MCP & A2A for SAP Systems
As of 2026-09-23
MCP gives an agent governed access to tools, resources and prompts; A2A lets one agent delegate to another discovered through its Agent Card. This module builds both around SAP: an S/4HANA API exposed as an MCP server on SAP Integration Suite (Integration Cell only, OpenAPI 3.0.x, OAuth-based APIs, up to 30 tools per server, published through Developer Hub) or with the CAP plugin @cap-js/mcp; the user's identity carried to the backend by principal propagation through Cloud Connector (on-premise/private cloud) or SAML bearer (S/4HANA Cloud Public Edition); consumption from Joule Studio, Joule Work Desktop and third-party clients; and a pro-code agent wired to Joule over A2A (dialog function agent-request, 60-second synchronous limit, IAS App2App trust). It uses the current specifications — MCP revision 2026-07-28 and A2A 1.0.0 — and ends with a per-hop security design and the registry in SAP AI Agent Hub.
What you will learn
- Explain MCP (revision 2026-07-28: tools, resources, prompts, elicitation, stdio and Streamable HTTP, OAuth 2.1 resource-server model) and A2A 1.0.0 (Agent Card, bindings, task states) and where each sits in SAP's architecture
- Expose an S/4HANA OData API as a governed MCP server on SAP Integration Suite and publish it through Developer Hub, respecting the documented constraints
- Carry the end user's identity to S/4HANA: principal propagation through Cloud Connector for on-premise/private cloud, OAuth2SAMLBearerAssertion for S/4HANA Cloud Public Edition
- Consume the MCP server from a Joule Studio agent, from Joule Work Desktop and from a third-party MCP client, and explain why each hop has its own authentication
- Wrap a pro-code CAP agent in A2A and surface it in Joule with a capability, a scenario and an agent-request dialog function deployed through the Joule CLI
Module overview
Two open protocols now decide how AI reaches SAP systems. The Model Context Protocol (MCP) lets an agent discover and call tools, read resources and use prompts exposed by a server. The Agent2Agent protocol (A2A) lets one agent delegate a task to another agent it discovered through an Agent Card. SAP's own training puts it simply: MCP gives an individual agent access to tools and data; A2A lets agents communicate, coordinate and delegate. This module shows how to expose an S/4HANA API as a governed MCP server, how to carry the user's identity to the backend, how to consume that server from Joule and from a third-party client, and how to wrap a pro-code agent in A2A so Joule can delegate to it. Every mechanism below is taken from SAP Help, SAP's architecture centre, the protocol specifications or SAP community posts written by SAP staff since July 2026.
Prerequisites
- Module M326 (Building Joule Agents with Joule Studio) or equivalent
- Working knowledge of SAP BTP destinations, SAP Cloud Identity Services and OData
- Review core concepts first: C164, C163, C105
Outcomes
- Choose between Integration Suite, CAP and a hand-written server for a given MCP use case and justify the choice by governance, identity and lifecycle.
- Configure an Integration Suite MCP server from an OpenAPI source with principal propagation and prove in Cloud Connector monitoring that the real user reached S/4HANA.
- Connect the same server to Joule Studio and to a third-party client, applying the Joule destination rules and the OAuth subscription from Developer Hub.
- Write an Agent Card and a Joule agent-request capability for a pro-code agent, and design the identity and trust for each hop.
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.