sap-ai-dev-toolkit 0.3.4 → 0.3.7

package/src/hana-database.mjs

@@ -0,0 +1,150 @@
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const QUERY_TIMEOUT_MS = 15_000;
+
+function hanaFailure(operation, error) {
+  const code = typeof error?.code === 'string' || typeof error?.code === 'number'
+    ? String(error.code).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 24)
+    : '';
+  const failure = new Error(`${operation} failed${code ? ` (HANA error ${code})` : ''}; verify the selected read-only binding, schema, and privileges.`);
+  failure.name = 'HanaDatabaseError';
+  return failure;
+}
+
+function callbackPromise(invoke, operation) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (error, result) => {
+      if (settled) return;
+      settled = true;
+      if (error) reject(hanaFailure(operation, error));
+      else resolve(result);
+    };
+    try {
+      invoke(done);
+    } catch (error) {
+      done(error);
+    }
+  });
+}
+
+function executeWithTimeout(connection, sql, values, timeoutMs, onTimeout) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      onTimeout();
+      const error = new Error(`HANA read exceeded the ${timeoutMs / 1000} second time limit; the connection was retired. Narrow the request and retry.`);
+      error.name = 'HanaQueryTimeoutError';
+      reject(error);
+    }, timeoutMs);
+    const done = (error, result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (error) reject(hanaFailure('HANA read', error));
+      else resolve(result);
+    };
+    try {
+      connection.exec(sql, values, {}, done);
+    } catch (error) {
+      done(error);
+    }
+  });
+}
+
+export function hanaConnectionOptions(config) {
+  return {
+    host: config.host,
+    port: config.port,
+    uid: config.user,
+    pwd: config.password,
+    currentSchema: config.schema,
+    encrypt: true,
+    sslValidateCertificate: true,
+    connectTimeout: 10_000,
+    ...(config.trustStore ? { sslTrustStore: config.trustStore } : {})
+  };
+}
+
+export class HanaDatabase {
+  constructor(connection, config, { queryTimeoutMs = QUERY_TIMEOUT_MS } = {}) {
+    this.connection = connection;
+    this.config = config;
+    this.queryTimeoutMs = queryTimeoutMs;
+    this.connected = false;
+    this.closed = false;
+    this.unusable = false;
+    this.queue = Promise.resolve();
+  }
+
+  async connect() {
+    if (this.closed) throw new Error('HANA connection is closed.');
+    if (this.connected) return this;
+    await callbackPromise(
+      callback => this.connection.connect(hanaConnectionOptions(this.config), callback),
+      'HANA connection'
+    );
+    this.connected = true;
+    return this;
+  }
+
+  async query(sql, values = []) {
+    if (!this.connected || this.closed || this.unusable) throw new Error('HANA connection is not available.');
+    if (typeof sql !== 'string' || !sql.trim() || !Array.isArray(values)) {
+      throw new Error('Invalid internal HANA query request.');
+    }
+    const result = this.queue.then(() => executeWithTimeout(
+      this.connection,
+      sql,
+      values,
+      this.queryTimeoutMs,
+      () => {
+        this.unusable = true;
+        try { this.connection.cancel?.(); } catch {}
+      }
+    ));
+    this.queue = result.then(() => undefined, () => undefined);
+    try {
+      return await result;
+    } catch (error) {
+      if (this.unusable) await this.close();
+      throw error;
+    }
+  }
+
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    await this.queue.catch(() => {});
+    if (!this.connected) return;
+    this.connected = false;
+    await callbackPromise(callback => this.connection.disconnect(callback), 'HANA disconnect').catch(() => {});
+  }
+}
+
+export async function connectReadOnlyHana(config, { driver } = {}) {
+  let selectedDriver = driver;
+  if (!selectedDriver) {
+    try {
+      selectedDriver = require('@sap/hana-client');
+    } catch {
+      throw new Error('The SAP HANA Node.js driver could not be loaded for this platform.');
+    }
+  }
+  if (typeof selectedDriver?.createConnection !== 'function') {
+    throw new Error('The configured SAP HANA Node.js driver is unavailable.');
+  }
+
+  const connection = selectedDriver.createConnection();
+  const database = new HanaDatabase(connection, config);
+  try {
+    await database.connect();
+    return database;
+  } catch (error) {
+    await database.close();
+    throw error;
+  }
+}

package/src/hana-inspector.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+import { readFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { resolveHanaReadOnlyConfig } from './hana-config.mjs';
+import { connectReadOnlyHana } from './hana-database.mjs';
+import { registerHanaTools } from './hana-tools.mjs';
+
+const packageMetadata = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+
+function publicConnectionSummary(config) {
+  return Object.freeze({
+    source: config.source,
+    serviceName: config.serviceName,
+    bindingName: config.bindingName,
+    host: config.host,
+    port: config.port,
+    schema: config.schema
+  });
+}
+
+/** Create an injectable server runtime for tests and the stdio executable. */
+export function createHanaInspector({ env = process.env, driver, databaseFactory = connectReadOnlyHana } = {}) {
+  const config = resolveHanaReadOnlyConfig(env);
+  const summary = publicConnectionSummary(config);
+  let databasePromise;
+  let database;
+
+  const getDatabase = async () => {
+    if (!databasePromise) {
+      databasePromise = databaseFactory(config, { driver })
+        .then(connected => {
+          database = connected;
+          return connected;
+        })
+        .catch(error => {
+          databasePromise = undefined;
+          throw error;
+        });
+    }
+    return databasePromise;
+  };
+
+  const server = new McpServer({
+    name: 'sap-ai-hana-inspector',
+    version: packageMetadata.version
+  }, { capabilities: { tools: {} } });
+  registerHanaTools(server, getDatabase, { connectionSummary: summary });
+
+  let closing;
+  const close = () => {
+    if (!closing) {
+      closing = (async () => {
+        await server.close().catch(() => {});
+        if (!database && databasePromise) database = await databasePromise.catch(() => undefined);
+        if (database) await database.close().catch(() => {});
+      })();
+    }
+    return closing;
+  };
+
+  return { server, close, connectionSummary: summary };
+}
+
+export async function runHanaInspector({ env = process.env, stdin = process.stdin, stdout = process.stdout, stderr = process.stderr, driver } = {}) {
+  if (process.argv.slice(2).some(argument => argument === '--help' || argument === '-h')) {
+    stdout.write([
+      'Usage: sap-ai-hana',
+      '',
+      'Starts a read-only stdio MCP server for the HANA service selected by HANA_RO_* or VCAP_SERVICES.',
+      'Required explicit variables: HANA_RO_HOST, HANA_RO_PORT, HANA_RO_USER, HANA_RO_PASSWORD, HANA_RO_SCHEMA.',
+      'VCAP selection: HANA_RO_VCAP_SERVICE and HANA_RO_BINDING are optional when exactly one HANA binding exists.',
+      'TLS certificate validation is always enabled. Deployment credentials are never used as a fallback.',
+      ''
+    ].join('\n'));
+    return;
+  }
+  let runtime;
+  try {
+    runtime = createHanaInspector({ env, driver });
+  } catch (error) {
+    stderr.write(`[sap-ai-hana] ${error.message}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const transport = new StdioServerTransport(stdin, stdout, { maxBufferSize: 1024 * 1024 });
+  let closing;
+  const shutdown = () => {
+    if (!closing) closing = runtime.close().catch(() => {});
+    return closing;
+  };
+  const onStdinEnd = () => { void shutdown(); };
+  const onSignal = signal => {
+    void shutdown().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143));
+  };
+  stdin.once('end', onStdinEnd);
+  process.once('SIGINT', onSignal);
+  process.once('SIGTERM', onSignal);
+  transport.onerror = () => stderr.write('[sap-ai-hana] MCP stdio transport failed.\n');
+
+  try {
+    await runtime.server.connect(transport);
+  } catch {
+    stderr.write('[sap-ai-hana] MCP server startup failed.\n');
+    await shutdown();
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  await runHanaInspector();
+}

package/src/hana-tools.mjs

@@ -0,0 +1,277 @@
+import { z } from 'zod';
+import { quoteHanaIdentifier } from './hana-config.mjs';
+
+export const HANA_MAX_ROWS = 200;
+export const HANA_MAX_OUTPUT_BYTES = 96 * 1024;
+const MAX_COLUMNS = 40;
+const MAX_FILTERS = 20;
+const MAX_SELECTED_COLUMN_WIDTH = 8192;
+const UNBOUNDED_COLUMN_TYPES = new Set(['BLOB', 'CLOB', 'NCLOB', 'BINARY', 'VARBINARY', 'ST_GEOMETRY', 'ST_POINT']);
+const SENSITIVE_COLUMN_NAME = /(?:PASS(?:WORD|WD)|SECRET|(?:ACCESS|REFRESH|AUTH)?_?TOKEN|API_?KEY|PRIVATE_?KEY|CREDENTIAL)/i;
+const SAFE_INSPECTION_ERRORS = new Set([
+  'HANA result is too large to return safely; request fewer rows or columns.',
+  'The requested object was not found in the bound HDI schema.',
+  'A requested column is not present on the requested HDI object.',
+  'Credential-like columns are not returned by the HANA inspector.',
+  'LOB and binary columns are not supported by the bounded row-read tool.',
+  'The selected columns exceed the safe row-width limit; select fewer or narrower columns.'
+]);
+
+const READ_ONLY_ANNOTATIONS = Object.freeze({
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+});
+
+const OPERATOR_SQL = Object.freeze({
+  eq: '=',
+  ne: '<>',
+  lt: '<',
+  lte: '<=',
+  gt: '>',
+  gte: '>='
+});
+
+function jsonSafe(value, seen = new WeakSet()) {
+  if (typeof value === 'bigint') return value.toString();
+  if (value instanceof Date) return value.toISOString();
+  if (Buffer.isBuffer(value)) return { type: 'binary', bytes: value.byteLength };
+  if (Array.isArray(value)) return value.map(entry => jsonSafe(entry, seen));
+  if (value && typeof value === 'object') {
+    if (seen.has(value)) return '[circular]';
+    seen.add(value);
+    const result = Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, jsonSafe(entry, seen)]));
+    seen.delete(value);
+    return result;
+  }
+  if (typeof value === 'number' && !Number.isFinite(value)) return String(value);
+  return value;
+}
+
+function jsonText(value) {
+  const text = JSON.stringify(jsonSafe(value), null, 2);
+  if (Buffer.byteLength(text, 'utf8') > HANA_MAX_OUTPUT_BYTES) {
+    throw new Error('HANA result is too large to return safely; request fewer rows or columns.');
+  }
+  return text;
+}
+
+function toolError(error) {
+  let message = 'HANA inspection failed. Check the selected read-only binding, target schema, and read permissions.';
+  if (error?.name === 'HanaDatabaseError' || error?.name === 'HanaQueryTimeoutError') {
+    message = error.message;
+  } else if (SAFE_INSPECTION_ERRORS.has(error?.message)) {
+    message = error.message;
+  } else if (typeof error?.message === 'string' && /^(?:Set HANA_RO_|Explicit HANA |VCAP_SERVICES|The selected HANA |No HANA VCAP|Multiple HANA VCAP|The configured HANA |HANA_RO_HOST|HANA_RO_PORT)/.test(error.message)) {
+    message = error.message;
+  }
+  return { isError: true, content: [{ type: 'text', text: message }] };
+}
+
+async function resultOf(operation) {
+  try {
+    return { content: [{ type: 'text', text: jsonText(await operation()) }] };
+  } catch (error) {
+    return toolError(error);
+  }
+}
+
+function rowsOf(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+async function listObjects(database, schema, objectType, maxResults) {
+  const entries = [];
+  if (objectType !== 'VIEW') {
+    const tables = rowsOf(await database.query(
+      `SELECT TABLE_NAME AS OBJECT_NAME FROM SYS.TABLES WHERE SCHEMA_NAME = ? ORDER BY TABLE_NAME LIMIT ${maxResults}`,
+      [schema]
+    ));
+    entries.push(...tables.map(row => ({ objectName: row.OBJECT_NAME, objectType: 'TABLE' })));
+  }
+  if (objectType !== 'TABLE') {
+    const views = rowsOf(await database.query(
+      `SELECT VIEW_NAME AS OBJECT_NAME FROM SYS.VIEWS WHERE SCHEMA_NAME = ? ORDER BY VIEW_NAME LIMIT ${maxResults}`,
+      [schema]
+    ));
+    entries.push(...views.map(row => ({ objectName: row.OBJECT_NAME, objectType: 'VIEW' })));
+  }
+  entries.sort((left, right) => String(left.objectName).localeCompare(String(right.objectName)) || left.objectType.localeCompare(right.objectType));
+  return {
+    schema,
+    objectType,
+    objects: entries.slice(0, maxResults),
+    maxResults,
+    truncated: entries.length >= maxResults
+  };
+}
+
+async function findObject(database, schema, objectName) {
+  const tables = rowsOf(await database.query(
+    'SELECT TABLE_NAME AS OBJECT_NAME FROM SYS.TABLES WHERE SCHEMA_NAME = ? AND TABLE_NAME = ?',
+    [schema, objectName]
+  ));
+  if (tables.length) return { objectName, objectType: 'TABLE' };
+  const views = rowsOf(await database.query(
+    'SELECT VIEW_NAME AS OBJECT_NAME FROM SYS.VIEWS WHERE SCHEMA_NAME = ? AND VIEW_NAME = ?',
+    [schema, objectName]
+  ));
+  if (views.length) return { objectName, objectType: 'VIEW' };
+  throw new Error('The requested object was not found in the bound HDI schema.');
+}
+
+async function describeObject(database, schema, objectName) {
+  const target = await findObject(database, schema, objectName);
+  const sql = target.objectType === 'TABLE'
+    ? 'SELECT COLUMN_NAME, POSITION, DATA_TYPE_NAME, LENGTH, SCALE, IS_NULLABLE FROM SYS.TABLE_COLUMNS WHERE SCHEMA_NAME = ? AND TABLE_NAME = ? ORDER BY POSITION'
+    : 'SELECT COLUMN_NAME, POSITION, DATA_TYPE_NAME, LENGTH, SCALE, IS_NULLABLE FROM SYS.VIEW_COLUMNS WHERE SCHEMA_NAME = ? AND VIEW_NAME = ? ORDER BY POSITION';
+  const columns = rowsOf(await database.query(sql, [schema, objectName]));
+  return { ...target, schema, columns };
+}
+
+function assertRequestedColumns(columns, metadataColumns) {
+  const available = new Set(metadataColumns.map(column => column.COLUMN_NAME));
+  for (const name of columns) {
+    if (!available.has(name)) throw new Error('A requested column is not present on the requested HDI object.');
+  }
+}
+
+function assertBoundedColumns(columns, metadataColumns) {
+  let estimatedWidth = 0;
+  for (const name of columns) {
+    const column = metadataColumns.find(entry => entry.COLUMN_NAME === name);
+    const type = String(column.DATA_TYPE_NAME || '').toUpperCase();
+    if (UNBOUNDED_COLUMN_TYPES.has(type)) {
+      throw new Error('LOB and binary columns are not supported by the bounded row-read tool.');
+    }
+    const length = Number(column.LENGTH);
+    estimatedWidth += Number.isFinite(length) && length > 0 ? length : 32;
+    if (estimatedWidth > MAX_SELECTED_COLUMN_WIDTH) {
+      throw new Error('The selected columns exceed the safe row-width limit; select fewer or narrower columns.');
+    }
+  }
+}
+
+function assertNonSensitiveColumns(columns) {
+  if (columns.some(name => SENSITIVE_COLUMN_NAME.test(name))) {
+    throw new Error('Credential-like columns are not returned by the HANA inspector.');
+  }
+}
+
+async function readRows(database, schema, args) {
+  const target = await findObject(database, schema, args.objectName);
+  const metadata = await describeObject(database, schema, args.objectName);
+  assertRequestedColumns(args.columns, metadata.columns);
+  assertNonSensitiveColumns([
+    ...args.columns,
+    ...args.filters.map(filter => filter.column),
+    ...(args.orderBy ? [args.orderBy.column] : [])
+  ]);
+  assertBoundedColumns(args.columns, metadata.columns);
+
+  for (const filter of args.filters) assertRequestedColumns([filter.column], metadata.columns);
+  if (args.orderBy) assertRequestedColumns([args.orderBy.column], metadata.columns);
+
+  const selected = args.columns.map(quoteHanaIdentifier).join(', ');
+  const conditions = args.filters.map(filter => `${quoteHanaIdentifier(filter.column)} ${OPERATOR_SQL[filter.operator]} ?`);
+  const order = args.orderBy
+    ? ` ORDER BY ${quoteHanaIdentifier(args.orderBy.column)} ${args.orderBy.direction}`
+    : '';
+  const where = conditions.length ? ` WHERE ${conditions.join(' AND ')}` : '';
+  const sql = `SELECT ${selected} FROM ${quoteHanaIdentifier(schema)}.${quoteHanaIdentifier(args.objectName)}${where}${order} LIMIT ${args.limit}`;
+  const values = args.filters.map(filter => filter.value);
+  const rows = rowsOf(await database.query(sql, values));
+  return {
+    schema,
+    ...target,
+    columns: args.columns,
+    limit: args.limit,
+    rowCount: rows.length,
+    rows,
+    possiblyTruncated: rows.length === args.limit
+  };
+}
+
+/** Register read-only inspection tools. No handler accepts arbitrary SQL or a caller-selected schema. */
+export function registerHanaTools(server, getDatabase, { connectionSummary } = {}) {
+  const schemaName = connectionSummary?.schema;
+  if (typeof schemaName !== 'string' || !schemaName.trim()) {
+    throw new Error('A configured HDI schema is required to register HANA tools.');
+  }
+
+  server.registerTool('hana_connection_info', {
+    title: 'HANA connection info',
+    description: 'Return the configured HANA Cloud endpoint and verified HDI schema/current user. Uses the dedicated read-only identity; never returns credentials.',
+    inputSchema: {},
+    annotations: READ_ONLY_ANNOTATIONS
+  }, async () => resultOf(async () => {
+    const database = await getDatabase();
+    const rows = rowsOf(await database.query('SELECT CURRENT_SCHEMA AS CURRENT_SCHEMA, CURRENT_USER AS CURRENT_USER FROM DUMMY'));
+    if (!rows.length) throw new Error('HANA did not return its current connection identity.');
+    const currentSchema = rows[0].CURRENT_SCHEMA;
+    if (currentSchema !== schemaName) throw new Error('The connected HANA schema does not match the configured HDI schema.');
+    return {
+      source: connectionSummary.source,
+      serviceName: connectionSummary.serviceName,
+      bindingName: connectionSummary.bindingName,
+      host: connectionSummary.host,
+      port: connectionSummary.port,
+      configuredSchema: schemaName,
+      currentSchema,
+      databaseUser: rows[0].CURRENT_USER,
+      tls: 'enabled; certificate verification required'
+    };
+  }));
+
+  server.registerTool('hana_list_objects', {
+    title: 'List HANA objects',
+    description: 'List tables and/or views from the configured HDI schema only. Results are capped at 200 objects.',
+    inputSchema: {
+      objectType: z.enum(['ALL', 'TABLE', 'VIEW']).default('ALL'),
+      maxResults: z.number().int().min(1).max(HANA_MAX_ROWS).default(100)
+    },
+    annotations: READ_ONLY_ANNOTATIONS
+  }, async ({ objectType, maxResults }) => resultOf(async () => {
+    return listObjects(await getDatabase(), schemaName, objectType, maxResults);
+  }));
+
+  server.registerTool('hana_describe_object', {
+    title: 'Describe HANA object',
+    description: 'Return column metadata for a table or view in the configured HDI schema only.',
+    inputSchema: { objectName: z.string().trim().min(1).max(127) },
+    annotations: READ_ONLY_ANNOTATIONS
+  }, async ({ objectName }) => resultOf(async () => {
+    return describeObject(await getDatabase(), schemaName, objectName);
+  }));
+
+  const valueSchema = z.union([z.string().max(2048), z.number().finite(), z.boolean()]);
+  const filterSchema = z.object({
+    column: z.string().trim().min(1).max(127),
+    operator: z.enum(['eq', 'ne', 'lt', 'lte', 'gt', 'gte']),
+    value: valueSchema
+  }).strict();
+
+  server.registerTool('hana_read_rows', {
+    title: 'Read HANA rows',
+    description: `Run a bounded, parameterized read from one catalog-listed table/view in the configured HDI schema. Select 1–${MAX_COLUMNS} known columns; no free-form SQL, DDL, DML, procedure calls, or schema selection is accepted. Maximum ${HANA_MAX_ROWS} rows.`,
+    inputSchema: {
+      objectName: z.string().trim().min(1).max(127),
+      columns: z.array(z.string().trim().min(1).max(127)).min(1).max(MAX_COLUMNS),
+      filters: z.array(filterSchema).max(MAX_FILTERS).default([]),
+      orderBy: z.object({
+        column: z.string().trim().min(1).max(127),
+        direction: z.enum(['ASC', 'DESC']).default('ASC')
+      }).strict().optional(),
+      limit: z.number().int().min(1).max(HANA_MAX_ROWS).default(50)
+    },
+    annotations: READ_ONLY_ANNOTATIONS
+  }, async args => resultOf(async () => readRows(await getDatabase(), schemaName, args)));
+}
+
+export const HANA_TOOL_NAMES = Object.freeze([
+  'hana_connection_info',
+  'hana_list_objects',
+  'hana_describe_object',
+  'hana_read_rows'
+]);

package/src/mcp-config.mjs

@@ -39,6 +39,15 @@ export const SAP_DEVELOPMENT_MCP_SERVERS = Object.freeze([
     packageName: '@playwright/mcp',
     bin: 'playwright-mcp',
     priority: 'recommended'
+  }),
+  Object.freeze({
+    id: 'hana-cloud-inspector',
+    name: 'HANA Cloud inspector',
+    description: 'Read-only HANA Cloud/HDI metadata and bounded row inspection using host-provided HANA_RO_* or VCAP_SERVICES credentials.',
+    packageName: 'sap-ai-dev-toolkit',
+    bin: 'sap-ai-hana',
+    ignoreScripts: true,
+    priority: 'optional'
   })
 ]);
 
@@ -78,7 +87,7 @@ export function buildSapDevelopmentMcpEntries(serverIds = SAP_DEVELOPMENT_MCP_SE
     entries[server.id] = {
       type: 'stdio',
       command: packageManager,
-      args: ['--yes', `--package=${packageSpec}`, server.bin],
+      args: ['--yes', ...(server.ignoreScripts ? ['--ignore-scripts'] : []), `--package=${packageSpec}`, server.bin],
       BAS_EXT: 'true',
       BAS_EXT_KIND: COMPANION_SERVER_KIND,
       displayName: server.name,

package/src/mcp-proxy.mjs

@@ -34,6 +34,66 @@ const APPLICATION_LOG_SCHEMA = {
 };
 const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Results are newest first and limited to 100 by default; set messages=true to include log message details.';
 
+// Keep the default public VSP surface small enough for developer-lifecycle use.
+// Hidden upstream tools can still be used by local workflow tools when needed.
+export const PUBLIC_VSP_TOOLS = new Set([
+  'Activate',
+  'ActivateMultiple',
+  'CompareSource',
+  'CreateTransport',
+  'DebuggerAttach',
+  'DebuggerDetach',
+  'DebuggerGetStack',
+  'DebuggerGetVariables',
+  'DebuggerStep',
+  'EditSource',
+  'FindDefinition',
+  'FindReferences',
+  'GetAPIReleaseState',
+  'GetBreakpoints',
+  'GetCDSDependencies',
+  'GetCDSElementInfo',
+  'GetCDSImpactAnalysis',
+  'GetClass',
+  'GetClassComponents',
+  'GetClassInclude',
+  'GetClassInfo',
+  'GetConnectionInfo',
+  'GetContext',
+  'GetFeatures',
+  'GetFunction',
+  'GetFunctionGroup',
+  'GetInactiveObjects',
+  'GetInclude',
+  'GetInstalledComponents',
+  'GetInterface',
+  'GetPackage',
+  'GetProgram',
+  'GetSource',
+  'GetSystemInfo',
+  'GetTable',
+  'GetTableContents',
+  'GetTransport',
+  'GetTransportInfo',
+  'GetUserTransports',
+  'GrepObjects',
+  'GrepPackages',
+  'ListDependencies',
+  'ListTransports',
+  'PrettyPrint',
+  'RunATCCheck',
+  'RunQuery',
+  'RunUnitTests',
+  'SearchObject',
+  'SetBreakpoint',
+  'SyntaxCheck',
+  'WriteSource'
+]);
+
+function exposeVspTool(tool) {
+  return PUBLIC_VSP_TOOLS.has(tool?.name);
+}
+
 function applicationLogArguments(arguments_ = {}) {
   const filters = arguments_ && typeof arguments_ === 'object' && !Array.isArray(arguments_) ? arguments_ : {};
   const params = { type: 'application_log' };
@@ -358,6 +418,7 @@ export class MCPProxy {
             });
           }
 
+          if (!exposeVspTool(tool)) continue;
           const name = `${slug}__${tool.name}`;
           this.namespace.set(name, { entry, upstream: tool.name });
           merged.push({ ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });

package/src/setup.mjs

@@ -306,8 +306,9 @@ export async function runSetup({
   let sapDevelopmentServers = [];
   if (includeSapDevelopmentToolsPrompt) {
     print(output, '');
-    print(output, formatStatus('Optionally add companion MCP servers for full-stack SAP development.', 'step', output, 'Tools'));
-    print(output, '  Recommended for RAP/Fiori/CAP/UI validation work. Leave empty to only configure ABAP/ADT destination servers.');
+    print(output, formatStatus('Optionally add companion MCP servers for full-stack SAP development and HANA inspection.', 'step', output, 'Tools'));
+    print(output, '  HANA Cloud inspector is read-only and uses HANA_RO_* or VCAP_SERVICES already present in the MCP host environment; credentials are not written to mcp.json.');
+    print(output, '  Leave empty to only configure ABAP/ADT destination servers.');
     print(output, '');
     sapDevelopmentServers = await checkboxPrompt({
       message: colorText('🧰 Select companion tools', 'cyan', output),