SAP Commerce MCP
A read-only MCP server that lets Claude or another MCP client inspect a local SAP Commerce instance through HAC, in natural language.
The Problem
Answering “what is in my dev instance?” normally means opening HAC, writing FlexibleSearch by hand and remembering type-system details. A natural-language client can do that, but only if the integration cannot change anything.
How It Works
- An MCP client (for example Claude Code or Copilot in VS Code) starts the server as a local stdio process and lists five allow-listed tools: flexible_search, type_info, config_get, logs_tail and cronjob.
- The client’s model turns a question into a tool call. Arguments are schema-validated, and any FlexibleSearch goes through an allow-list validator (single SELECT, no comments, no mutation words) before it reaches HAC.
- The server calls a fixed set of local HAC paths (or reads the local console log), masks secret-like values and caps result size, then returns structured data to the client.
Technically Interesting
Read-only is enforced in code, not by prompting: a tool allow-list, a conservative query validator, a HAC client limited to fixed paths, and a host guard that accepts only loopback or private addresses.
Why It Matters
It shows how to give an AI assistant useful access to enterprise commerce data with narrow, auditable boundaries.
Scope & honesty. The demo above is a simulation with hard-coded sample data. It never contacts SAP Commerce, HAC, an MCP server or an AI API, and it does not run a real FlexibleSearch. The project is for a local development instance only. Its authors state that real HAC behaviour and the Claude Code and Copilot clients have not been verified live.