sap-ai-dev-toolkit 0.9.9912 → 0.9.9914

package/src/setup.mjs

@@ -1,3 +1,4 @@
+import { readFileSync } from 'node:fs';
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
 import { platform } from 'node:os';
@@ -7,6 +8,9 @@ import { discoverDestinations, remediation } from './bas-discovery.mjs';
 import { adtBaseUrl, adtPort, defaultAdtUrl, discoverSapGuiSystems, hasExplicitPort, hasPathPrefix, messageServerAppServers } from './local-sap-gui.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
+import { parseIntegrationServiceKey, resolveIntegrationConfig, resolveIntegrationSideFromEnvironment } from './integration-config.mjs';
+import { readStoredIntegrationKeys, storeIntegrationKey } from './integration-credentials.mjs';
+import { createIntegrationClients, verificationLines, verifyIntegrationClients } from './integration-verify.mjs';
 import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
 import { findRemoteControllableSsoBrowsers } from './sso-browsers.mjs';
 
@@ -268,14 +272,167 @@ function warnSsoIpHost(destination, label, output) {
   print(output, formatStatus(`${label} uses an IP address; SSO needs the DNS host name for Kerberos and the browser certificate check. Enter the host name if the sign-in fails.`, 'warning', output, 'SSO'));
 }
 
-async function confirmPrompt(message, { input = stdin, output = stdout } = {}) {
+async function confirmPrompt(message, { input = stdin, output = stdout, defaultYes = true } = {}) {
   const answer = await textPrompt({
     message,
-    placeholder: 'y',
+    placeholder: defaultYes ? 'y' : 'n',
     required: false,
     validate: value => /^(?:|y|yes|n|no)$/i.test(String(value || '').trim()) || 'Enter y or n.'
   }, { input, output });
-  return !/^n(?:o)?$/i.test(String(answer || '').trim());
+  const trimmed = String(answer || '').trim();
+  if (!trimmed) return defaultYes;
+  return !/^n(?:o)?$/i.test(trimmed);
+}
+
+// Credential status for the Integration Suite companion, without exposing any value: which sides
+// (CPI, APIM) resolve from this environment or the stored-key file, and from which source.
+export function integrationSuiteCredentialStatus(env = process.env) {
+  try {
+    const config = resolveIntegrationConfig(env, { stored: readStoredIntegrationKeys(env) });
+    const side = value => (value ? `configured from ${value.source}${value.bindingName ? ` (${value.bindingName})` : ''}, host ${new URL(value.url).host}` : 'not configured');
+    return { found: true, config, lines: [`CPI: ${side(config.cpi)}`, `APIM: ${side(config.apim)}`] };
+  } catch (error) {
+    const message = String(error?.message || '');
+    if (/^Configure CPI/.test(message)) return { found: false, config: null, lines: ['No CPI or APIM credentials were found in this environment.'] };
+    return { found: false, config: null, lines: [`Credentials found but not usable: ${message}`] };
+  }
+}
+
+function defaultVerifyIntegration(config, { env }) {
+  return verifyIntegrationClients(createIntegrationClients(config, { env }));
+}
+
+/** Read a pasted service key: JSON text (line breaks from a multi-line paste are dropped) or a path to a .json file. */
+function pastedServiceKey(side, value, env) {
+  const trimmed = String(value || '').trim();
+  let text = trimmed;
+  if (!trimmed.startsWith('{')) {
+    const path = trimmed.replace(/^~(?=$|[\\/])/, env.HOME || env.USERPROFILE || '~');
+    try {
+      text = readFileSync(path, 'utf8');
+    } catch {
+      throw new Error('Paste the service key JSON (starting with {) or the path to a readable .json file.');
+    }
+  }
+  return parseIntegrationServiceKey(side, text);
+}
+
+async function printIntegrationVerification(config, { env, output, verifyIntegration }) {
+  const stop = startProgress('Signing in to Integration Suite and checking each tool area', { output, env, label: 'Integration Suite' });
+  let report;
+  try {
+    report = await verifyIntegration(config, { env });
+  } finally {
+    stop();
+  }
+  const host = side => (config[side] ? new URL(config[side].url).host : '');
+  for (const line of [...verificationLines('CPI', host('cpi'), report.cpi), ...verificationLines('APIM', host('apim'), report.apim)]) print(output, `  ${line}`);
+  const missing = [report.cpi, report.apim].flatMap(side => side?.checks || []).filter(check => check.result === 'forbidden').length;
+  if (report.ok) {
+    print(output, formatStatus(`Integration Suite credentials verified${missing ? `; ${missing} area${missing === 1 ? ' needs' : 's need'} an extra role on the service key` : ''}.`, missing ? 'warning' : 'success', output, 'Integration Suite'));
+  } else {
+    print(output, formatStatus('Integration Suite verification failed; fix or replace the service key before using the tools.', 'warning', output, 'Integration Suite'));
+  }
+  return report;
+}
+
+// Verify the detected credentials online and let the user paste CPI/APIM service keys. A pasted key is checked
+// online first and saved to the user-only store (never to mcp.json); it is used when the environment has no key.
+async function configureIntegrationCredentials({ env, input, output, verifyIntegration }) {
+  let status = integrationSuiteCredentialStatus(env);
+  if (status.found) await printIntegrationVerification(status.config, { env, output, verifyIntegration });
+  for (;;) {
+    print(output, '');
+    const choice = await selectPrompt({
+      message: colorText('🔑 Integration Suite credentials', 'cyan', output),
+      defaultValue: status.found ? 'done' : 'cpi',
+      choices: [
+        { name: status.found ? 'Continue' : 'Continue without credentials (the server will not start until a key is configured)', value: 'done', shortcut: 'c' },
+        { name: 'Paste a Cloud Integration (CPI) service key — Process Integration Runtime, plan api', value: 'cpi', shortcut: 'p' },
+        { name: 'Paste an API Management service key — API Management, plan apiportal-apiaccess', value: 'apim', shortcut: 'a' },
+        ...(status.found ? [{ name: 'Check the configured credentials online again', value: 'verify', shortcut: 'v' }] : [])
+      ]
+    }, { input, output });
+    if (choice === 'done') return status;
+    if (choice === 'verify') {
+      await printIntegrationVerification(status.config, { env, output, verifyIntegration });
+      continue;
+    }
+    const side = choice.toUpperCase();
+    const pasted = await textPrompt({
+      message: `Paste the ${side} service key JSON or the path to its .json file`,
+      secret: true,
+      validate: value => {
+        try {
+          pastedServiceKey(side, value, env);
+          return true;
+        } catch (error) {
+          return error.message;
+        }
+      }
+    }, { input, output });
+    const config = pastedServiceKey(side, pasted, env);
+    const report = await printIntegrationVerification({ [choice]: config }, { env, output, verifyIntegration });
+    if (!report[choice].signed_in && !await confirmPrompt('Save this key anyway? (y/n, Enter=no)', { input, output, defaultYes: false })) continue;
+    const path = await storeIntegrationKey(side, config, env);
+    print(output, formatStatus(`Saved the ${side} key to ${path} (readable only by you; not written to mcp.json).`, 'success', output, 'Integration Suite'));
+    let fromEnvironment = null;
+    try {
+      fromEnvironment = resolveIntegrationSideFromEnvironment(env, side);
+    } catch {
+      // A broken environment value is reported by the status lines below.
+    }
+    if (fromEnvironment) print(output, formatStatus(`${side} credentials from ${fromEnvironment.source} in this environment take precedence over the saved key.`, 'warning', output, 'Integration Suite'));
+    status = integrationSuiteCredentialStatus(env);
+    for (const line of status.lines) print(output, `  ${line}`);
+  }
+}
+
+async function promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration = defaultVerifyIntegration, ask = true }) {
+  print(output, '');
+  print(output, formatStatus('SAP Integration Suite tools (Cloud Integration + API Management).', 'step', output, 'Integration Suite'));
+  print(output, '  Adds the sap-ai-integration MCP server: iFlows, value mappings, security material and monitoring in CPI; API providers, proxies, policies, products and key value maps in APIM.');
+  print(output, '  Every write needs an exact confirmation string; there are no delete tools and secrets are write-only. Agents: SAP Integration Architect, SAP Integration Developer.');
+  if (alreadyConfigured) print(output, '  Already configured in this MCP config; keeping it and refreshing its version.');
+  const status = integrationSuiteCredentialStatus(env);
+  for (const line of status.lines) print(output, `  ${line}`);
+  if (!status.found) {
+    print(output, '  The server needs CPI_SERVICE_KEY and/or APIM_SERVICE_KEY (or CPI_*/APIM_* variables, VCAP_SERVICES) in the MCP host environment,');
+    print(output, '  or a service key pasted in the next step (verified online, then saved for your user only). Credentials are never written to mcp.json.');
+  }
+  if (ask && !alreadyConfigured) {
+    print(output, '');
+    const defaultYes = status.found;
+    if (!await confirmPrompt(`Add the SAP Integration Suite tools? (y/n, Enter=${defaultYes ? 'yes' : 'no'})`, { input, output, defaultYes })) return false;
+  }
+  await configureIntegrationCredentials({ env, input, output, verifyIntegration });
+  return true;
+}
+
+/** `sap-ai-dev --setup-integration`: only the Integration Suite step (paste, verify, add the server), keeping every other MCP entry. */
+export async function runIntegrationSuiteSetup({
+  env = process.env,
+  input = stdin,
+  output = stdout,
+  install = installMcpConfig,
+  verifyIntegration = defaultVerifyIntegration
+} = {}) {
+  if (!input.isTTY || !output.isTTY) {
+    print(output, formatStatus('Interactive setup needs a terminal. Rerun sap-ai-dev --setup-integration from a terminal.', 'warning', output, 'SAP AI Dev Toolkit'));
+    return { skipped: true, reason: 'non-tty' };
+  }
+  let alreadyConfigured = false;
+  try {
+    alreadyConfigured = Boolean((await readMcpConfig(await resolveMcpConfigPath(env)))?.servers?.['integration-suite']);
+  } catch {
+    // A missing or unreadable config is created or healed by install.
+  }
+  await promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration, ask: false });
+  const result = await install([], { env, sapDevelopmentServers: ['integration-suite'], additive: true });
+  print(output, '');
+  print(output, formatStatus(`Configured the Integration Suite MCP server${result?.path ? ` in ${result.path}` : ''}.`, 'success', output, 'Integration Suite'));
+  for (const message of Array.isArray(result?.warnings) ? result.warnings : []) print(output, formatStatus(message, 'warning', output, 'Warning'));
+  return { selected: [], ...(result || {}) };
 }
 
 function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false, browserPath } = {}) {
@@ -613,7 +770,8 @@ export async function runSetup({
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false,
   detectAdtUrl,
-  discoverSsoBrowsers = findRemoteControllableSsoBrowsers
+  discoverSsoBrowsers = findRemoteControllableSsoBrowsers,
+  verifyIntegration = defaultVerifyIntegration
 } = {}) {
   const isBas = Boolean(env.H2O_URL);
   if (!isBas && (!input.isTTY || !output.isTTY)) {
@@ -661,11 +819,13 @@ export async function runSetup({
   let configPath;
   let managedKeys = [];
   let previousAdtUrls = new Map();
+  let integrationSuiteConfigured = false;
   try {
     configPath = await resolveMcpConfigPath(env);
     const existingConfig = await readMcpConfig(configPath);
     managedKeys = collectManagedCloudFoundryKeyReferences(existingConfig);
     previousAdtUrls = previousLocalAdtUrls(existingConfig);
+    integrationSuiteConfigured = Boolean(existingConfig?.servers?.['integration-suite']);
   } catch {
     warnings.push('Existing MCP config could not be read before setup; existing CF service keys will not be reused.');
   }
@@ -750,6 +910,7 @@ export async function runSetup({
   };
   let selected;
   let additiveSetup = false;
+  let integrationOnly = false;
   if (!selectable.length) {
     // Nothing was detected — no BAS/CF destinations, or no SAP GUI entries.
     // Offer the manual MCP entry wizard before giving up.
@@ -761,23 +922,34 @@ export async function runSetup({
       defaultValue: 'manual',
       choices: [
         { name: '✍️  Start manual entry wizard (system name, ADT URL, client, login)', value: 'manual', shortcut: 'm' },
+        { name: '🔌 Set up only the SAP Integration Suite tools (paste and verify CPI / API Management service keys)', value: 'integration', shortcut: 'i' },
         { name: 'Exit setup without changes', value: 'exit', shortcut: 'e' }
       ]
     }, { input, output });
-    if (choice !== 'manual') return await exitWithoutDestinations();
-    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser });
-    additiveSetup = true;
-    if (!selected.length) return await exitWithoutDestinations();
+    if (choice === 'integration') {
+      selected = [];
+      additiveSetup = true;
+      integrationOnly = true;
+    } else {
+      if (choice !== 'manual') return await exitWithoutDestinations();
+      selected = await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser });
+      additiveSetup = true;
+      if (!selected.length) return await exitWithoutDestinations();
+    }
   } else {
     selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls, selectSsoBrowser });
     additiveSetup = selected.length > 0;
   }
 
   let sapDevelopmentServers = [];
-  if (includeSapDevelopmentToolsPrompt) {
+  if (integrationOnly) {
+    await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, ask: false });
+    sapDevelopmentServers = ['integration-suite'];
+  } else if (includeSapDevelopmentToolsPrompt) {
     print(output, '');
-    print(output, formatStatus('Optionally add companion MCP servers for full-stack SAP development and HANA inspection.', 'step', output, 'Tools'));
+    print(output, formatStatus('Optionally add companion MCP servers for full-stack SAP development, HANA inspection, and Integration Suite (CPI/API Management).', 'step', output, 'Tools'));
     print(output, '  HANA Cloud inspector is read-only and uses HANA_RO_* or VCAP_SERVICES already present in the MCP host environment; credentials are not written to mcp.json.');
+    print(output, '  Integration Suite uses CPI/APIM service keys from the MCP host environment or keys you paste next (verified online, saved for your user only); credentials are not written to mcp.json.');
     print(output, '  Leave empty to only configure ABAP/ADT destination servers.');
     print(output, '');
     sapDevelopmentServers = await checkboxPrompt({
@@ -785,11 +957,17 @@ export async function runSetup({
       choices: SAP_DEVELOPMENT_MCP_SERVERS.map(server => ({
         value: server.id,
         name: `${server.name} — ${server.description}`,
-        checked: false
+        checked: server.id === 'integration-suite' && integrationSuiteConfigured
       })),
       required: false,
       shortcuts: { all: 'a' }
     }, { input, output });
+    if (sapDevelopmentServers.includes('integration-suite')) {
+      await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, ask: false });
+    }
+  } else if (await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration })) {
+    // Without --tools, Integration Suite still gets its own yes/no step instead of being hidden.
+    sapDevelopmentServers = ['integration-suite'];
   }
 
   try {

package/tools.md

@@ -1,6 +1,6 @@
 # Curated SAP tools exposed through the BAS proxy
 
-The proxy no longer advertises every tool provided by the SAP runtime. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a curated set of upstream tools plus local workflow tools (currently 72 tools when all upstream capabilities are registered).
+The proxy no longer advertises every tool provided by the SAP runtime. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a curated set of upstream tools plus local workflow tools (up to 75 tools: 74 destination-scoped tools plus one workspace-scoped project-lint tool).
 
 The names below are the logical tool names. Publicly they are exposed in lowercase snake_case without a prefix (`get_table_contents`, `run_query`) because each generated MCP server is scoped to one destination; only when a single server fronts multiple destinations does each name gain its destination slug (`demo-abap_get_table_contents`) to stay unambiguous. BAS/VS Code chat tool references bind only lowercase identifiers, so mixed-case names never reach the model.
 
@@ -73,11 +73,11 @@ Hidden upstream tools are not directly callable through the proxy. Local workflo
 - `UnpublishServiceBinding`
 - `WriteSource`
 
-`CreatePackage` creates a local package or a transportable package with an explicit transport; it changes SAP state and requires explicit approval. `CreateTable` creates a transparent DDIC table, writes its generated DDL source, and activates it. `GetStructure`, `GetTypeInfo`, and `GetMessages` are read-only metadata lookups. The upstream VSP package and transport mutation checks still apply. The pinned backend does not create structures, table types, or authorization objects.
+`CreatePackage` creates a local package or a transportable package with an explicit transport; it changes SAP state and requires explicit approval. `CreateTable` creates a transparent DDIC table, writes its generated DDL source, and activates it. Client-dependent tables already get the implicit `CLIENT` key; supplied `CLIENT` or `MANDT` fields map to that same key and are not emitted twice. `GetStructure`, `GetTypeInfo`, and `GetMessages` are read-only metadata lookups. The upstream VSP package and transport mutation checks still apply. The pinned backend does not create structures, table types, or authorization objects.
 
 ## Hidden from direct proxy calls
 
-Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
+Broad/destructive surfaces such as generic object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. The local `DeleteEmptyDDLS` workflow is a narrow exception: it verifies the source is blank and requires exact confirmation before deleting a Z/Y DDLS shell. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
 
 ## Local and destination-scoped workflow tools
 
@@ -86,6 +86,8 @@ The proxy adds local tools to the MCP surface. Some are workspace-wide; others a
 - `LintABAP` — local in-memory ABAP linting.
 - `LintABAPProject` — scan serialized ABAP objects in the configured workspace root (SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT, defaulting to the MCP server working directory) using the project abaplint config and available local dependency folders. This is static analysis only; it does not contact SAP or activate objects.
 - `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
+- `UpdateTable` — update and activate an existing Z/Y DDIC table from replacement DDL after comparing expected_source with `GetTable`; the write uses VSP's hash check under lock and requires `UPDATE TABLE <TABLE_NAME>` confirmation.
+- `DeleteEmptyDDLS` — delete only a blank Z/Y DDLS source after an emptiness check and exact `DELETE EMPTY DDLS <OBJECT_NAME>` confirmation. It calls the hidden generic delete operation internally.
 - `PrepareABAPChangeSet` and `ApplyABAPChangeSet` — review full-source diffs and recheck source before explicit writes.
 - `CheckTransportReadiness` — collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC results.
 - `PlanABAPCloudMigration` — batch SAP API release-state checks and prioritize recognized unreleased results.
@@ -108,3 +110,79 @@ The optional `hana-cloud-inspector` companion starts `sap-ai-hana` as a separate
 - `hana_read_rows` — perform parameterized reads of selected columns, capped at 200 rows; credential-like columns are blocked and arbitrary SQL is not accepted.
 
 Connection secrets are read from the MCP host environment via explicit `HANA_RO_*` variables or a selected `VCAP_SERVICES` binding and are not written to `mcp.json`. TLS certificate verification is mandatory. No HANA write, DDL/DML, deploy/undeploy, grants, or service-key tools are exposed; deployment remains a user-run project workflow.
+
+## Separate optional Integration Suite server
+
+The optional `integration-suite` companion starts `sap-ai-integration` as a separate stdio MCP server for SAP Cloud Integration (CPI) and API Management (APIM). It does not use the BAS proxy or a destination prefix. Tools for a side appear only when that side is configured:
+
+- `integration_connection_info` — show which of CPI/APIM are configured, the credential source, and tenant hosts; with `verify: true` it signs in and reports per tool area whether the service key has the needed role. Never returns client ids or secrets.
+
+Cloud Integration — design time:
+
+- `cpi_list_packages` — list Cloud Integration packages.
+- `cpi_list_iflows` — list the iFlows of one package.
+- `cpi_list_package_artifacts` — list a package's iFlows, value mappings, script collections, and message mappings.
+- `cpi_get_iflow` — read iFlow metadata, externalized configuration, and bundle files (or one file by path).
+- `cpi_get_artifact` — read a value mapping, script collection, or message mapping with its bundle files.
+- `cpi_get_value_mappings` — read value-mapping agency pairs with their value and default pairs.
+- `cpi_create_package` — create a package.
+- `cpi_update_package` — change package name, short text, description, or version.
+- `cpi_copy_package` — copy a Discover package into Design (new copy with suffix, or overwrite-merge keeping configuration).
+- `cpi_create_iflow` — create an iFlow from the vetted HTTPS → Request Reply → HTTP template or caller-supplied BPMN.
+- `cpi_update_iflow` — replace/add bundle files and parameters with an expected-version check and patch-version bump.
+- `cpi_update_iflow_configuration` — set externalized configuration parameters.
+- `cpi_upsert_value_mappings` — add or change value-mapping pairs.
+- `cpi_update_script_collection` — add or replace scripts in a script collection.
+
+Cloud Integration — deployment and monitoring:
+
+- `cpi_deploy_iflow` — deploy the active iFlow version and wait for build and runtime status.
+- `cpi_deploy_artifact` — deploy a value mapping, script collection, or message mapping and wait for runtime status.
+- `cpi_undeploy_artifact` — undeploy any runtime artifact and wait until it is gone.
+- `cpi_list_runtime_artifacts` — list deployed artifacts, optionally by status.
+- `cpi_get_iflow_runtime_status` — read deployed runtime status, including error text when the iFlow failed to start.
+- `cpi_list_service_endpoints` — list deployed endpoint URLs, optionally for one iFlow.
+- `cpi_list_message_logs` — list message processing logs by iFlow, status, time window, correlation id, application message id, or custom header.
+- `cpi_get_message_log` — read one message log with error text and custom header properties; payload attachments are never read.
+- `cpi_get_message_log_steps` — read the processing steps of a message's latest run with step errors.
+- `cpi_get_jms_broker_status` — read JMS broker capacity and queues that are not healthy.
+- `cpi_list_data_stores` — list data stores with message and overdue counts.
+- `cpi_list_data_store_entries` — list entry metadata of one data store; payloads are never read.
+- `cpi_list_variables` — list global and iFlow variables (metadata only).
+
+Cloud Integration — security material and tenant configuration:
+
+- `cpi_list_security_material` — list user credentials, OAuth2 client credentials, or keystore entries with secret fields redacted.
+- `cpi_set_user_credential` — create or update a user credential; the password is write-only.
+- `cpi_set_oauth2_client_credential` — create or update an OAuth2 client credential; the client secret is write-only.
+- `cpi_upload_certificate` — add or replace a public certificate in the tenant keystore.
+- `cpi_list_number_ranges` — list number ranges.
+- `cpi_set_number_range` — create or update a number range.
+- `cpi_list_partner_parameters` — list Partner Directory string parameters and binary parameter metadata.
+- `cpi_set_partner_parameter` — create or update a Partner Directory string or binary parameter.
+- `cpi_odata_get` — guarded read-only GET for other CPI entity sets (for example access policies or JMS queues) and the service metadata.
+
+API Management:
+
+- `apim_list_api_providers` — list API providers without credential fields.
+- `apim_get_api_provider` — read one API provider with credential properties removed.
+- `apim_create_api_provider` — create an Internet or On-Premise (Cloud Connector) API provider without credentials.
+- `apim_update_api_provider` — change host, port, type, location, path prefix, or sap-client of a credential-free provider.
+- `apim_list_api_proxies` — list API proxies.
+- `apim_get_api_proxy` — read one API proxy with endpoints, virtual hosts, and the computed runtime URL.
+- `apim_export_api_proxy` — export an API proxy bundle and return its files (policies, endpoints, scripts).
+- `apim_list_virtual_hosts` — list virtual hosts.
+- `apim_create_api_proxy` — import (and thereby deploy) a policy-free API proxy for a provider or https URL target.
+- `apim_update_api_proxy` — change base path, target, title, or description; existing policies and steps are kept.
+- `apim_attach_api_proxy_policies` — add or replace policies (API key, quota, spike arrest, CORS, headers, OAuth, IP allow list, response cache, Basic auth from a key value map, raise fault, JavaScript, custom XML) and their flow steps, then redeploy.
+- `apim_list_api_products` — list API products.
+- `apim_get_api_product` — read one API product with its proxies.
+- `apim_create_api_product` — create (and by default publish) an API product over existing proxies with an optional quota.
+- `apim_update_api_product` — change product title, description, scope, quota, or publish state.
+- `apim_list_key_value_maps` — list key value maps.
+- `apim_get_key_value_map` — read one key value map; encrypted values are redacted.
+- `apim_create_key_value_map` — create a key value map; values are write-only.
+- `apim_set_key_value_map_entries` — add or change key value map entries; values are write-only.
+- `apim_odata_get` — guarded read-only GET for other Management.svc entity sets (for example applications, developers, certificate store references) and the service metadata.
+
+Credentials come from CPI/APIM OAuth client service keys in the MCP host environment (`CPI_SERVICE_KEY`/`APIM_SERVICE_KEY`, explicit `CPI_*`/`APIM_*` variables, or `VCAP_SERVICES`) and are never written to `mcp.json`. Every write requires an exact confirmation string (for example `CREATE IFLOW <iflow_id>` or `UNDEPLOY ARTIFACT <artifact_id>`) and is checked before any network call. Scope is create, update, deploy, and undeploy: there are no delete tools, and deletions stay manual in the Integration Suite UI. Secrets (passwords, client secrets, key value map values) are write-only: tools accept them as input and never return them. Message payloads, attachments, and data-store payloads are never read.