SAP HANA MCP server: connect AI to HANA cleanly

What is an SAP HANA MCP server?

An SAP HANA MCP server is a program that provides an AI assistant, via the Model Context Protocol, with tools for queries on an SAP HANA database. The assistant picks a tool, the server runs the query and returns the result.

Most freely available HANA MCP servers work at the SQL level: they sign in with a database user, let the model explore tables and run SQL. For developers, that is convenient. For business data under S/4HANA, it is the riskiest path, for technical, licensing and contractual reasons. For a standalone HANA Cloud database holding your own data, on the other hand, a well-built server can make sense.

SAP HANA or SAP HANA Cloud: what is the difference?

SAP HANA is the database that S/4HANA runs on. SAP HANA Cloud is a standalone database service on the SAP Business Technology Platform (BTP), managed by SAP.

The tie between S/4HANA and HANA is set by contract: under the SAP Software Use Rights, S/4HANA packages may only be run on an SAP HANA database (SAP Software Use Rights v.4-2026, section 2.1). In this case, tables, data model and authorizations belong to the S/4HANA application, and the database is its storage.

SAP describes SAP HANA Cloud as a cloud-native database service that forms the basis of database management on the SAP BTP (SAP Help: Data Persistence Using SAP HANA Cloud). As a managed service, it needs little administration according to SAP (SAP Help: Administration Guide). Here you create schemas, tables and views yourself, for example for your own applications on the BTP or as an analytics database.

Why does direct SQL access bypass the application layer?

Because S/4HANA checks business users’ permissions, client separation and business logic in the application server and not in the database. Anyone who reads via SQL bypassing the application gets raw data without these checks.

For an AI agent with SQL access, this means in concrete terms:

• No business authorizations: Roles and authorization objects, for example for company code or sales organisation, do not apply. The technical user sees whatever the database allows it to see, and that is often a great deal.
• No link to the individual: The database only sees the MCP server’s technical user. Who on the team asked which question appears only in the server’s own log, if it writes one.
• No business logic: Status, document flow, currency conversion and the client field must be rebuilt correctly in every query. A model that formulates SQL itself can produce wrong figures that look plausible.
• No stable interface: Tables are not a published API. On unpublished interfaces, SAP writes that they may change or be discontinued without notice (SAP API Policy, section 1.2).
• Load on the production system: A poorly chosen query on large tables hits the system your daily business runs on.
• Prompt injection: If the model reads text from fields such as remarks or short texts, those fields can contain instructions that steer the next query. More on this in the guide Prompt injection and AI security.

Does your HANA licence allow direct access by an AI tool?

With a runtime licence, the wording of SAP’s terms of use argues against it. Only your contract with SAP can settle this authoritatively, which is why the question belongs before the first line of code.

SAP governs usage rights in the SAP Software Use Rights. The current English version (v.4-2026) distinguishes between a runtime database, which may only be used together with certain SAP applications, and a full-use licence. For the SAP HANA enterprise edition, it states that it may be used with an unlimited number of licensed data sources (section 19.2.1).

For the widespread runtime variant “SAP HANA, runtime edition for applications and SAP BW” (HANA REAB), the 2026 version is even clearer (section 19.15.4): HANA Studio, Cockpit, Web IDE and Business Application Studio may only be used to administer, monitor and create your own views. Analyses must run through the supported SAP software or through such views, and according to the text, SAP BI tools may access those views.

A self-built or third-party MCP server is neither an SAP BI tool nor part of the licensed SAP application. Going by the wording, SQL access by it to a runtime database is therefore not covered. Notably, the 2021 version still allowed, at the same place, access to your own views by non-SAP BI tools certified by SAP (SUR 2021, section 11.16). Which version applies to you depends on the date and wording of your contract.

1. Which HANA licence is in your order form: runtime (for example HANA REAB) or full use (enterprise edition)?
2. Which version of the Software Use Rights forms part of the contract?
3. Does an MCP server that issues SQL against your own views count as use “other than as specified”, triggering a full-use licence?
4. How does SAP count, for licensing purposes, the people who access the data indirectly through an AI assistant?
5. Does your operating model (for example RISE or private cloud) give you database access for your own software at all?

What does the SAP API Policy mean for SQL access?

The SAP API Policy allows only published interfaces and prohibits AI systems that plan calls themselves, as well as systematic or high-volume data extraction, unless a path recognised by SAP is used.

The provisions of Policy v.4.2026a that matter for database access (PDF at SAP):

• Section 1.1, Published APIs: Interfaces published in the SAP Business Accelerator Hub or in the product documentation count as published, usable for the purposes described there.
• Section 1.2, unpublished interfaces: Customer and third-party applications must not access them. Customers must verify for each endpoint that it is a Published API.
• Section 2.1: SAP documents limits for each interface, including “limits and preconditions for bulk extraction / replication”.
• Section 2.2.2: Without an SAP-recognised path, no use by AI systems that plan, select or execute sequences of calls (a), and no systematic or high-volume extraction or replication (b).
• Section 3: Controls must not be circumvented, not even “through intermediary services, custom code or developments, proxies, gateways”.

Whether SQL access to the database falls under the term “API” is not expressly answered by the Policy text. It covers programming interfaces, extensions and “related data transmission interfaces made available as part of SAP solutions”. Two things are clear nonetheless: S/4HANA tables are not a published interface, and an MCP server through which a model plans its own queries matches exactly the scenario in section 2.2.2 (a). SQL is therefore not a way out of the Policy but rather an additional risk. Which paths SAP expressly recognises for AI agents is covered in detail in the guide SAP MCP server and API Policy.

Which paths are better for AI analysis of SAP data?

For operational questions, published OData services; for metrics, analytical CDS queries; and for large data volumes, a data platform such as SAP Datasphere or SAP Business Data Cloud. What they all have in common: access runs through a layer that SAP intends for the purpose.

For bulk data, the Policy is clear in its direction: high-volume extraction only via SAP-recognised paths and within the documented limits. Which path is intended for your volume is stated in the documentation of the respective product and belongs in your discussion with SAP.

Access paths compared: suitability and risk

The table summarises which paths suit which purpose and where the main risk lies. It does not replace a review of your contract.

HANA Cloud as your own database: what does a clean MCP server look like?

A clean MCP server for HANA Cloud uses a dedicated read user, released views, fixed tools with bound parameters, hard limits and an audit log of every call. That keeps the database protected even if the model makes a mistake or is manipulated.

• Dedicated read userA technical user for the MCP server only, with read access to a schema of released views. No access to base tables, no system or administration rights.
• Views as a contractEach view contains only the columns the use case needs. Personal data stays out if the question can be answered without it.
• Fixed tools instead of free-form SQLA tool such as “revenue by customer and month” contains the query as a fixed statement with placeholders. The model supplies only values, such as customer number and period, never SQL text. Each value is checked against type and range.
• Limits in two placesIn the server, a fixed upper limit for rows and a time limit per call. In the database, additionally a workload class for the user, which according to SAP documentation can set, among other things, a statement time limit and a memory limit (SAP Help).
• Keep the network tightAccording to SAP, HANA Cloud denies all access by default, and access is granted via an IP allowlist (SAP Help). Only the address of the MCP server is allowed, not “all”.
• Authentication at the MCP serverEvery request to the server is authenticated, with narrowly scoped permissions. The assistant’s tokens are not passed on to the database. Details in the guide MCP server security.
• Audit log on two levelsThe server logs caller, tool, parameters with personal data masked, row count and duration. In HANA Cloud, an audit policy for the MCP user is added (SAP Help).
• No database error messages to the modelSQL error messages reveal tables and columns. The model receives only a neutral message; the full text goes to the audit log.
• Credentials in a secrets storeThe database password is not kept in a configuration file but in a secrets store, and is rotated regularly.
• Read firstWrite tools belong in a separate server with its own user and an approval step by a person, not as a switch in the read-only server.

Are there ready-made MCP servers for SAP HANA?

Yes, from the community and from third-party vendors. As of October 2026, we have not found a standalone SAP product that gives AI assistants direct database access to HANA via MCP.

• hana-mcp-server (community, MIT licence): According to the project description, it covers SAP HANA and HANA Cloud, with schema exploration and SQL execution. Write commands are blocked by default; automatic row limits and the query time limit are off by default, according to the documentation. Anyone using such a server switches the limits on and gives it a read-only user.
• hana-cli as an MCP server (SAP-samples, Apache 2.0): A sample project for local HANA development with, according to its description, over 150 tools, including backup, restore and administration. A tool for development environments, not for business queries on production data.
• Driver vendors: There are servers that read from HANA through commercial JDBC drivers, for example a server from CData, which requires a separately licensed driver.

The same applies to all of them: a third-party MCP server runs with the permissions you give it and sees whatever the model sees. Check origin, version and permissions before it touches real data. What such an approval looks like is described in the guide MCP server security and GDPR. Several systems behind one assistant are covered in the guide on MCP clusters.

Frequently asked questions

Is there an official SAP HANA MCP server from SAP?

As of October 2026, we have not found a standalone SAP product that gives AI assistants direct database access to HANA via MCP. There is a sample project in the SAP-samples area on GitHub for developers, as well as community servers and offerings from driver vendors. For business data, SAP offers MCP through the MCP Gateway of the Integration Suite, that is, through the application layer.

May an AI agent access the S/4HANA database via SQL?

We advise against it. Direct SQL access bypasses the authorizations and business logic of the application layer, S/4HANA tables are not a published API within the meaning of the SAP API Policy, and with a runtime licence the wording of SAP’s terms of use argues against access by third-party software. Clarify the individual case with SAP in writing.

What is the difference between a HANA runtime licence and a full-use licence?

According to the SAP Software Use Rights, a runtime database may only be used together with the licensed SAP applications. According to SAP, anyone who uses it otherwise needs a full-use licence. The SAP HANA enterprise edition may be used with any number of licensed data sources. Which licence you hold is stated in your order form.

Does direct SQL access fall under the SAP API Policy?

The Policy text does not answer this expressly. It covers programming interfaces and related data transmission interfaces of SAP solutions, allows only published APIs, and prohibits circumventing controls through custom developments, proxies or gateways. Anyone planning SQL as a detour around the Policy should clarify this with SAP beforehand.

When is an MCP server directly on HANA Cloud defensible?

When HANA Cloud serves as a standalone database with your own data and not as the database of an SAP application. The usual care then applies: a dedicated read user, released views, fixed tools with bound parameters, row and time limits, IP approval only for the server, and an audit log of every call.

How do I stop the model from running arbitrary SQL?

By not offering a tool for free-form SQL in the server. Each tool contains a fixed query with placeholders, and the model supplies only values such as customer number or period. The database user may only read, and only the released views.

Which path suits large data volumes from SAP?

For bulk data, the SAP API Policy requires paths recognised by SAP and refers to the limits in the product documentation. For analyses, SAP Datasphere or data products of the SAP Business Data Cloud are suitable. Which path fits your contract, we clarify before building.

Can Microsoft Copilot access HANA data via MCP?

Technically yes: Copilot Studio connects MCP servers via Streamable HTTP with OAuth 2.0 or an API key. Whether the server accesses HANA directly or through SAP interfaces determines the licensing and policy questions. For S/4HANA data, we recommend the path via published interfaces.