@sap-ux/fiori-mcp-server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of npm/@sap-ux/fiori-mcp-server: Do Fiori project edits or external SAP connection requirements materially change in later versions?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Generate and edit SAP Fiori apps

What we know

SAP Fiori app generation and modification MCP published under SAP UX tooling namespace.

Maintenance / activity evidence

The npm package @sap-ux/fiori-mcp-server published version 1.15.8 on 2026-10-09.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Project code changes possible; requires user review before running generated changes; some OData functions need SAP connection. Reported action classes: Generate or modify SAP Fiori project code or configuration through development tools. Complete write authority is not verified.
Authentication not yet verified.
Can create or change application project files. Review generated code and system credentials before use.

Can create or change application project files. Review generated code and system credentials before use.
Advisory/security review not completed; no safety badge.
Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

158 shared-repository stars · 398.6k package downloads / 30 days

Stars observed Oct 9, 2026. Downloads observed Oct 9, 2026.

Repository total for SAP/open-ux-tools; not package-specific.

Exact npm package @sap-ux/fiori-mcp-server; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

Do Fiori project edits or external SAP connection requirements materially change in later versions?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Can create or change application project files. Review generated code and system credentials before use.
Advisory/security review not completed; no safety badge.
Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.
Project code changes possible; requires user review before running generated changes; some OData functions need SAP connection.
Reviewed write actions: Generate or modify SAP Fiori project code or configuration through development tools
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Generated code and SAP system connections can access enterprise resources; installation alone does not grant authorization.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
exact authentication contract
first-party data processing and retention
data retention and permission scope
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Requires local workspace and may require SAP system connection.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

The npm package @sap-ux/fiori-mcp-server published version 1.15.8 on 2026-10-09.

Technical identity

npm/@sap-ux/fiori-mcp-server

Exact implementation source: https://www.npmjs.com/package/@sap-ux%2Ffiori-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: SAP/open-ux-tools
Package identity: npm:@sap-ux/fiori-mcp-server

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
@sap-ux/fiori-mcp-server
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
sap/open-ux-tools
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
SAP Fiori server has published `npx --yes @sap-ux/fiori-mcp-server@<version> fiori-mcp` pattern requiring real pinned version; prefer global install when version unspecified.
preferred pinned mcp client registration · Claude Code only · Publisher instructions · Review before use
```
claude mcp add fiori-mcp -- npx --yes @sap-ux/fiori-mcp-server@<version> fiori-mcp
```
optional global install · Publisher instructions
npm install -g @sap-ux/fiori-mcp-server
Configure / authenticate
MCP100 setup guide
SAP Fiori MCP is started through npx pinned published package and `fiori-mcp` subcommand; choose exact known version from official release.
Check connection
Suggested check
After npx --yes @sap-ux/fiori-mcp-server@<pinned-version> fiori-mcp registration, inspect Fiori tool list only. Do not mutate Fiori source project.
Remove / uninstall / revoke
MCP100 setup guide
For a Claude Code registration named `fiori-mcp`, run `claude mcp remove fiori-mcp`. Stop any separately running local process. Do not delete SAP projects or account tokens automatically.
MCP client unregister, stopping hosted processes, package uninstall, OAuth disconnect and token revocation are distinct actions.
A claude mcp remove command is only valid for Claude Code when the local registration actually has that name. Other MCP hosts require their own UI/config cleanup.
Separate credential guidance / limitations: SAP Fiori MCP itself is local stdio via npx and requires no MCP-specific API key; credentials for separately configured SAP systems are managed in those SAP systems, not this package.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove fiori-mcp

Official Documentation & Sources

What it does

SAP Fiori app generation and modification MCP published under SAP UX tooling namespace.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Generate and edit SAP Fiori apps

Representative uses

stdio
app generation
modification
potential local write

Limitations

Requires local workspace and may require SAP system connection.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Project code changes possible; requires user review before running generated changes; some OData functions need SAP connection.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Can create or change application project files. Review generated code and system credentials before use.

Access scope and cautions

Write actions: Not verified Generate or modify SAP Fiori project code or configuration through development tools
Risk level: moderate
Security notes: Advisory/security review not completed; no safety badge. Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: stdio; app generation; modification; potential local write.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx --yes @sap-ux/fiori-mcp-server@latest fiori-mcp. Recorded transport: stdio. Prerequisites: Node/npm; SAP Fiori/CAP/UI5 project for code-changing workflows. Client notes: List tools from client after launching stdio server. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local filesystem/project context; SAP system connection needed when using remote OData/SAP system operations.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Generate or modify SAP Fiori project code or configuration through development tools. Recorded permission context: Project code changes possible; requires user review before running generated changes; some OData functions need SAP connection.

What limitations and risks should I check before use?

Can create or change application project files. Review generated code and system credentials before use. Requires local workspace and may require SAP system connection. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Generated code and SAP system connections can access enterprise resources; installation alone does not grant authorization. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.