← MCP Security Catalog

@ui5/mcp-server 0.2.18

npm · @ui5/mcp-server · latest release

Verified with no proven findings
Security result
10
Observed tools
32
Version rating
100
Change risk

Independent inventory

Observed 2026-08-14T18:16:10.886Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
create_integration_cardCreate a new Integration Card, UI Integration Card, or UI5 Integration Card
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "basePath": {
      "type": "string",
      "description": "Absolute base path for the creation."
    },
    "cardFolderName": {
      "default": "card",
      "type": "string",
      "description": "Name of the folder to create the card in, inside the base path."
    },
    "cardType": {
      "default": "List",
      "type": "string",
      "enum": [
        "Analytical",
        "Calendar",
        "List",
        "Object",
        "Table",
        "Timeline"
      ],
      "description": "Type of the Integration Card to create."
    },
    "destinations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "pattern": "^[a-zA-Z0-9 .,'@_-]+$",
            "description": "Name of the destination."
          },
          "defaultUrl": {
            "type": "string",
            "description": "Default URL of the destination."
          }
        },
        "required": [
          "name",
          "defaultUrl"
        ]
      },
      "description": "List of destinations to be included in the card configuration."
    }
  },
  "required": [
    "basePath"
  ]
}
Annotations
{
  "title": "Create Integration Card",
  "readOnlyHint": false
}
create_ui5_appCreate a new basic SAPUI5 application implemented in TypeScript or JavaScript
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "appNamespace": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9_.]*$",
      "description": "The namespace for the application, e.g. com.myorg.myapp. Only lowercase alpha-numeric characters, underscores and dots are allowed."
    },
    "basePath": {
      "type": "string",
      "description": "Absolute base path for the creation. The application will be created either immediately inside this path or in a subdirectory (its name equals the application namespace), depending on the 'createAppDirectory' parameter. This base path must be absolute, not just 'app' or '.' or './something'!"
    },
    "createAppDirectory": {
      "default": true,
      "description": "Whether to create a new directory (name equals the application namespace) inside the base path. Set this to 'false' when you want to place the 'app' directly in the given base path. In SAP CAP applications, typically give the path to the 'app' folder as basePath and set this to 'true' to create an application folder. Default: true.",
      "type": "boolean"
    },
    "framework": {
      "default": "SAPUI5",
      "description": "Framework to use (OpenUI5 or SAPUI5), defaults to SAPUI5",
      "type": "string",
      "enum": [
        "OpenUI5",
        "SAPUI5"
      ]
    },
    "frameworkVersion": {
      "description": "Framework version, defaults to latest version. Omit this when in doubt. When provided, it must be a concrete semantic version, like e.g. 1.136.0. Versions older than 1.96.0 are not supported.",
      "type": "string",
      "pattern": "^\\d+\\.\\d+\\.\\d+$"
    },
    "author": {
      "description": "Author of the application (auto-detected if not provided)",
      "type": "string",
      "pattern": "^[a-zA-Z0-9 .,'@_-]+$"
    },
    "oDataV4Url": {
      "description": "URL of an OData V4 service, if applicable. This is entirely optional, but without it, the generated app UI will have no OData Model configured. Setting an URL will configure an OData V4 model in the application. Only works for OData V4 services, not for OData V2. The URL must be either a valid complete URL starting with http:// or https:// or a server-root-relative URL like '/odata/v4/serviceName' when the OData service is running on the same server. In this case, the prefix 'http://localhost:4004/' will be assumed and used by this tool for inquiries about the service. When the port is not 4004, a complete 'http://localhost:<port>...' URL must be provided. In the generated application, any 'http://localhost:<port>' prefix will be removed. HINT: when the project is a SAP CAP project and CAP/CDS tools are available, you **MUST** use them to search for OData services and entities and properties **BEFORE** calling this tool. This will help you find the correct service URL.",
      "type": "string"
    },
    "oDataEntitySet": {
      "description": "Entity set of the OData V4 service to display. Only has an effect when 'oDataV4Url' is set as well. This is optional, but setting an entity set is beneficial, as it will configure a basic UI in the application which displays the entity set.",
      "type": "string",
      "pattern": "^[a-zA-Z0-9_]+$"
    },
    "entityProperties": {
      "description": "Properties of the OData entity set to display. Only has an effect when 'oDataV4Url' and'oDataEntitySet' are set. This parameter is optional, but useful to display initial data, when the names of existing properties are known. If not provided and the service is active and reachable at tool execution time, some random properties will be displayed.",
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^[a-zA-Z0-9_]+$"
      }
    },
    "initializeGitRepository": {
      "default": true,
      "description": "Initialize a local git repository for the application, default is 'true'",
      "type": "boolean"
    },
    "runNpmInstall": {
      "default": true,
      "description": "Execute npm install after creating the application, default is 'true'",
      "type": "boolean"
    },
    "typescript": {
      "default": true,
      "description": "Whether to create a TypeScript application (true) or JavaScript application (false), default is 'true'. Although the default is preferred, the user MUST know about this option before generation, but you should not require an active decision. Also, if an overall project already exists, this should influence the language choice to keep things consistent.",
      "type": "boolean"
    }
  },
  "required": [
    "appNamespace",
    "basePath"
  ]
}
Annotations
{
  "title": "Create SAPUI5 App",
  "readOnlyHint": false
}
get_api_referenceSearch the UI5 API reference for module names and symbols
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "projectDir": {
      "type": "string",
      "description": "The root directory of the UI5 project, containing the 'package.json' and 'ui5.yaml' files. This is used to determine the UI5 framework version and libraries used in the project. "
    },
    "query": {
      "type": "string",
      "pattern": "^[^<>\"'()]+$",
      "description": "Name of the UI5 module or symbol using either dot or slash notation. Examples: 'sap.m.Button', 'sap/ui/core/Core'. Individual symbols can be requested as well, e.g. 'sap.m.Button#text', 'sap.ui.core.Core#init'"
    }
  },
  "required": [
    "projectDir",
    "query"
  ]
}
Annotations
{
  "title": "UI5 API Reference",
  "readOnlyHint": true,
  "idempotentHint": true
}
get_guidelinesThis tool MUST be called once to retrieve UI5 guidelines before working on any UI5 (SAPUI5/OpenUI5) related task or project or creating a UI5 project. The guidelines provided by this tool MUST be followed to ensure best practices and avoid common pitfalls in UI5 development.
Input schema
{
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Get UI5 Guidelines",
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
get_integration_cards_guidelinesThis tool MUST be called once to retrieve Integration Cards guidelines before working on any Integration Card related task or creating an Integration Card. The guidelines provided by this tool MUST be followed to ensure best practices and avoid common pitfalls in Integration Cards development.Integration Cards are also called 'UI Integration Cards' or 'UI5 Integration Cards'.
Input schema
{
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Get Integration Cards Guidelines",
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
get_project_infoGet general information about a local UI5 project.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "projectDir": {
      "type": "string",
      "description": "Root directory of the UI5 project to analyze. Must be an absolute path. If a path to a file is provided, the root directory will be determined automatically."
    }
  },
  "required": [
    "projectDir"
  ]
}
Output schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "projectDir": {
      "type": "string",
      "description": "The root directory of the UI5 project, containing the 'package.json' and 'ui5.yaml' files."
    },
    "projectName": {
      "type": "string",
      "description": "The name of the project. Note that this may *not* be the namespace"
    },
    "projectType": {
      "type": "string"
    },
    "frameworkName": {
      "description": "Whether the project uses OpenUI5 or SAPUI5",
      "type": "string",
      "enum": [
        "OpenUI5",
        "SAPUI5"
      ]
    },
    "frameworkVersion": {
      "description": "The version of the framework used in the project",
      "type": "string"
    },
    "frameworkLibraries": {
      "description": "The framework libraries used in the project",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "versionInfo": {
      "type": "object",
      "properties": {
        "supportStatus": {
          "type": "string"
        },
        "isLts": {
          "description": "Whether the framework version is a Long Term Support (LTS) version",
          "type": "boolean"
        },
        "latestVersion": {
          "type": "string"
        },
        "latestLtsVersion": {
          "type": "string"
        }
      },
      "required": [
        "supportStatus",
        "latestVersion"
      ],
      "additionalProperties": false
    }
  },
  "required": [
    "projectDir",
    "projectName",
    "projectType"
  ],
  "additionalProperties": false
}
Annotations
{
  "title": "UI5 Project Info",
  "readOnlyHint": true,
  "idempotentHint": true
}
get_typescript_conversion_guidelinesThis tool MUST be called once before converting a UI5 (SAPUI5/OpenUI5) project from JavaScript to TypeScript. The instructions provided by this tool MUST be followed to ensure that the project setup and code is correctly converted.
Input schema
{
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Get TypeScript Conversion Guidelines",
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
get_version_infoGet version information for UI5 (OpenUI5 or SAPUI5)
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "frameworkName": {
      "type": "string",
      "enum": [
        "OpenUI5",
        "SAPUI5"
      ],
      "description": "The UI5 framework to get version information for"
    }
  },
  "required": [
    "frameworkName"
  ]
}
Output schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "versions": {
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {
        "type": "object",
        "properties": {
          "version": {
            "type": "string"
          },
          "support": {
            "type": "string"
          },
          "lts": {
            "type": "boolean"
          }
        },
        "required": [
          "version",
          "support",
          "lts"
        ],
        "additionalProperties": false
      },
      "description": "All known versions with their support information"
    }
  },
  "required": [
    "versions"
  ],
  "additionalProperties": false
}
Annotations
{
  "title": "UI5 Version Info",
  "readOnlyHint": true,
  "idempotentHint": true
}
run_manifest_validationValidates UI5 manifest file. After making changes, you should always run the validation again to verify that no new problems have been introduced.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "manifestPath": {
      "type": "string",
      "description": "Absolute path to the manifest file to validate."
    }
  },
  "required": [
    "manifestPath"
  ]
}
Output schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "isValid": {
      "type": "boolean",
      "description": "Whether the manifest is valid according to the UI5 Manifest schema."
    },
    "errors": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "keyword": {
            "type": "string",
            "description": "Validation keyword."
          },
          "instancePath": {
            "type": "string",
            "description": "JSON Pointer to the location in the data instance (e.g., `/prop/1/subProp`)."
          },
          "schemaPath": {
            "type": "string",
            "description": "JSON Pointer to the location of the failing keyword in the schema."
          },
          "params": {
            "type": "object",
            "propertyNames": {},
            "additionalProperties": {},
            "description": "An object with additional information about the error."
          },
          "propertyName": {
            "description": "Set for errors in `propertyNames` keyword schema.",
            "type": "string"
          },
          "message": {
            "description": "The error message.",
            "type": "string"
          }
        },
        "required": [
          "keyword",
          "instancePath",
          "schemaPath",
          "params"
        ],
        "additionalProperties": false
      },
      "description": "Array of validation error objects as returned by Ajv."
    }
  },
  "required": [
    "isValid",
    "errors"
  ],
  "additionalProperties": false
}
Annotations
{
  "title": "Manifest Validation",
  "readOnlyHint": true
}
run_ui5_linterRun UI5 linter on a UI5 project to find and optionally fix UI5 related problems like the usage of deprecated API. After making changes, you should always run the linter again to verify that no new problems have been introduced.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "projectDir": {
      "type": "string",
      "description": "Root directory of the UI5 project to analyze. Must be an absolute path. Typically this the directory where the 'package.json' and 'ui5.yaml' files are located."
    },
    "fix": {
      "default": false,
      "description": "Attempt to automatically correct certain findings in the files. Only the remaining findings will be returned.",
      "type": "boolean"
    },
    "filePatterns": {
      "description": "File paths or patterns to lint. If not provided, all files in the project will be linted.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "provideContextInformation": {
      "default": true,
      "description": "Whether to include supplementary information in the output. This includes UI5 API reference and documentation resources. When calling the tool multiple times for the same file or project, refrain from requesting additional context every time.",
      "type": "boolean"
    }
  },
  "required": [
    "projectDir"
  ]
}
Output schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "projectDir": {
      "type": "string"
    },
    "frameworkVersion": {
      "description": "The version of UI5 used in the project",
      "type": "string"
    },
    "results": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "filePath": {
            "type": "string"
          },
          "messages": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "ruleId": {
                  "type": "string"
                },
                "severity": {
                  "type": "number",
                  "description": "2 = error, 1 = warning"
                },
                "line": {
                  "type": "number"
                },
                "column": {
                  "type": "number"
                },
                "fatal": {
                  "type": "boolean"
                },
                "message": {
                  "type": "string"
                },
                "messageDetails": {
                  "type": "string"
                }
              },
              "required": [
                "ruleId",
                "severity",
                "message"
              ],
              "additionalProperties": false
            }
          }
        },
        "required": [
          "filePath",
          "messages"
        ],
        "additionalProperties": false,
        "description": "Linting results for a single file in the project"
      }
    },
    "contextInformation": {
      "type": "object",
      "properties": {
        "ruleDescriptions": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "ruleId": {
                "type": "string"
              },
              "description": {
                "type": "string"
              }
            },
            "required": [
              "ruleId",
              "description"
            ],
            "additionalProperties": false
          },
          "description": "Brief descriptions of the rules that were found to be violated in the project"
        },
        "migrationGuides": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "title": {
                "type": "string"
              },
              "text": {
                "type": "string"
              },
              "uri": {
                "type": "string"
              }
            },
            "required": [
              "title",
              "text",
              "uri"
            ],
            "additionalProperties": false
          },
          "description": "For problems the linter can't fix automatically, \"fix hint\" documents may be provided as guidance for manually resolving them."
        },
        "apiReferences": {
          "type": "array",
          "items": {},
          "description": "Short extracts from the UI5 API reference for the APIs mentioned in the linter report"
        },
        "documentationResources": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "title": {
                "type": "string"
              },
              "text": {
                "type": "string"
              },
              "uri": {
                "type": "string"
              }
            },
            "required": [
              "title",
              "text",
              "uri"
            ],
            "additionalProperties": false
          },
          "description": "Relevant pages in the UI5 documentation that may help to understand the findings and how to resolve them best."
        }
      },
      "required": [
        "ruleDescriptions",
        "migrationGuides",
        "apiReferences",
        "documentationResources"
      ],
      "additionalProperties": false
    }
  },
  "required": [
    "projectDir",
    "results"
  ],
  "additionalProperties": false
}
Annotations
{
  "title": "UI5 linter",
  "readOnlyHint": false
}

Resources 0

Resource templates 0

Prompts 0

Changes from previous version

Compared with initial baseline using full_baseline.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: eaed135e034a0e0a2cf870581124045d0869df5833fe8a0cb556b55fa6ed5ea8

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.