SAP S/4HANA (HANA SQL)

What this connects to: the HANA database under an SAP S/4HANA system (on-premise, Private Cloud / RISE, or HANA Enterprise Cloud), read directly with SQL. SAP's table and column names are abbreviations (BUKRS, HSL, VBELN); the tools below read SAP's own dictionary so the model sees what each table and field means before it queries.

Start with sap_guide: it costs nothing and explains the SAP data model (client, dates, currencies, finance, sales, inventory) and the order in which to use the other tools.

Setup (SAP Basis, one-off)

1. Create a technical database user in the tenant that holds the ABAP schema (usually SAPHANADB or SAPABAP1), with a password that does not expire:

   CREATE USER AMCP_READER PASSWORD "<strong password>" NO FORCE_FIRST_PASSWORD_CHANGE;
   ALTER USER AMCP_READER DISABLE PASSWORD LIFETIME;
   

2. Grant SELECT on what the agent may read. The dictionary tools need DD02L DD02T DD03L DD03T DD03ND DD04T DD07T DD08L DD05S DDHEADANNO DDFIELDANNO ARS_W_API_STATE and sap_org_structure needs T001 T001K T001W TKA01 TVKO TVKOT T024E. Add the business tables and CDS views for your use cases, or GRANT SELECT ON SCHEMA SAPHANADB for broad analytics. Never grant HR tables you do not want read.
3. Recommended: cap the user's statements on the server side with a workload class (STATEMENT TIMEOUT, STATEMENT MEMORY LIMIT) mapped to the user.
4. Fill in the variables: SAP_HANA_HOST; SAP_HANA_PORT, the tenant's SQL port (3<instance>15 for the first tenant, 3<instance>41 and up for others; the system database port 3<instance>13 also works together with the tenant name); SAP_HANA_TENANT, the tenant database name; SAP_HANA_SCHEMA (e.g. SAPHANADB); SAP_CLIENT, the three-digit SAP client (e.g. 100); SAP_LANGUAGE, the one-letter SAP language for texts (E English, D German); SAP_HANA_TLS, verify, no-verify (self-signed certificate) or off; SAP_HANA_USER and SAP_HANA_PASSWORD.

Network: the HANA SQL port is normally reachable only inside the company network. Self-host AnythingMCP there (or connect it through a VPN) and add the host to SSRF_ALLOWED_HOSTS.

Read-only by design: the session runs SET TRANSACTION READ ONLY, writes and locking reads are refused, results are capped at 1000 rows and each statement times out after 60 seconds. SQL bypasses SAP's application authorizations, so the database grants are the real boundary. HR and user/password tables are on the connector's denied-tables list by default (edit it in the connector settings).

Licensing: direct SQL access to the ABAP schema by a third-party application is governed by your SAP HANA licence. A runtime licence bundled with S/4HANA usually does not cover it; a full-use licence does. Check your contract before connecting production.

Driver: the bundled hdb driver needs nothing installed. To use SAP's native @sap/hana-client instead, see the SAP HANA page of the AnythingMCP docs.