Lesson 4 of 6
SAP's CAP, UI5 and Fiori MCP servers with a coding agent
9 min
Listen to this lesson
After the first sprint, Elena moves to VS Code on her laptop, where the team's coding agent runs. SAP has published three open-source MCP servers that give any MCP-capable agent SAP-specific knowledge and tools. At SAP TechEd 2025, SAP announced local MCP servers for SAP Build that work with coding assistants such as Claude Code, Cursor, Windsurf, Cline and OpenAI Codex; the CAP, UI5 and Fiori servers are published as open source on GitHub. They run on the developer's machine, started by the agent's MCP client; they are not BTP services.
| Server (npm package) | Tools | What the agent gains |
|---|---|---|
CAP: @cap-js/mcp-server | search_model (fuzzy search over the compiled CDS model: entities, fields, services, annotations, endpoints); search_docs (semantic search over CAP documentation, run locally with embeddings) | Answers from the project's real model and current CAP docs instead of memory |
UI5: @ui5/mcp-server | create_ui5_app, create_integration_card, get_api_reference, get_guidelines, get_integration_cards_guidelines, get_project_info, get_typescript_conversion_guidelines, get_version_info, run_manifest_validation, run_ui5_linter | Scaffolding, API reference, linting and manifest validation |
Fiori: @sap-ux/fiori-mcp-server | search_docs, list_fiori_apps, list_sap_systems, download_odata_service_metadata, generate_fiori_app_odata, generate_fiori_app_cap, and the three-step list_functionality, get_functionality_details, execute_functionality | Generating and modifying Fiori elements apps through tools rather than free-form edits |
SAP's open-source MCP servers for CAP, UI5 and Fiori, with tools as listed in their GitHub READMEs (checked October 2026; all Apache-2.0).
Connecting them to Claude Code
Each README gives commands for several clients. For Claude Code, they follow the same pattern: claude mcp add, a scope, a name, and the npx command that starts the server. The CAP README shows claude mcp add --scope user cds-mcp -- npx -y @cap-js/mcp-server; the UI5 README shows claude mcp add --transport stdio --scope user ui5-mcp-server -- npx -y @ui5/mcp-server; the Fiori README shows claude mcp add fiori-mcp -- npx --yes @sap-ux/fiori-mcp-server@<version> fiori-mcp. Claude Code stores user and local scope in the user's configuration and project scope in a .mcp.json file in the repository, which the team can review like code.
- Pin versions. The Fiori README recommends a pinned version instead of latest for reproducible behavior. The CAP README notes that tools are meant for AI models and don't constitute a stable API, so expect changes.
- Know the network calls. The Fiori server downloads an embedding model (about 86 MB) on first use of search_docs. The CAP server fetches documentation embeddings unless you set
CDS_MCP_OFFLINE. The UI5 server restricts the domains its tools may reach (default: localhost and services.odata.org) throughUI5_MCP_SERVER_ALLOWED_DOMAINS; an empty value allows any domain. - Know the telemetry. The Fiori server's README says telemetry is on by default (non-personal data) and documents two opt-outs: a setting in
~/.fioritools/telemetrysettings.jsonand the environment variableSAP_UX_FIORI_TOOLS_DISABLE_TELEMETRY. - Use project scope deliberately. A
.mcp.jsonin the repository means every developer runs the same servers; Claude Code asks for approval before using project-scoped servers in interactive sessions.
Rules for the agent
MCP servers give the agent tools; rules tell it when to use them. The CAP README suggests two rules for an AGENTS.md file: search CDS definitions with the CAP server first and read .cds files only if that fails, and search CAP docs every time before creating or changing models or using CAP APIs. The Fiori README adds rules such as starting with a List Report and Object Page and using UUID keys. Contoso's project file adds its own: never change db/data to make a test pass, run npm test after every change, and stop for review before touching authorization annotations.
Rules in a file guide the agent; they don't enforce anything. Claude Code's documentation is explicit that a CLAUDE.md file is treated as context, and that hard limits come from permission rules or hooks. If "never change authorization annotations without review" must hold, back it with a control the agent can't talk itself past: a permission rule that asks before editing the annotations file, a hook, or a protected branch that requires the security lead's approval.
| Concern | SAP Build Code with Joule | VS Code with MCP servers and an agent |
|---|---|---|
| Where it runs | Cloud dev space in Business Application Studio | Developer's machine; servers start locally |
| Who supplies the model | SAP (Joule), or AI Chat with SAP's or your configured provider | Your agent's provider under your company's terms |
| Strength | Guided generation from the storyboard; little setup | Works across the whole repository, tests and git |
| Main risk | Accepting generated code without review | Broad local permissions; unpinned tool versions |
| Controls | Entitlements, admin AI switch, roles | Agent permissions, approved servers, pinned versions |
What would you do?
A developer commits a .mcp.json that starts @sap-ux/fiori-mcp-server@latest and @ui5/mcp-server with UI5_MCP_SERVER_ALLOWED_DOMAINS set to an empty value, "so nothing gets blocked". Nadia reviews the pull request. What should she ask for?
- SAP's CAP, UI5 and Fiori MCP servers are open source (Apache-2.0) and run locally with any MCP-capable agent.
- CAP: search_model and search_docs. UI5: scaffolding, API reference, linter, manifest validation. Fiori: generate and modify Fiori elements apps.
- Pin versions, know each server's network calls and telemetry, and review project-scoped .mcp.json like code.
- Put rules in AGENTS.md or CLAUDE.md so the agent uses the servers and stops before sensitive changes.
Check your understanding · not graded
Lesson check
1. What does the CAP MCP server's search_model tool search?
2. Which UI5 MCP server tool runs the UI5 linter on a project?
3. What does the Fiori MCP server README recommend about versions?
4. Where does Claude Code store a project-scoped MCP server configuration?