SAP GUI MCP server: what GUI scripting means for AI agents

What is an SAP GUI MCP server?

An SAP GUI MCP server lets an AI assistant operate SAP GUI for Windows like a person: call a transaction, fill in fields, press keys, read tables off the screen. Technically, it uses the SAP GUI Scripting API for this, the same automation interface that macros, testing tools and many RPA bots have used for years. The only new thing is who chooses the steps: not a fixed script, but a language model.

That makes such servers attractive. They need no OData service, no BAPI tailoring and no gateway rework, just a signed-in SAP GUI session. But that is exactly where the problems lie: legally under the SAP API Policy, and technically in security, stability and traceability. This page assesses both and shows when better paths exist. For an overview of SAP and MCP, see the guide to MCP servers for SAP.

How does SAP GUI scripting work technically?

SAP GUI Scripting is an automation interface of SAP GUI for Windows through which a program on the workstation can read and operate every screen element of a running SAP session. SAP describes the purpose as follows: end users can automate recurring tasks with macro-like scripts, and administrators and developers can build tools for application testing or client-side integration (SAP GUI Scripting Security Guide). Besides SAP GUI for Windows, the API reference also names SAP GUI for Java, though with a smaller range of functions (SAP GUI Scripting API).

An SAP GUI MCP server therefore runs on a Windows machine with SAP GUI installed. It attaches to an open session via COM and provides the AI assistant with tools such as “start transaction”, “set field”, “press key” or “read table”. The language model decides in which order it uses these tools.

One sentence from the Security Guide is decisive for everything that follows:

To the SAP system, an AI agent in the GUI therefore looks like the signed-in person. It has that person’s permissions, and the system cannot distinguish what the person did from what the agent did.

Which SAP GUI MCP servers exist as community projects?

On GitHub there are several open-source SAP GUI MCP servers, none of them from SAP. We checked two directly in their repositories on 28 October 2026:

Listing a project is not an endorsement. Both projects are tools by individual developers without vendor support. A positive point of the first project is that it ships its own safeguards and states openly in its documentation that the agent appears in the system as ordinary user activity. Before any use, a third-party MCP server needs a security review, such as we describe in the guide MCP server: security and GDPR.

Is SAP GUI Scripting a “Published API” under the SAP API Policy?

SAP GUI Scripting is an automation interface of the SAP GUI documented by SAP, but not a business API in the SAP Business Accelerator Hub. For AI agents, however, it is not this classification that decides, but section 2.2.2 of the Policy: when a language model controls the GUI, an AI system plans and selects the sequence of calls. SAP prohibits exactly that outside recognised paths.

In detail, as an assessment and not legal advice:

• Sections 1.1 and 1.2: Published APIs are interfaces from the Business Accelerator Hub or those identified in the product-specific documentation, for the purpose described there (“Documented Use”). Under section 1.2, customer and third-party applications may not use other interfaces. The Scripting API is documented, and its described purpose is macros, tests and client-side integration. Whether SAP regards control by a language model as “Documented Use” is not expressly answered by the Policy or the FAQ. Section 2.2.1 (b) excludes scenarios outside the documented purpose without SAP’s consent.
• Section 2.2.2: The restriction affects “(semi-) autonomous or generative AI systems that plan, select, or execute sequences of API calls”. An LLM that decides which transaction to open and which field to fill does exactly that. The FAQ names no recognised path for AI agents via the GUI. Recognised are the MCP Gateway of the Integration Suite, SAP MCP servers via Joule Studio, and A2A via the Agent Gateway (question 35).
• Section 3: Customers may not circumvent the Policy’s controls, not even via intermediary services, custom code, proxies, gateways or “impersonation techniques”. If an agent is indistinguishable from a person to the SAP system, it is reasonable to ask whether this would be treated as such a technique.

Our reading: however one classifies the Scripting API, an SAP GUI MCP server in which a language model chooses the steps falls under section 2.2.2. According to the FAQ, the Policy applies to the entire on-premise portfolio, including ECC and older releases (question 1). The detailed assessment of the Policy is in the section SAP API Policy 2026 of our SAP guide.

What applies to deterministic RPA under question 40 of the SAP FAQ?

According to the SAP FAQ, rule-based RPA that works through fixed, predefined call sequences without AI planning does not fall under section 2.2.2. That is the decisive difference from the SAP GUI MCP server: there, a language model plans; in classic RPA, it does not.

Three points are worth reading closely:

1. The exception depends on the process, not the tool. What matters are “pre-defined, deterministic” sequences without an LLM decision. An RPA product whose bot is controlled by a language model does not fall under the exception just because it is called “RPA”.
2. The question refers to RPA tools that call SAP APIs. Whether SAP also means bots that work through the GUI is not expressly stated in the FAQ. For GUI-based bots, the rest of the Policy applies in any case, including the question of the documented purpose.
3. The rest of the Policy still applies. Even a deterministic bot must not overload the system (section 2.2.1 c) or engage in systematic mass extraction (section 2.2.2 b).

Drawing the line in practice:

• Outside 2.2.2A recorded script enters the same incoming invoices in the same screen every morning. No language model decides on the steps.
• Under 2.2.2A language model is given the task “Find out why order 4711 is stuck” and clicks its way through VA03, VL03N and status messages on its own.
• Borderline case, clarify in advanceA language model reads a customer email and returns fields; a fixed bot enters them into a fixed screen. The sequence is fixed, but the inputs come from the AI.
• Under 2.2.2An AI agent uses a tool call to choose which of several stored scripts to start. The model then makes the choice of sequence.

For borderline cases, the same applies as for any custom AI access to SAP: describe the process concretely and obtain a written assessment from your SAP contact.

What technical risks does an SAP GUI MCP server carry?

The biggest technical risks are the agent’s full user permissions, the lack of distinguishability in the audit log, fragile screen logic, and screen content as an entry point for prompt injection. On top of that, scripting is deliberately switched off on many systems.

Scripting must be enabled on the server side. According to SAP, GUI scripting is disabled by default on every SAP system. An administrator enables it with the profile parameter sapgui/user_scripting = TRUE on the application server, on newer releases dynamically via transaction RZ11 rather than via the profile file and a restart. SAP expressly points out that scripting can also be prevented entirely on a system, to protect business-critical data from modification or download. In addition, scripting must be permitted on the client, where administrators can block it via the registry (SAP GUI Scripting Security Guide).

Finer switches exist. SAP documents further parameters that only take effect when sapgui/user_scripting is active:

• sapgui/user_scripting_per_user: scripting only for users with the authorization object S_SCR (activity 16).
• sapgui/user_scripting_set_readonly: read-only access, no call that changes the data stream sent to the server.
• sapgui/user_scripting_disable_recording: no recording of new scripts; playback remains possible.

Full permissions of the signed-in user. According to SAP, a script has the same rights as the person who starts it. If the agent runs in the session of a clerk with broad roles, it can do everything she can. SAP also warns that a faulty script runs faster than a person, possibly unattended, and can therefore generate more incorrect data before anyone notices the error. With a language model that chooses its own steps, this weighs more heavily than with a tested script.

Traceability. Because the system does not distinguish between script and person, change documents and logs show the user, not the agent. Anyone who has to prove what the AI did needs their own complete audit log in the MCP server and a clear rule on when the agent may work in a session.

Sessions and infrastructure. The server needs a Windows machine with SAP GUI and a signed-in session. For several users, that means several sessions, locked objects with parallel access, and credentials involved somewhere. SAP expressly advises against writing login credentials into scripts.

Stability. Screen logic breaks with release changes, modified screens, new pop-ups, a different login language or personalisation. A language model can compensate for some deviations, but not predictably, and in an ERP that is exactly the problem.

Prompt injection via screen content. Everything the agent reads from the screen ends up in the model: long texts, remarks fields, vendor names. Anyone who places instructions there tries to redirect the agent, with the user’s permissions. How to protect against this is described in the guide on prompt injection and AI security.

When can an SAP GUI MCP server still make sense?

An SAP GUI MCP server can make sense where no production data is affected, where a person approves every step, or where there is simply no other interface. Even then the SAP API Policy applies, so the question should be clarified beforehand.

• Test and training systemsExploring a process, preparing test cases, documenting screens. With anonymised data and a user with narrow roles.
• Legacy systems without an interfaceWhere a process exists only in a Z transaction and no OData service or BAPI is in sight, for analysis and as a bridge until a clean interface exists. The Policy applies there too.
• With human approvalThe agent proposes, the person sees values and screen and confirms every write step. This lowers the risk of errors but changes nothing about the policy question.
• Read-onlyWith sapgui/user_scripting_set_readonly and authorizations without change rights, for example for an analysis that a person accompanies.

For production agents that are meant to work regularly and for many users, we advise against GUI scripting.

What alternatives to GUI scripting are there?

The better alternatives are an MCP server with fixed tools on OData services or BAPIs, deterministic RPA without AI planning, and the MCP Gateway of the SAP Integration Suite as a path recognised by SAP. Which one fits depends on your system and on how freely the AI is to work.

OData and BAPI as tools. On ECC, this means: SAP Gateway with standard or custom OData services and BAPIs via RFC, each assigned to one tool. What this looks like on ECC 6.0, with a table of interfaces and architecture paths with and without BTP, is covered in the guide SAP ECC MCP server.

Deterministic RPA. For uniform bulk processes, a classic bot with a fixed sequence is often the more robust solution. The language model can sit upstream, for example to read documents, and downstream, to summarise results. The sequence of SAP steps stays fixed.

MCP Gateway of the Integration Suite. Anyone using BTP gets, with the MCP Gateway, the path that SAP expressly recognises for AI agents. For a comparison of how other ERP systems regulate AI access, see MCP servers for ERP systems.

Checklist before you test an SAP GUI MCP server

If you want to try out an SAP GUI MCP server, do so with these guardrails:

1. Only on a development or test system with anonymised data, never in production.
2. A dedicated user with narrow roles, scripting enabled only for that user via sapgui/user_scripting_per_user and S_SCR, read-only via sapgui/user_scripting_set_readonly where that is enough.
3. Involve the Basis team and information security before any parameter is changed.
4. Review the server itself: origin, licence, dependencies, transport (local rather than network), blocked transactions, audit log.
5. Confirmation before every write step by the person in front of the screen.
6. Document the policy question: What should the agent do, why via the GUI, which alternative was examined. This note is the basis for the conversation with your SAP contact.

Frequently asked questions

What is an SAP GUI MCP server?

An MCP server that lets an AI assistant operate SAP GUI for Windows through the SAP GUI Scripting API: start transactions, fill in fields, read tables off the screen. The language model itself decides which steps to carry out and in which order.

Is an SAP GUI MCP server compatible with the SAP API Policy?

In our assessment, an SAP GUI MCP server in which a language model chooses the steps falls under section 2.2.2 of the Policy, which restricts AI systems that plan or select call sequences to paths recognised by SAP. The SAP FAQ names no recognised path via the GUI. This is an assessment, not legal advice.

Is SAP GUI Scripting a Published API?

SAP GUI Scripting is an automation interface documented by SAP for macros, tests and client-side integration, but not a business API in the SAP Business Accelerator Hub. Whether SAP regards control by a language model as a documented purpose is not expressly answered by the Policy or the FAQ.

Is classic RPA on SAP still allowed?

According to the SAP FAQ, question 40, rule-based RPA tools with fixed, deterministic call sequences and no AI planning do not fall under section 2.2.2. The other rules of the Policy continue to apply, for example on system load and mass extraction.

How is SAP GUI Scripting enabled?

According to SAP, scripting is off by default on every system. An administrator sets the profile parameter sapgui/user_scripting to TRUE, on newer releases dynamically via RZ11. In addition, scripting must be permitted on the client. Finer parameters restrict it to users with the authorization object S_SCR or to read-only access.

Can SAP tell whether a person or an AI agent is working?

No. SAP states in the Security Guide that the system sees no difference between a script and a user. The agent has the signed-in user’s permissions, and logs show only that user. Traceability therefore requires a dedicated audit log in the MCP server.

When does an SAP GUI MCP server make sense?

Most likely on test and training systems, for analyses with human approval of every step, or as a bridge for legacy systems without an interface. Even then the SAP API Policy applies. For production agents, we recommend fixed tools on OData or BAPI.

Which alternative to GUI scripting do you recommend?

An MCP server with fixed tools on OData services or BAPIs, with the permissions of the user asking and an audit log per call. Anyone using SAP BTP has, with the MCP Gateway of the Integration Suite, the path recognised by SAP. For uniform bulk processes, deterministic RPA remains an option.

Which open-source SAP GUI MCP servers exist?

As of 28 October 2026, for example kts982/mcp-sap-gui (MIT licence, version 0.5.4) and jduncan8142/sap_gui_mcp (MIT licence, last change December 2025). Both come from individuals, not from SAP. Listing them is not an endorsement; before use, every third-party MCP server needs a security review.