From f58f23d697595ba12a4da30e6a9c5625bbaf9ed3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirko=20G=C3=BCnther?= Date: Mon, 13 Jul 2026 09:02:17 +0200 Subject: [PATCH 1/3] docs: Enhance MCP documentation. --- guides/protocols/mcp.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/guides/protocols/mcp.md b/guides/protocols/mcp.md index f63dc6e27..a8fe7e546 100644 --- a/guides/protocols/mcp.md +++ b/guides/protocols/mcp.md @@ -5,7 +5,11 @@ synopsis: > # MCP Protocol Adapter - +> [!warning] +> The CAP MCP adapter is in **Beta** status and is **not intended for production use**. It is provided for exploration and early feedback only. Do not use this adapter in production systems or to expose business-critical data to agents. +> +> The CAP MCP adapter is designed exclusively to expose custom CAP application services via MCP. +> It is neither a recommended nor endorsed pathway for exposing SAP APIs directly via MCP to agents, since it lacks the governance, authentication, and compliance controls those APIs require. For endorsed architectures covering agentic access to SAP APIs, refer to the **[SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0)** reference architectures on AI and agentic integration patterns. The [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) is an open-source standard that enables direct integration between large language model (LLM) applications and external data sources. Any CAP service can be turned into an MCP server, allowing AI agents and LLM-powered tools to interact with the service without additional implementation work. All that is required is annotating it with [ `@mcp`](#serving-mcp). From CAP perspective MCP is just another protocol which we serve similar to _OData_, _GraphQL_, _REST_, or _HCQL_. @@ -491,5 +495,10 @@ Future versions of the adapter may add support for data changes using CREATE, UP ### Prompt Injection Attacks > [!caution] -> The MCP adapter does not perform any input validation or output validation regarding prompt injections. -> Hence, for production use cases ensure you use infrastructure and practices that mitigate prompt injection risks and connect only to trusted MCP agents (e.g., Joule). +> The MCP adapter does not perform any input or output validation regarding prompt injection attacks. +> Agents can potentially be manipulated by data returned from the service to execute unintended actions. For any deployment ensure you use infrastructure and practices that mitigate prompt injection risks and connect only to trusted MCP agents (e.g., Joule). + +### Missing Governance Controls + +> [!caution] +> The CAP MCP adapter is not designed to act as a gateway or proxy for SAP APIs and must not be used for such purposes. Exposing SAP APIs via this adapter bypasses the governance, authentication, and compliance controls those APIs require. For endorsed patterns on agentic access to SAP APIs, consult the [SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. From 000e0f5eba9d540b91a674adb8e9b1e7f6564c6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirko=20G=C3=BCnther?= Date: Mon, 13 Jul 2026 09:18:53 +0200 Subject: [PATCH 2/3] docs: Improve wording. --- guides/protocols/mcp.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/guides/protocols/mcp.md b/guides/protocols/mcp.md index 38261e7f9..2b74c8dba 100644 --- a/guides/protocols/mcp.md +++ b/guides/protocols/mcp.md @@ -9,7 +9,7 @@ synopsis: > > The CAP MCP adapter is in **Beta** status and is **not intended for production use**. It is provided for exploration and early feedback only. Do not use this adapter in production systems or to expose business-critical data to agents. > > The CAP MCP adapter is designed exclusively to expose custom CAP application services via MCP. -> It is neither a recommended nor endorsed pathway for exposing SAP APIs directly via MCP to agents, since it lacks the governance, authentication, and compliance controls those APIs require. For endorsed architectures covering agentic access to SAP APIs, refer to the **[SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0)** reference architectures on AI and agentic integration patterns. +> It is not an endorsed pathway for exposing SAP APIs directly via MCP to agents, since it lacks the required governance, authentication, and compliance controls. For endorsed architectures covering agentic access to SAP APIs, refer to the **[SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0)** reference architectures on AI and agentic integration patterns. The [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) is an open-source standard that enables direct integration between large language model (LLM) applications and external data sources. Any CAP service can be turned into an MCP server, allowing AI agents and LLM-powered tools to interact with the service without additional implementation work. All that is required is annotating it with [ `@mcp`](#serving-mcp). From CAP perspective MCP is just another protocol which we serve similar to _OData_, _GraphQL_, _REST_, or _HCQL_. @@ -501,4 +501,6 @@ Future versions of the adapter may add support for data changes using CREATE, UP ### Missing Governance Controls > [!caution] -> The CAP MCP adapter is not designed to act as a gateway or proxy for SAP APIs and must not be used for such purposes. Exposing SAP APIs via this adapter bypasses the governance, authentication, and compliance controls those APIs require. For endorsed patterns on agentic access to SAP APIs, consult the [SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. +> The adapter provides no built-in governance features: there is no rate limiting, no audit logging of agent actions, no approval workflows for sensitive operations, and no policy enforcement layer. Before using MCP in any environment beyond local development, put appropriate controls in place at the infrastructure or application level. +> +> In particular, the CAP MCP adapter must not be used as a gateway or proxy for SAP APIs, as doing so bypasses the governance, authentication, and compliance controls those APIs require. Any use of SAP APIs must be in accordance with the [SAP API Policy](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy). For endorsed patterns on agentic access to SAP APIs, consult the [SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. From 2ac29ee086d2f89700e1bb8dc9e5f2d242d1dcc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirko=20G=C3=BCnther?= Date: Mon, 13 Jul 2026 09:21:11 +0200 Subject: [PATCH 3/3] docs: Improve wording. --- guides/protocols/mcp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/guides/protocols/mcp.md b/guides/protocols/mcp.md index 2b74c8dba..69ecb4300 100644 --- a/guides/protocols/mcp.md +++ b/guides/protocols/mcp.md @@ -9,7 +9,7 @@ synopsis: > > The CAP MCP adapter is in **Beta** status and is **not intended for production use**. It is provided for exploration and early feedback only. Do not use this adapter in production systems or to expose business-critical data to agents. > > The CAP MCP adapter is designed exclusively to expose custom CAP application services via MCP. -> It is not an endorsed pathway for exposing SAP APIs directly via MCP to agents, since it lacks the required governance, authentication, and compliance controls. For endorsed architectures covering agentic access to SAP APIs, refer to the **[SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0)** reference architectures on AI and agentic integration patterns. +> It is not an endorsed pathway for exposing SAP APIs directly via MCP to agents, since it lacks the required governance, authentication, and compliance controls. For endorsed architectures covering agentic access to SAP APIs, please refer to the reference architectures published on the **[SAP Architecture Center](https://architecture.learning.sap.com/docs/ref-arch/98efa0)**. The [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) is an open-source standard that enables direct integration between large language model (LLM) applications and external data sources. Any CAP service can be turned into an MCP server, allowing AI agents and LLM-powered tools to interact with the service without additional implementation work. All that is required is annotating it with [ `@mcp`](#serving-mcp). From CAP perspective MCP is just another protocol which we serve similar to _OData_, _GraphQL_, _REST_, or _HCQL_.