ARC-1

Install

npx -y [email protected]

Required configuration names: SAP_URL, SAP_USER. Values are not stored.

2 secret configuration fields are declared. Names and values are omitted here.

Client fit

Inferred for Cursor, Claude, Codex. Basis: stdio. This is not a certification from those products.

Transports: stdio.

Links

• Repository
• Project site
• npm package arc-1
• Registry record

Other

Audit report

Tested Tested by AddonAudit.

Sandbox handshake completed, with warnings: medium known vulnerabilities; install scripts present.

Automated smoke test, not a security guarantee.

Version

1.9.0

Audited

24 Oct 2026

Package

npm arc-1

Advisories

0 critical, 0 high, 1 medium, 0 low

Time to ready

2418 ms

Network

Disabled

• Pass Version. Pinned npm [email protected]
• Warn Known vulnerabilities. Medium advisories were returned. No critical or high advisories were returned.
• Pass License. MIT
• Warn Install scripts. Install-time scripts: prepare
• Pass Credential patterns. No credential patterns in the published artifact.
• Pass Package size. 1.4 MB
• Pass Maintainer activity. Active 0 days ago.
• Pass Sandbox. MCP handshake completed. 9 tools listed.

Tools

• SAPRead Read SAP ABAP source, metadata and syntax results. For source purpose, explanations, specs, reviews or pre-change context, prefer SAPContext first. DDIC metadata: omit format (default text); structured is CLAS-only for ordinary reads. TABLE
• SAPSearch Search for ABAP objects, exact object-directory entries, or source code. Modes: 1. Object search (default): name pattern with wildcards (*); returns type, name, package, description, ADT URI. 2. TADIR lookup (searchType="tadir_lookup"): exa
• SAPNavigate Navigate code: definitions, references, completion, hierarchy. references: where-used objects by default; detail=positions/snippets adds bounded native usages; objectType filters results (e.g. CLAS/OC, PROG/P); type+name replaces uri. hiera
• SAPLint Run local abaplint rules on ABAP/CDS source (auto-selects cloud or on-prem rules by system type). Actions: - "lint": check source (errors+warnings) for ABAP (PROG/CLAS/INTF/FUNC) and CDS (DDLS). - "lint_and_fix": lint + auto-fix fixable iss
• SAPDiagnose ABAP diagnostics: - "syntax": check objects[] (CLAS/INTF/PROG/DDLS; version active/inactive). Single: prefer SAPRead SYNTAX. - "unittest": harmless ABAP Unit for CLAS/PROG/FUGR or DEVC (exact; includeSubpackages recurses). - "unittest_ci":
• SAPContext Primary tool for understanding ABAP/CDS objects before specs, reviews, explanations, or changes — use instead of SAPRead when the user asks what an object does. Returns intent first (the object KTD when available) then compressed dependency
• SAPManage Probe and report SAP system capabilities. Use BEFORE operations that depend on optional features (abapGit, RAP/CDS, AMDP, HANA, UI5/Fiori, CTS transports, FLP). Also handles package (DEVC) lifecycle. Actions: - "features": cached feature s
• SAPTransport Manage CTS transport requests (SE09/SE10). Actions: list (current user, modifiable), get (tasks + objects), create (always a Workbench (K) request — the package/target sets target & layer, not the request category; optional explicit target)
• SAPGit Git reads and gated abapGit workflows. gCTS mutations are quarantined. abapGit mutations need write/Git gates and allowedPackages ROOT/** or *; clone/pull evidence is unverified. external_info is gated HTTPS SAP egress.

: Object cache enabled {"mode":"auto","sources":0,"legacyDepGraphs":0}
[2026-10-24T00:12:37.145Z] INFO: Skipped startup auth preflight: SAP_URL is not configured.
[2026-10-24T00:12:37.148Z] INFO: ARC-1 MCP server running on stdio
[2026-10-24T00:12:37.150Z] WARN: ADT discovery unavailable (Invalid URL) — continuing without proactive MIME negotiation
[2026-10-24T00:12:37.150Z] WARN: Authorization probe: object search access is not confirmed — Network error — cannot reach the search endpoint.
[2026-10-24T00:12:37.150Z] INFO: Authorization probe: transport access is not available — Network error — cannot reach the transport endpoint.
[2026-10-24T00:12:37.159Z] INFO: schema nullable optionals auto mode clientInfo {"clientName":"addonaudit","clientVersion":"0","resolvedNullableOptionals":false}

Raw audit JSON

Metadata checks

• Repository activity: Active in the last 180 days
• License: Recognized SPDX id
• Metadata quality: High

Score 85 uses public metadata only. It is separate from the audit tier. Payment never changes a score. How listings are checked.