Requirements

Node.js: 20.0.0 or newer
Claude Code: CLI installed (Max or Pro subscription, or an API key)
SAP system: ECC 6.0 · S/4HANA On-Premise · S/4HANA Cloud (Public and Private), with ADT enabled

The MCP server abap-mcp-adt-powerup is installed and configured automatically during /sc4sap:setup. Nothing to fetch beforehand

Installation

sc4sap is not on the official Claude Code plugin marketplace yet. For now, add the repository as a custom marketplace and install from it

Recommended

Add as a custom marketplace

Run both lines inside a Claude Code session

/plugin marketplace add https://github.com/babamba2/superclaude-for-sap.git
/plugin install sc4sap

To update later

/plugin marketplace update babamba2/superclaude-for-sap
/plugin install sc4sap

Alternative

Install from source

Clone and build, then point Claude Code at that directory with /plugin marketplace add <local-path>

git clone https://github.com/babamba2/superclaude-for-sap.git
cd superclaude-for-sap
npm install && npm run build

Setup wizard

The wizard asks one question at a time. Existing values are shown so you can press Enter to keep them

/sc4sap:setup

01

System and industry

Choose S4 or ECC, enter the ABAP release, pick an industry from the 15-option menu. These drive the SPRO tables, BAPIs, transaction codes, and ABAP syntax gating

02

Install the MCP server

Clones and builds abap-mcp-adt-powerup into <PLUGIN_ROOT>/vendor/abap-mcp-adt/. Skipped if it is already there

03

Create a profile and connect

Set an alias (KR-DEV style is suggested) and a tier (DEV, QA, PRD), then supply URL, client, auth type, account, and language one field at a time. Pick an RFC backend from soap, native, gateway, odata, zrfc

04

Verify the connection

Reconnect with /mcp, then a GetSession round trip, a system info check, and an ADT authority check via GetInactiveObjects. No Claude Code restart needed

05

Create the ABAP utility objects

DEV profiles only. Installs the ZMCP_ADT_UTILS function group plus the ZIF_S4SAP_CM and ZCL_S4SAP_CM_* ALV handlers. On QA and PRD it refuses and prints CTS import guidance instead

06

Install the permission hooks required

Setup is not complete without this step. Registers block-forbidden-tables.mjs (row-extraction guard) and tier-readonly-guard.mjs (tier mutation guard) in .claude/settings.json, then runs both smoke tests

Optional steps

SPRO extraction. Token heavy, but the cache cuts token use sharply on everything that follows
Customization inventory. Scans Z* and Y* enhancements and append structures
HUD status line. After a restart it shows the active profile, its tier, and token usage

Subcommands

/sc4sap:setup                # 전체 위저드
/sc4sap:setup doctor         # 상태 점검으로 라우팅
/sc4sap:setup mcp            # MCP 설정으로 라우팅
/sc4sap:setup spro           # SPRO 설정 추출만
/sc4sap:setup customizations # Z*/Y* 인벤토리만

Multiple profiles

~/.sc4sap · <project>/.sc4sap

~/.sc4sap/                      저장소 간 공유
└── profiles/
    ├── KR-DEV/  sap.env · config.json
    ├── KR-QA/   sap.env · config.json
    └── KR-PRD/  sap.env · config.json

<project>/.sc4sap/              프로젝트 범위
├── active-profile.txt        "KR-DEV"
└── work/
    ├── KR-DEV/  program · cbo · ...
    └── KR-PRD/  ...

One Claude Code session can hold several SAP connections. Each connection is a profile; the project only records which one is active

Tier is what enforces read-only On QA and PRD profiles, Create*, Update*, and Delete* are blocked at two layers, the hook and the MCP server
Tier is immutable Changing it means removing the profile and adding it again
Passwords live in the OS keychain Windows Credential Manager, macOS Keychain, Linux libsecret. Where no keychain is available it falls back to plaintext in the profile env and warns you

Three layers of defense

This is the first thing reviewed before anything touches a live system. It is enforced in code, not in a policy document

L1a

Row extraction guard

A Claude Code PreToolUse hook. Uses the profile's blocklistProfile to deny GetTableContents and GetSqlQuery on sensitive tables

L1b

Tier mutation guard

A Claude Code PreToolUse hook. Re-reads SAP_TIER from the active profile on every call and denies mutations on QA and PRD. It holds no state

L2

MCP server guard

The layer you cannot route around. Even if the hooks are missing or misconfigured, the guard inside abap-mcp-adt-powerup is always active

Both L1 hooks fail open on IO or parse errors; the L2 guard is always on. Typical defaults are strict for L1a and standard for the MCP server blocklist

After setup

Switch active system: /sc4sap:sap-option switch <alias>
Add a company or tier: /sc4sap:sap-option add
List profiles: /sc4sap:sap-option list
Health check: /sc4sap:sap-doctor
Re-extract SPRO: /sc4sap:setup spro

Install guide