Lesson 2 of 6
MCP Gateway architecture
9 min
Listen to this lesson
The MCP Gateway is not a separate product you install. It is part of what SAP calls API-centric integration in SAP Integration Suite: a model in which security, traffic management, mediation and integration logic live together in one API artifact, deployed to a new managed runtime called the Integration Cell. SAP's documentation describes the MCP server as a first-class artifact on that runtime, with its own deployment status, version history, monitoring and transport, just like an API artifact or an integration flow.
Four ways to create an MCP server
In Design > Integrations and APIs, you open an integration package, choose Edit, then Artifacts > Add > MCP Server. The Create MCP Server dialog asks for a source type. SAP Help currently lists four:
| Source type | What it wraps | Constraints worth knowing |
|---|---|---|
| API | An OData or REST API artifact already deployed on the Integration Cell | OpenAPI 3.0.0 to 3.0.3 only (no Swagger 2.0); only APIs with OAuth-based authentication; a Synchronize option pulls later API changes |
| HTTP Endpoint with OpenAPI Specification | Any HTTPS endpoint, by URL or BTP destination, described by an OpenAPI file you upload or generate | Destinations need the label IntegrationCell.Include = true; spec generation with AI depends on edition and settings |
| RFC | Remote-enabled function modules and BAPIs in SAP S/4HANA or SAP ECC, through an RFC destination and the Cloud Connector | The Cloud Connector must expose discovery modules such as RFC_FUNCTION_SEARCH and RFC_METADATA_GET, plus BAPI_TRANSACTION_COMMIT and BAPI_TRANSACTION_ROLLBACK |
| Remote MCP Servers | An existing MCP server elsewhere, proxied and governed by Integration Suite | Internet destinations only; the remote server must support Streamable HTTP |
Source types for an MCP server, from SAP Help Portal (October 2026).
Whatever the source, the server gets an MCP Path (for example /BusinessPartner; not empty and not just /; /graph is reserved), an optional Version, the Runtime Profile (only the Integration Cell can run MCP servers) and a Virtual Host that forms the public URL. Every server is limited to 50 tools regardless of source (the limit was 15 at launch, 30 from August 2026 and 50 from the October 18, 2026 update), and responses are capped at 500,000 tokens. Inside the artifact, an MCP sender adapter receives agent requests (created automatically and read-only), and for API sources an HTTP receiver adapter forwards calls to the source API artifact with a default timeout of 60,000 ms.
Developer Hub: products and subscriptions for agents
Deploying is not the end. An administrator discovers the deployed MCP server in Developer Hub under Admin Center > Manage > Content, selects the Integration Suite business system, opens the MCP Servers tab and chooses Create Product, then publishes it. An application developer then creates a Subscription for Agent for that product, entering the agent's callback URL. Developer Hub generates the client ID and secret the agent uses to get an OAuth token. SAP's documentation calls credentials taken directly from a Process Integration Runtime service key an anti-pattern and recommends the Developer Hub route.
- Integration developerCreates and configures the MCP server in an integration package (role collection PI_Integration_Developer)
- DeployDeploys to the Integration Cell and checks the runtime status in Monitor
- Developer Hub adminBundles the server into a product with a clear description and publishes it
- Application developerCreates a subscription for an agent with its callback URL; gets client credentials
- Agent ownerConfigures the AI application with the MCP server URL and OAuth details
Contoso's target picture
Theo's team runs SAP Integration Suite with the transport path CMC_DEV > CMC_TEST > CMC_PROD. SAP documents that API and MCP server artifacts are transported between tenants with Content Transport Management, configured the same way as integration content. For the first agent use case, order status for the order-to-cash team, the plan is an API artifact over the released sales order API on CMP, reached through the Cloud Connector, and an MCP server built from that API artifact. Nothing reads S/4HANA tables directly, and nothing calls a custom RFC that is not cleared for the purpose.
- MCP servers are first-class artifacts in API-centric integration and run only on the Integration Cell runtime.
- Four source types: API artifact, HTTP endpoint with OpenAPI, RFC backend, and remote MCP server.
- Each MCP server allows at most 50 tools; API sources need OpenAPI 3.0.x and OAuth-based authentication.
- Developer Hub products and agent subscriptions are the recommended way to hand agents their credentials.
- API and MCP server artifacts are transported with Content Transport Management like integration content.
Check your understanding · not graded
Lesson check
1. Which runtime can an MCP server be deployed to, according to SAP Help?
2. An API artifact uses an OpenAPI 2.0 (Swagger) definition and basic authentication. Can you create an MCP server from it?
3. How does SAP recommend that an agent obtain its OAuth client credentials for an MCP server?
4. What does the RFC source type require on the SAP Cloud Connector?