery and billing document via the published OData services. Answer in plain language, with document numbers.
2. Analyses on demand Analytical CDS views as tools: revenue by region, top customers, ABC analysis, answered from real SAP figures instead of an Excel copy.
3. Finance and controlling information "Which open items in company code 1000 are due next week?" The tool queries only the approved fields, with the rights of the user asking.
4. Complaints and service For an incoming email, the assistant finds the order and document in SAP and suggests a reply. Your team decides.
5. Purchasing Query order status, goods receipts and supplier ratings. Authority stays with the assigned role in SAP.
6. Write scenarios, later Prepare master data or purchase orders, with an approval step by an authorised person. We only tackle this once the route, policy question and authorisations are clarified.

How we build an SAP MCP server

For custom servers we follow the governance checklist from the SAP Architecture Center and the OWASP MCP Top 10:

• Published APIs onlyTools access OData services from the SAP Business Accelerator Hub or the product documentation, not internal building blocks.
• Fixed tools instead of free queriesOne tool per use case, with fixed fields, upper limits and validated inputs. No generic "query OData".
• User rights, not a shared accountSAP requires a token exchange (RFC 8693) with agent and user context instead of a passed-through user token. No long-lived credentials in the server.
• Read firstWrite tools are not present in the read-only server at all, not merely locked.
• Limits below the SAP quotasRate limiting per user, timeouts and circuit breakers for every SAP call, so that no agent slows down the backend.
• Complete logEvery call with user, parameters, target API, status and runtime, personal values redacted. No log entry, no data.
• No SAP error texts to the modelThird-party content in the error path is an entry point for prompt injection.
• Test in the QA clientSame configuration as later in production, with a realistic data set and tests by the business department.

HANA, BTP and ABAP: where do AI agents best connect?

The same variants come up in every conversation. A brief classification:

• OData via the SAP Gateway (the standard route): Almost always the right connection point for order status, open items or master data. Documented, authorisable, versioned. For analyses, analytical CDS views or OData V4 analytical services are suitable.
• SAP BTP and Cloud Connector: The Cloud Connector is a component of BTP connectivity. If you want to work without BTP, you can reach an on-premise system instead via, for example, Azure API Management, an SAP Web Dispatcher or Microsoft's on-premises data gateway.
• HANA directly: Direct SQL access bypasses the business logic and authorisation checks of the application layer and is not a published API. We advise against it for AI agents.
• ABAP ADT MCP server: A topic for development teams (reading and writing ABAP with AI support). For business processes in a department it is the wrong connection point.

Common pitfalls from practice

SAP MCP projects rarely fail because of code. They are delayed by these points:

• Policy and licence question asked too late: Whether the chosen route fits the API Policy and your contract belongs at the start. So does the question of how SAP assesses the access of many Copilot users under licensing rules.
• Shared technical user as a shortcut: It is quick to set up, but every user then sees what the account sees, and internal audit loses the attribution of who queried what. Individual user rights are more effort and the cleaner route.
• Authorisations take longer than the technology: Basis, information security and the works council need lead time. Start this process on day one.
• Expensive calls without limits: An agent that runs the same query in a loop slows down the backend. Rate limiting and timeouts belong in from the start.
• QA client without usable data: Tests against an empty or outdated client say nothing.
• Network route underestimated: Whether gateway, VNet or API Management: involve the network team early, otherwise the finished integration waits in front of the firewall.

GDPR, hosting & security

SAP systems contain personnel master data, salary data and supplier data. Therefore:

• MCP server in your environment or in an EU region, as close as possible to SAP and your Microsoft tenant.
• No direct connection from the internet to the SAP system, but via gateway, VNet or API Management.
• Data minimisation in the tool: Each tool returns only the fields the use case needs.
• Data processing agreement with the AI provider and use of the contractually available EU data processing.
• Involve the works council early: Analyses via Copilot can be subject to co-determination.

What does it cost?

SAP MCP projects are more demanding than DATEV or Lexoffice, because authorisations, coordination and approvals come on top. We therefore proceed in steps:

• Clarify first: route, policy and licence question, authorisation concept, as a decision paper for your IT.
• Then one use case: for example the order status query, read-only.
• Then expand: Once server, login and logging are in place, further use cases cost a fraction of the entry.

We discuss concrete orders of magnitude in the AI Check, depending on your SAP variant, your use cases and your compliance requirements.

Frequently asked questions

Is a custom MCP server for SAP allowed?

According to SAP's FAQ on the API Policy, yes, if the entire use is compatible with the contract, documentation and API Policy. Responsibility lies entirely with the operator; SAP gives no support commitment. Because clause 2.2.2 restricts AI systems outside recognised routes, we recommend obtaining a written assessment from your SAP contact before building.

Do I need the SAP Integration Suite?

Not necessarily. The MCP Gateway of the Integration Suite is the route recognised by SAP. A custom MCP server following the SAP Architecture Center checklist or fixed, rule-based queries are alternatives, each with its own conditions.

Can Microsoft Copilot access SAP data?

Yes. Copilot Studio integrates MCP servers as tools, and systems in the company network via a custom connector with an on-premises data gateway or Power Platform VNet. Coupling SAP Joule with Microsoft 365 Copilot, by contrast, requires BTP.

Which SAP versions are supported?

S/4HANA (on-premise, private cloud and public cloud) and SAP ECC with OData Gateway. SAP Business One can be connected via its own interfaces. According to SAP, the SAP API Policy applies to the entire on-premise portfolio, so we clarify the specific constellation in the AI Check.

Is SAP written to, or only read?

We start with read-only use cases. Write tools only come once the route, policy question and authorisations are clarified, and then with an approval step by an authorised person.

Do we have to change SAP customising?

As a rule, no. The MCP server works via published standard interfaces, without intervening in the SAP core.

How secure is the access?

Every call is authenticated and runs with the rights of the user asking, rather than via a shared account. The server contains only fixed tools, limits calls and logs every access. SAP error texts do not reach the model.

Which AI models work with SAP MCP?

All MCP-capable assistants, such as Microsoft Copilot Studio, Anthropic Claude, OpenAI or Google Gemini. The server stays the same when you switch models.

How long does an SAP MCP project take?

The timeline depends mainly on clarifying the route and policy question, on the authorisations and on the network route. We set the timeline after the AI Check. Follow-on use cases go considerably faster.

What about S/4HANA Cloud Public Edition?

The API Policy applies there too. Inbound access runs through released APIs and the configuration provided by SAP. Ideally, the MCP server runs in the same cloud region.

Can the MCP server run on SAP BTP?

Yes. If you use BTP, you should also look at the MCP Gateway of the Integration Suite and the MCP servers from Joule Studio, because SAP expressly recognises these routes.

What distinguishes an MCP server from SAP Joule?

Joule is SAP's assistant within the SAP world. An MCP server connects SAP with the assistant your team already uses, such as Microsoft Copilot, and with other systems. The two can complement each other.