MCP for SAP: connecting AI models to the enterprise, safely

Before agentic AI, enterprise integration was mostly application-to-application: system A calls system B through a known, stable interface. AI clients change the shape of the problem — Claude, ChatGPT, Gemini, SAP Joule and whatever comes next each want to call into the same SAP capabilities, but none of them share an integration technology by default.

Built naively, that becomes N AI clients times M SAP capabilities in bespoke integrations — an amount of integration debt that scales badly and audits worse. Model Context Protocol exists to collapse that N×M into N+M: SAP capabilities exposed once, through one governed interface, that any compliant AI client can discover and call.

An MCP server sits between AI clients and SAP, exposing a defined set of tools — read a sales order, check inventory, trigger a workflow — each with a schema, a permission scope and an audit trail. The AI client discovers what is available at runtime rather than through a hard-coded integration, which means adding a new AI client does not require touching SAP-side code at all.

Critically, MCP does not bypass SAP authorization — it should sit on top of it. Every tool call carries the identity of the calling context, and the MCP server enforces the same authorization checks a human user would face. This is the detail that separates a production-grade MCP deployment from a demo: the agent can only do what the underlying SAP user is actually allowed to do.

We build MCP servers as first-class SAP BTP workloads — Cloud Foundry when managed simplicity is the priority, Kyma when a team needs Kubernetes-native control, both wired into SAP Integration Suite and Event Mesh for asynchronous, event-driven agent patterns. That keeps the MCP layer inside your existing BTP governance rather than as an unmanaged side process.

This is also where Clean Core and MCP intersect directly: the tools an MCP server exposes are only as safe and stable as the interfaces behind them. A well-scoped RAP or CDS-based API makes for a well-scoped MCP tool. Entangled custom code does not.