Lesson 5 of 5
Limits and guardrails
8 min
Listen to this lesson
ADT for VS Code and the ADT MCP server are young products. They're useful today, and they have limits you need to plan around. This lesson collects those limits and the first guardrails every team should set before agents change code.
Product limits to plan around
| Limit | What it means | Workaround or plan |
|---|---|---|
| Runs only with the IDE | The MCP server stops when VS Code or Eclipse closes | Keep the IDE open for agent sessions; a standalone server is under discussion only |
| Object types | Classic UI (Dynpro, Web Dynpro) and SAP GUI integration aren't in VS Code | Use Eclipse or SAP GUI for those objects |
| Custom code migration agent | Eclipse only until VS Code supports all required object types | Run migration work in Eclipse |
| License condition | SAP supports MCP tools only with a valid J4D license | Budget J4D for teams that rely on MCP |
| Tool names change | SAP renamed tools in 1.2 | Review AGENTS.md, skills and hooks after each update |
| Release differences | SAP's What's New lists backend releases per feature | Check the row for your system before relying on a feature |
Each limit has a practical answer; none of them is a reason to skip the guardrails.
Guardrails: five layers
The first layer is the strongest. An agent can't damage a system it can't reach. Because the MCP server uses the IDE's destinations, an agent machine that has no destination for CMQ or CMP can't touch them, whatever the prompt says. The second layer, access restrictions, is SAP's built-in control; keep it on. The third and fourth layers depend on the agent host and the team's discipline. The fifth layer is the one that existed before AI: quality gates and review.
Security and privacy, in SAP's words
- If a workstation is compromised, SAP says the protective measures no longer work: ADT for Eclipse, ADT for VS Code and the MCP server may all be exposed. Agent machines need normal endpoint security.
- Prompt injection may compromise the client system. Validate every MCP server you install, and treat text the agent reads (comments, error messages, documents) as data, not instructions.
- Any additional MCP server a user adds is that user's responsibility; SAP disclaims responsibility for third-party MCP tools.
- Connecting the MCP server to a third-party AI service may expose processed data, including business data from feeds, to that provider.
Pilot exit criteria
| Criterion | Evidence | Owner |
|---|---|---|
| Agents stayed in scope | No out-of-package edits in the pilot log or transport diffs | Kenji |
| Quality held | ATC priority 1 and 2 findings at release: zero; ABAP Unit pass rate unchanged | Kenji |
| Security controls in place | No CMQ or CMP destinations on agent machines; restrictions on; feeds deselected | Nadia |
| Support path clear | J4D license confirmed; BC-DWB-AIV process documented | Sam |
| Value shown | Time saved on agreed tasks, measured against a baseline | Grace |
A pilot ends with evidence for each criterion and a named owner, not with an impression.
Keeping up
Expect the details in this course to move. SAP shipped four releases of the extension between June and October 2026 and renamed the MCP tools once. Assign someone to watch three places: the Marketplace version history, the What's New page in SAP's documentation, and the ABAP Cloud roadmap that SAP now uses instead of listing plans in release blogs. SAP TechEd runs from 27 to 29 October 2026, so plan a review of your AGENTS.md, tool selections and pilot rules in early November.
A compliance note
SAP's API Policy FAQ (question 33) lists SAP's own ADT and SAP-provided developer tools that use ADT APIs among the endorsed channels for development, and says ADT APIs aren't intended for reading application tables, exporting business data or agentic AI workflows on business data. Using the ADT MCP server for development tasks fits that description. Using it, or any tool, to pull business data into an agent doesn't. Keep agent work on code, not data.
What would you do?
Theo, Contoso's integration lead, wants to use the ADT MCP server's SQL Notebook and feed tools to let an agent analyze failed IDoc postings in CMQ, because the data there is "only test data". What should Kenji and Nadia decide?
- Plan around limits: IDE-bound server, VS Code object scope, Eclipse-only migration agent, license condition, renamed tools.
- The strongest guardrail is reach: no CMQ or CMP destinations on agent machines.
- Keep access restrictions on and the edit tool off unless needed.
- Treat prompt injection, workstation compromise and data exposure as real risks.
- Keep agents on code, not business data.
Check your understanding · not graded
Lesson check
1. Why is "no CMQ or CMP destination on agent machines" such a strong guardrail?
2. What does SAP's security page say about additional MCP servers a user adds?
3. Which agent use fits SAP's API Policy FAQ description of endorsed ADT use?