sap-ai-dev-toolkit 0.3.4 → 0.3.7

package/test/live-s4h.test.mjs

@@ -0,0 +1,202 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const launcher = fileURLToPath(new URL('../src/launcher.mjs', import.meta.url));
+const LIVE = /^(1|true|yes)$/iu.test(process.env.SAP_AI_DEV_LIVE_S4H || '');
+const DESTINATION = process.env.SAP_AI_DEV_LIVE_DESTINATION || 'S4H';
+const SLUG = process.env.SAP_AI_DEV_LIVE_DESTINATION_SLUG || DESTINATION.toLowerCase().replace(/[^a-z0-9_-]+/gu, '-');
+const REQUEST_TIMEOUT_MS = Number(process.env.SAP_AI_DEV_LIVE_TIMEOUT_MS || 45_000);
+
+async function readConfiguredServer() {
+  if (/^(0|false|no)$/iu.test(process.env.SAP_AI_DEV_LIVE_USE_MCP_CONFIG || '')) return null;
+  const candidates = [
+    process.env.SAP_AI_DEV_MCP_CONFIG,
+    process.env.BAS_VSP_MCP_CONFIG,
+    join(homedir(), '.vscode', 'data', 'User', 'mcp.json'),
+    join(homedir(), '.vscode-server', 'data', 'User', 'mcp.json'),
+    join(homedir(), '.code-server', 'data', 'User', 'mcp.json')
+  ].filter(Boolean);
+  for (const path of candidates) {
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile(path, 'utf8'));
+    } catch {
+      continue;
+    }
+    const server = parsed?.servers?.[DESTINATION];
+    if (server?.command) return { path, server };
+  }
+  return null;
+}
+
+class StdioMcpClient {
+  constructor(command, args, env) {
+    this.child = spawn(command, args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    this.nextId = 1;
+    this.pending = new Map();
+    this.stdout = '';
+    this.stderr = '';
+    this.notifications = [];
+    this.child.stdout.setEncoding('utf8');
+    this.child.stderr.setEncoding('utf8');
+    this.child.stdout.on('data', chunk => this.#onStdout(chunk));
+    this.child.stderr.on('data', chunk => { this.stderr += chunk; });
+    this.child.on('exit', (code, signal) => {
+      const error = new Error(`MCP process exited (${code ?? signal})\n${this.stderr.slice(-4000)}`);
+      for (const pending of this.pending.values()) pending.reject(error);
+      this.pending.clear();
+    });
+  }
+
+  #onStdout(chunk) {
+    this.stdout += chunk;
+    let newline;
+    while ((newline = this.stdout.indexOf('\n')) >= 0) {
+      const line = this.stdout.slice(0, newline).trim();
+      this.stdout = this.stdout.slice(newline + 1);
+      if (!line) continue;
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch (error) {
+        for (const pending of this.pending.values()) pending.reject(new Error(`Invalid JSON-RPC line: ${line}`));
+        this.pending.clear();
+        return;
+      }
+      if (message.id === undefined || message.id === null) {
+        this.notifications.push(message);
+        continue;
+      }
+      const pending = this.pending.get(message.id);
+      if (!pending) continue;
+      this.pending.delete(message.id);
+      clearTimeout(pending.timeout);
+      if (message.error) pending.reject(Object.assign(new Error(message.error.message), { response: message }));
+      else pending.resolve(message.result);
+    }
+  }
+
+  request(method, params) {
+    const id = this.nextId++;
+    const payload = { jsonrpc: '2.0', id, method, ...(params === undefined ? {} : { params }) };
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`Timed out waiting for ${method}\n${this.stderr.slice(-4000)}`));
+      }, REQUEST_TIMEOUT_MS);
+      this.pending.set(id, { resolve, reject, timeout });
+      this.child.stdin.write(`${JSON.stringify(payload)}\n`);
+    });
+  }
+
+  notify(method, params) {
+    this.child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method, ...(params === undefined ? {} : { params }) })}\n`);
+  }
+
+  async close() {
+    this.child.stdin.end();
+    this.child.kill('SIGTERM');
+    await Promise.race([
+      once(this.child, 'exit').catch(() => {}),
+      new Promise(resolve => setTimeout(resolve, 1500))
+    ]);
+    if (!this.child.killed) this.child.kill('SIGKILL');
+  }
+}
+
+function textPayload(result) {
+  return (result?.content || []).filter(item => item.type === 'text').map(item => item.text).join('\n');
+}
+
+async function withLiveClient(t) {
+  const configured = await readConfiguredServer();
+  const server = configured?.server;
+  const command = process.env.SAP_AI_DEV_LIVE_COMMAND || server?.command || process.execPath;
+  const args = process.env.SAP_AI_DEV_LIVE_COMMAND
+    ? (process.env.SAP_AI_DEV_LIVE_ARGS ? JSON.parse(process.env.SAP_AI_DEV_LIVE_ARGS) : [])
+    : (server?.command ? (server.args || []) : [launcher]);
+  const client = new StdioMcpClient(command, args, {
+    ...process.env,
+    ...(server?.env || {}),
+    SAP_AI_DEV_TOOLKIT_DESTINATION: server?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION || DESTINATION,
+    SAP_AI_DEV_TOOLKIT_MODE: process.env.SAP_AI_DEV_TOOLKIT_MODE || server?.env?.SAP_AI_DEV_TOOLKIT_MODE || 'expert',
+    SAP_ALLOW_TRANSPORTABLE_EDITS: process.env.SAP_ALLOW_TRANSPORTABLE_EDITS || server?.env?.SAP_ALLOW_TRANSPORTABLE_EDITS || 'true'
+  });
+  t.after(() => client.close());
+  const initialized = await client.request('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'sap-ai-dev-live-test', version: '1.0.0' } });
+  client.notify('notifications/initialized');
+  assert.equal(initialized.serverInfo.name, DESTINATION);
+  return client;
+}
+
+test('live S4H MCP exposes a curated ABAP lifecycle surface under 60 tools', { skip: LIVE ? false : 'set SAP_AI_DEV_LIVE_S4H=1 to run against a live BAS/S4H destination' }, async t => {
+  const client = await withLiveClient(t);
+  const listed = await client.request('tools/list', {});
+  const tools = listed.tools || [];
+  const names = new Set(tools.map(tool => tool.name));
+  const prefix = `${SLUG}__`;
+
+  assert.ok(tools.length > 25, `expected a useful ABAP lifecycle surface, got ${tools.length}`);
+  assert.ok(tools.length < 60, `curated destination tool count must stay below 60, got ${tools.length}`);
+  assert.ok(tools.every(tool => tool.name.startsWith(prefix)), 'every tool is destination-prefixed for the selected S4H server');
+
+  for (const required of [
+    'LintABAP', 'GetSystemInfo', 'GetConnectionInfo', 'GetFeatures',
+    'SearchObject', 'GrepObjects', 'GrepPackages', 'GetSource', 'WriteSource', 'EditSource', 'CompareSource',
+    'SyntaxCheck', 'PrettyPrint', 'Activate', 'RunUnitTests', 'RunATCCheck', 'GetInactiveObjects',
+    'GetClass', 'GetProgram', 'GetPackage', 'GetTable', 'GetTableContents', 'RunQuery',
+    'GetTransport', 'GetTransportInfo', 'ListTransports', 'CreateTransport',
+    'GetApplicationLog', 'PrepareABAPChangeSet', 'ApplyABAPChangeSet', 'CheckTransportReadiness', 'PlanABAPCloudMigration'
+  ]) {
+    assert.ok(names.has(`${prefix}${required}`), `expected curated lifecycle tool ${required}`);
+  }
+
+  for (const hidden of [
+    'SAP', 'ReleaseTransport', 'DeleteTransport', 'DeleteObject', 'ExecuteABAP', 'CallRFC',
+    'ListSQLTraces', 'AnalyzeABAPCode', 'CreateObject', 'CreateClassWithTests', 'WriteClass', 'UpdateSource'
+  ]) {
+    assert.equal(names.has(`${prefix}${hidden}`), false, `broad/destructive tool ${hidden} must remain hidden`);
+  }
+});
+
+test('live S4H MCP handles safe local and read-only SAP calls', { skip: LIVE ? false : 'set SAP_AI_DEV_LIVE_S4H=1 to run against a live BAS/S4H destination' }, async t => {
+  const client = await withLiveClient(t);
+  const prefix = `${SLUG}__`;
+  await client.request('tools/list', {});
+
+  const lint = await client.request('tools/call', {
+    name: `${prefix}LintABAP`,
+    arguments: { files: [{ filename: 'zlive_probe.prog.abap', source: "REPORT zlive_probe.\nWRITE / 'ok'.\n" }] }
+  });
+  const lintJson = JSON.parse(textPayload(lint));
+  assert.equal(lintJson.filesChecked, 1);
+
+  for (const [tool, args] of [
+    ['GetSystemInfo', {}],
+    ['GetConnectionInfo', {}],
+    ['GetFeatures', {}],
+    ['GetInstalledComponents', {}]
+  ]) {
+    const result = await client.request('tools/call', { name: `${prefix}${tool}`, arguments: args });
+    assert.notEqual(result.isError, true, `${tool} returned an MCP tool error: ${textPayload(result)}`);
+  }
+
+  const query = await client.request('tools/call', {
+    name: `${prefix}RunQuery`,
+    arguments: { sql_query: 'SELECT * FROM T000', max_rows: 1 }
+  });
+  assert.notEqual(query.isError, true, `RunQuery returned an MCP tool error: ${textPayload(query)}`);
+  assert.match(textPayload(query), /T000|MANDT|client|rows|\[/iu);
+
+  const appLog = await client.request('tools/call', {
+    name: `${prefix}GetApplicationLog`,
+    arguments: { max_results: 1 }
+  });
+  assert.notEqual(appLog.isError, true, `GetApplicationLog returned an MCP tool error: ${textPayload(appLog)}`);
+});

package/test/mcp-config-cf.test.mjs

@@ -100,6 +100,17 @@ test('builds SAP development companion MCP entries', () => {
   assert.throws(() => buildSapDevelopmentMcpEntries(['missing-tool']), /Unknown SAP development MCP server id/);
 });
 
+test('configures the HANA inspector without persisting credentials', () => {
+  const entry = buildSapDevelopmentMcpEntries(['hana-cloud-inspector'])['hana-cloud-inspector'];
+  assert.equal(entry.command, 'npx');
+  assert.deepEqual(entry.args, ['--yes', '--ignore-scripts', '--package=sap-ai-dev-toolkit', 'sap-ai-hana']);
+  assert.equal(entry.BAS_EXT_KIND, 'sap-development-companion');
+  assert.equal(entry.displayName, 'HANA Cloud inspector');
+  assert.equal(entry.env, undefined);
+  assert.doesNotMatch(JSON.stringify(entry), /"(?:HANA_RO_PASSWORD|VCAP_SERVICES)"\s*:/);
+  assert.doesNotMatch(JSON.stringify(entry), /"(?:password|pwd)"\s*:/i);
+});
+
 test('installs and removes SAP development companion entries', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-tools-config-'));
   const path = join(directory, 'mcp.json');
@@ -120,6 +131,35 @@ test('installs and removes SAP development companion entries', async t => {
   assert.deepEqual(Object.keys(cleared.servers), ['userServer']);
 });
 
+test('installs and removes the HANA inspector without changing unrelated MCP servers', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-hana-config-'));
+  const path = join(directory, 'mcp.json');
+  const initial = {
+    custom: true,
+    servers: { userServer: { type: 'stdio', command: 'custom-server' } }
+  };
+  await writeFile(path, JSON.stringify(initial));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+
+  const installed = await installMcpConfig([], {
+    env: { H2O_URL: 'http://h2o.example' },
+    path,
+    sapDevelopmentServers: ['hana-cloud-inspector']
+  });
+  assert.deepEqual(Object.keys(installed.servers), ['hana-cloud-inspector']);
+  const configured = await readMcpConfig(path);
+  assert.deepEqual(Object.keys(configured.servers).sort(), ['hana-cloud-inspector', 'userServer']);
+  assert.equal(configured.custom, true);
+  assert.equal(configured.servers['hana-cloud-inspector'].env, undefined);
+  assert.doesNotMatch(JSON.stringify(configured), /"(?:HANA_RO_PASSWORD|VCAP_SERVICES)"\s*:/);
+  assert.doesNotMatch(JSON.stringify(configured), /"(?:password|pwd)"\s*:/i);
+
+  await installMcpConfig([], { env: { H2O_URL: 'http://h2o.example' }, path });
+  const removed = await readMcpConfig(path);
+  assert.deepEqual(removed.servers, initial.servers);
+  assert.equal(removed.custom, true);
+});
+
 test('installs and removes CF entries without deleting unrelated MCP servers', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-cf-config-'));
   const path = join(directory, 'mcp.json');

package/test/mcp-proxy.test.mjs

@@ -5,24 +5,13 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { once } from 'node:events';
-import { childArguments, MCPProxy } from '../src/mcp-proxy.mjs';
+import { childArguments, MCPProxy, PUBLIC_VSP_TOOLS } from '../src/mcp-proxy.mjs';
 import { PassThrough } from 'node:stream';
 
 const fixture = fileURLToPath(new URL('./fixtures/fake-vsp.mjs', import.meta.url));
-const REQUESTED_TOOLS = [
-  'AnalyzeABAPCode', 'AnalyzeCallGraph', 'CodeCompletion', 'GetAbapHelp',
-  'GetCallGraph', 'GetCalleesOf', 'GetCallersOf', 'GetCodeCoverage',
-  'GetConnectionInfo', 'GetObjectStructure', 'GetTypeHierarchy', 'GetTypeInfo',
-  'GrepObject', 'GrepPackage', 'CallRFC', 'DebuggerAttach', 'DebuggerDetach',
-  'DebuggerGetStack', 'DebuggerGetVariables', 'DebuggerListen', 'DebuggerStep',
-  'DeleteBreakpoint', 'GetBreakpoints', 'GetDump', 'GetSQLTraceState', 'GetTrace',
-  'ListDumps', 'SetBreakpoint', 'CloneObject', 'CreateAndActivateProgram',
-  'CreateClassWithTests', 'CreateObject', 'CreateTestInclude', 'DeleteObject',
-  'ExecuteABAP', 'GetClass', 'GetClassComponents', 'GetClassInclude', 'GetFunction',
-  'GetInclude', 'GetInterface', 'GetProgram', 'GetStructure', 'GetTransaction',
-  'LockObject', 'MoveObject', 'RecoverFailedCreate', 'RenameObject', 'SaveToFile',
-  'UnlockObject', 'UpdateClassInclude', 'UpdateSource', 'WriteClass', 'WriteProgram',
-  'CreateTransport', 'ListDependencies', 'PublishServiceBinding', 'UnpublishServiceBinding'
+const HIDDEN_VSP_TOOLS = [
+  'AnalyzeABAPCode', 'DebuggerListen', 'DeleteBreakpoint', 'DeleteObject', 'ExecuteABAP', 'ReleaseTransport',
+  'DeleteTransport', 'SAP', 'ListSQLTraces', 'PublishServiceBinding', 'UnpublishServiceBinding'
 ];
 
 
@@ -166,22 +155,23 @@ test('merges paged tools and routes calls to the selected child', async t => {
   assert.deepEqual(lintTool.inputSchema.required, ['files']);
   assert.deepEqual(lintTool.inputSchema.properties.files.items.required, ['filename', 'source']);
 
+  const localWorkflowTools = [
+    'LintABAP', 'GetApplicationLog', 'PrepareABAPChangeSet', 'ApplyABAPChangeSet',
+    'CheckTransportReadiness', 'PlanABAPCloudMigration', 'GenerateRAPRegressionSuite', 'RunRAPRegressionSuite'
+  ];
   for (const destination of ['alpha', 'beta']) {
-    for (const toolName of REQUESTED_TOOLS) {
-      assert.ok(names.has(`${destination}__${toolName}`), `${destination} exposes ${toolName}`);
+    for (const toolName of PUBLIC_VSP_TOOLS) {
+      assert.ok(names.has(`${destination}__${toolName}`), `${destination} exposes curated ${toolName}`);
     }
-    for (const coreTool of [
-      'GetSource', 'RunQuery', 'GetSystemInfo', 'GetInstalledComponents',
-      'GetFeatures', 'GetAPIReleaseState', 'PrettyPrint', 'ListTransports',
-      'GetTransport', 'GetUserTransports', 'GetTransportInfo',
-      'GetApplicationLog', 'ActivateMultiple'
-    ]) {
-      assert.ok(names.has(`${destination}__${coreTool}`), `${destination} exposes ${coreTool}`);
+    for (const toolName of localWorkflowTools) {
+      assert.ok(names.has(`${destination}__${toolName}`), `${destination} exposes local ${toolName}`);
     }
-    for (const formerlyExcludedTool of ['ListSQLTraces', 'ReleaseTransport', 'DeleteTransport', 'SAP']) {
-      assert.ok(names.has(`${destination}__${formerlyExcludedTool}`), `${destination} exposes ${formerlyExcludedTool}`);
+    for (const hiddenTool of HIDDEN_VSP_TOOLS) {
+      assert.equal(names.has(`${destination}__${hiddenTool}`), false, `${destination} hides ${hiddenTool}`);
     }
   }
+  assert.equal(listed.result.tools.filter(tool => tool.name.startsWith('alpha__')).length, PUBLIC_VSP_TOOLS.size + localWorkflowTools.length);
+  assert.equal(PUBLIC_VSP_TOOLS.size + localWorkflowTools.length, 59);
 
   const requiredArguments = {
     GetFeatures: [],
@@ -234,11 +224,7 @@ test('merges paged tools and routes calls to the selected child', async t => {
       params: { type: 'delete' }
     }],
     ['ActivateMultiple', { objects: ['PROG ZDEMO'] }],
-    ['CreateTransport', {}],
-    ['ReleaseTransport', {}],
-    ['DeleteTransport', {}],
-    ['ListSQLTraces', {}],
-    ['SAP', { action: 'analyze', params: { type: 'application_log' } }]
+    ['CreateTransport', {}]
   ];
   for (const [index, [name, arguments_]] of additionalCalls.entries()) {
     const response = await proxy.handle({

package/test/setup.test.mjs

@@ -70,7 +70,7 @@ function runPostinstallInPty(env, keys, assetsAnswer = '\r') {
         selectionSent = true;
         child.stdin.write(keys);
       }
-      if (!assetsAnswerSent && stdout.includes('Install the bundled agents and eleven skills')) {
+      if (!assetsAnswerSent && stdout.includes('Install the bundled agents and all skills')) {
         assetsAnswerSent = true;
         child.stdin.write(assetsAnswer);
       }
@@ -90,6 +90,7 @@ function runPostinstallInPty(env, keys, assetsAnswer = '\r') {
 async function assertUserCopilotAssets(home) {
   const copilotRoot = join(home, '.copilot');
   assert.equal((await stat(join(copilotRoot, 'agents', 'abap-developer.agent.md'))).isFile(), true);
+  assert.equal((await stat(join(copilotRoot, 'agents', 'hana-cloud-hdi-specialist.agent.md'))).isFile(), true);
   const skillNames = (await readdir(join(copilotRoot, 'skills'))).sort();
   assert.deepEqual(skillNames, [
     'abap-debugging',
@@ -98,6 +99,9 @@ async function assertUserCopilotAssets(home) {
     'abap-testing-quality',
     'cds-development',
     'clean-core-extensibility',
+    'hana-cloud-inspection',
+    'hana-cloud-native-development',
+    'hana-cloud-validation',
     'rap-development',
     'rap-service-delivery',
     'sap-sdlc-orchestration',
@@ -279,13 +283,13 @@ test('global postinstall completes BAS selection before optional Copilot assets'
   const declineLogs = `${declined.stdout}\n${declined.stderr}`;
   assert.match(declineLogs, /Configured 0 MCP servers/);
   assert.match(declineLogs, /\[Y\/n\]/);
-  assert.match(declineLogs, /Press Enter to install the bundled agents and eleven skills in the path shown below; type n then press Enter to skip/);
+  assert.match(declineLogs, /Press Enter to install the bundled agents and all skills in the path shown below; type n then press Enter to skip/);
   assert.match(declineLogs, /🤖 sap-ai-dev-toolkit/);
   assert.match(declineLogs, /\u001b\[1;35m/);
   assert.match(declineLogs, /Optional Copilot setup is waiting for your choice/);
   assert.match(declineLogs, /Copilot agent and skills were skipped\. Your files were not changed/);
   assert.ok(declineLogs.indexOf('Optional Copilot setup is waiting for your choice') > declineLogs.indexOf('Configured 0 MCP servers'), declineLogs);
-  assert.ok(declineLogs.indexOf('Install the bundled agents and eleven skills') > declineLogs.indexOf('Optional Copilot setup is waiting for your choice'), declineLogs);
+  assert.ok(declineLogs.indexOf('Install the bundled agents and all skills') > declineLogs.indexOf('Optional Copilot setup is waiting for your choice'), declineLogs);
   assert.ok(declineLogs.indexOf('No MCP server entries are configured for this add-on.') > declineLogs.indexOf('Copilot agent and skills were skipped'), declineLogs);
   assert.ok(declineLogs.includes(`MCP config file: ${config}`), declineLogs);
   const configAfterDecline = JSON.parse(await readFile(config, 'utf8'));
@@ -297,9 +301,9 @@ test('global postinstall completes BAS selection before optional Copilot assets'
   assert.equal(accepted.selectionSent, true, accepted.stdout);
   assert.equal(accepted.assetsAnswerSent, true, accepted.stdout);
   const acceptLogs = `${accepted.stdout}\n${accepted.stderr}`;
-  assert.ok(acceptLogs.indexOf('Install the bundled agents and eleven skills') > acceptLogs.indexOf('Configured 1 MCP server'), acceptLogs);
-  assert.match(acceptLogs, /Installed 15 Copilot files/);
-  assert.ok(acceptLogs.indexOf('Installation configuration summary') > acceptLogs.indexOf('Installed 15 Copilot files'), acceptLogs);
+  assert.ok(acceptLogs.indexOf('Install the bundled agents and all skills') > acceptLogs.indexOf('Configured 1 MCP server'), acceptLogs);
+  assert.match(acceptLogs, /Installed 19 Copilot files/);
+  assert.ok(acceptLogs.indexOf('Installation configuration summary') > acceptLogs.indexOf('Installed 19 Copilot files'), acceptLogs);
   assert.ok(acceptLogs.includes(`MCP config file: ${config}`), acceptLogs);
   assert.ok(acceptLogs.includes('Destination: BAS · alpha-system · client 100 · Basic'), acceptLogs);
   assert.ok(acceptLogs.includes('Launch: stdio · sap-ai-dev'), acceptLogs);

package/tools.md

@@ -1,79 +1,87 @@
+# Curated VSP tools exposed through the BAS proxy
 
-# Additional VSP tools exposed through the BAS proxy
+The proxy no longer advertises every VSP tool. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a cherry-picked set of VSP tools plus local workflow tools (currently 59 tools when all curated VSP capabilities are registered).
 
-The proxy forwards these tools when the installed VSP mode registers them. They extend its existing curated tool set.
+Hidden upstream VSP tools are not directly callable through the proxy. Local workflow tools may still call hidden or non-advertised upstream operations internally when they are required for a bounded workflow.
 
-## Analysis, metadata, debugging, and trace
+## Public VSP tools
 
-- `AnalyzeABAPCode`
-- `AnalyzeCallGraph`
-- `CodeCompletion`
-- `GetAbapHelp`
-- `GetCallGraph`
-- `GetCalleesOf`
-- `GetCallersOf`
-- `GetCodeCoverage`
-- `GetConnectionInfo`
-- `GetObjectStructure`
-- `GetTypeHierarchy`
-- `GetTypeInfo`
-- `GrepObject`
-- `GrepPackage`
-- `CallRFC`
+- `Activate`
+- `ActivateMultiple`
+- `CompareSource`
+- `CreateTransport`
 - `DebuggerAttach`
 - `DebuggerDetach`
 - `DebuggerGetStack`
 - `DebuggerGetVariables`
-- `DebuggerListen`
 - `DebuggerStep`
-- `DeleteBreakpoint`
+- `EditSource`
+- `FindDefinition`
+- `FindReferences`
+- `GetAPIReleaseState`
 - `GetBreakpoints`
-- `GetDump`
-- `GetSQLTraceState`
-- `GetTrace`
-- `ListDumps`
-- `SetBreakpoint`
-
-## Object, source, transport, and service operations
-
-- `CloneObject`
-- `CreateAndActivateProgram`
-- `CreateClassWithTests`
-- `CreateObject`
-- `CreateTestInclude`
-- `DeleteObject`
-- `ExecuteABAP`
+- `GetCDSDependencies`
+- `GetCDSElementInfo`
+- `GetCDSImpactAnalysis`
 - `GetClass`
 - `GetClassComponents`
 - `GetClassInclude`
+- `GetClassInfo`
+- `GetConnectionInfo`
+- `GetContext`
+- `GetFeatures`
 - `GetFunction`
+- `GetFunctionGroup`
+- `GetInactiveObjects`
 - `GetInclude`
+- `GetInstalledComponents`
 - `GetInterface`
+- `GetPackage`
 - `GetProgram`
-- `GetStructure`
-- `GetTransaction`
-- `LockObject`
-- `MoveObject`
-- `RecoverFailedCreate`
-- `RenameObject`
-- `SaveToFile`
-- `UnlockObject`
-- `UpdateClassInclude`
-- `UpdateSource`
-- `WriteClass`
-- `WriteProgram`
-- `CreateTransport`
+- `GetSource`
+- `GetSystemInfo`
+- `GetTable`
+- `GetTableContents`
+- `GetTransport`
+- `GetTransportInfo`
+- `GetUserTransports`
+- `GrepObjects`
+- `GrepPackages`
 - `ListDependencies`
-- `PublishServiceBinding`
-- `UnpublishServiceBinding`
+- `ListTransports`
+- `PrettyPrint`
+- `RunATCCheck`
+- `RunQuery`
+- `RunUnitTests`
+- `SearchObject`
+- `SetBreakpoint`
+- `SyntaxCheck`
+- `WriteSource`
+
+## Hidden from direct proxy calls
+
+Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy.
 
 ## Destination-scoped workflow tools
 
 The proxy adds local multi-step tools to each destination when their required VSP capabilities are available:
 
+- `LintABAP` — local in-memory ABAP linting.
+- `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
 - `PrepareABAPChangeSet` and `ApplyABAPChangeSet` — review full-source diffs and recheck source before explicit writes.
 - `CheckTransportReadiness` — collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC results.
 - `PlanABAPCloudMigration` — batch SAP API release-state checks and prioritize recognized unreleased results.
 - `GenerateRAPRegressionSuite` and `RunRAPRegressionSuite` — create and run reusable OData GET-only checks under the selected service root.
 
 `sap-ai-dev-toolkit --doctor` checks destination probing, VSP startup, `GetSystemInfo`, and MCP tool listing. `sap-ai-dev-toolkit --demo` runs the sample tools and OData fixtures without contacting SAP; demo writes and transport creation remain in memory until that process exits.
+
+## Separate optional HANA Cloud inspector
+
+The optional `hana-cloud-inspector` companion starts `sap-ai-hana` as a separate stdio MCP server. It does not use the VSP proxy, BAS destination prefix, or ABAP SQL `RunQuery`. When selected and configured with a dedicated read-only identity, it exposes:
+
+- `hana_connection_info` — verify the configured endpoint, service/binding, current user, schema, and TLS state without returning credentials.
+- `hana_list_objects` — list tables/views in the bound HDI schema, with a 200-object maximum.
+- `hana_describe_object` — inspect columns for a catalog-verified object in that schema.
+- `hana_read_rows` — perform parameterized reads of selected columns, capped at 200 rows; credential-like columns are blocked and arbitrary SQL is not accepted.
+
+Connection secrets are read from the MCP host environment via explicit `HANA_RO_*` variables or a selected `VCAP_SERVICES` binding and are not written to `mcp.json`. TLS certificate verification is mandatory. No HANA write, DDL/DML, deploy/undeploy, grants, or service-key tools are exposed; deployment remains a user-run project workflow.