SAP MCP Server

162 of the 377 tools listed anonymously say in their own descriptions that they need an account or a key (sap_register_agent, sap_update_agent, sap_deactivate_agent, sap_reactivate_agent, sap_agent_migrate_pricing_menu, sap_close_agent, sap_report_calls, sap_update_reputation_metrics, sap_get_agent, sap_get_agent_stats, sap_get_global_state, sap_get_network_overview, sap_get_agent_profile, sap_is_agent_active, sap_discover_agents, sap_list_agents, sap_list_all_agents, sap_find_tools_by_category, sap_get_tool_category_summary, sap_fetch_capability_index, sap_fetch_protocol_index, sap_fetch_tool_category_index, sap_fetch_tool, sap_fetch_feedback, sap_fetch_attestation, sap_fetch_escrow, sap_fetch_escrow_v2, sap_fetch_pending_settlement, sap_fetch_dispute, sap_fetch_vault, sap_fetch_session, sap_fetch_epoch_page, sap_fetch_stake, sap_fetch_subscription, sap_x402_fetch_escrow, sap_escrow_build_settle_transaction, sap_create_escrow_v2, sap_deposit_escrow_v2, sap_settle_escrow_v2, sap_finalize_settlement_v2, sap_file_dispute_v2, sap_withdraw_escrow_v2, sap_give_feedback, sap_revoke_feedback, sap_create_attestation, sap_revoke_attestation, sap_init_vault, sap_open_vault_session, sap_inscribe_memory, sap_publish_tool_by_name, sap_update_tool, sap_deactivate_tool, sap_reactivate_tool, sap_init_stake, sap_deposit_stake, sap_create_subscription, sap_fund_subscription, sap_cancel_subscription, sap_sns_check_domain, sap_sns_batch_check_domains, sap_sns_resolve_domain, sap_sns_register_agent_domain, sap_sns_get_domain_records, sap_sns_get_record, sap_sns_resolve_wallet, sap_sns_build_set_primary_domain_transaction, sol_get_balance, spl-token_deployToken, spl-token_transfer, spl-token_transferSol, spl-token_getTokenAccounts, spl-token_mintTo, spl-token_burn, spl-token_freezeAccount, spl-token_thawAccount, spl-token_closeAccount, staking_stakeSOL, staking_unstakeSOL, staking_getStakeAccounts, staking_stakeJupSOL, staking_unstakeJupSOL, staking_stakeSolayer, staking_unstakeSolayer, bridging_bridgeWormhole, bridging_bridgeDeBridge, metaplex-nft_deployCollection, metaplex-nft_mintNFT, metaplex-nft_updateMetadata, metaplex-nft_verifyCreator, metaplex-nft_verifyCollection, metaplex-nft_setAndVerifyCollection, metaplex-nft_delegateAuthority, metaplex-nft_revokeAuthority, metaplex-nft_configureRoyalties, 3land_createCollection, 3land_mintAndList, 3land_listForSale, 3land_cancelListing, 3land_buyNFT, pump_launchToken, pump_trade, raydium-pools_createCPMM, raydium-pools_createCLMM, raydium-pools_createAMMv4, raydium-pools_addLiquidity, raydium-pools_removeLiquidity, orca_swap, orca_openPosition, orca_closePosition, orca_collectFees, manifest_placeLimitOrder, manifest_cancelOrder, meteora_createDynamicPool, meteora_createDLMMPool, meteora_addDLMMLiquidity, meteora_removeDLMMLiquidity, meteora_createAlphaVault, adrena_openPosition, adrena_closePosition, adrena_addCollateral, adrena_removeCollateral, lulo_deposit, lulo_withdraw, jito_sendBundle, alldomains_registerDomain, gibwork_createBounty, gibwork_submitWork, send-arcade_listGames, send-arcade_playGame, blinks_executeAction, blinks_confirmAction, jupiter_executeOrder, jupiter_getHoldings, jupiter_swap, jupiter_createLimitOrder, jupiter_executeTrigger, jupiter_cancelLimitOrder, jupiter_cancelLimitOrders, jupiter_createDCA, jupiter_executeDCA, jupiter_cancelDCA, jupiter_smartSwap, sap_sign_transaction, sap_build_sol_transfer, sap_build_spl_transfer, sap_webhook_catalog, sap_premium_webhook_unregister, sap_premium_webhook_status, sap_premium_webhook_relay, sap_premium_webhook_relay_status, sap_perp_markets, sap_perp_position_info, sap_perp_funding_history, sap_adrena_trade_intent, sap_adrena_build_init_user_staking, sap_adrena_get_pool_info, sap_adrena_get_markets, sap_perp_fear_greed, magicblock_getDelegationStatus, magicblock_getAccountInfo, magicblock_getBlockhashForAccounts, magicblock_getRandomnessResult), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.