SAP Integration Suite MCP Gateway: SAP APIs and iFlows as governed agent tools

Status as of November 2026 By Rameshkumar Varanganti · Enterprise Integration Lead & Architect · Updated 1 November 2026 · 14 min read

For most SAP customers the first serious question about AI agents is not which model to use. It is how do agents reach SAP data without someone wiring a new back door into S/4HANA or SuccessFactors? In 2026 SAP's answer is the MCP Gateway in SAP Integration Suite: a capability of API Management, delivered with SAP's API-centric integration release in Q3 2026, that publishes selected APIs, integration flows and data sources as governed MCP servers.

This guide is written from the perspective of the team that runs Integration Suite day to day. It separates what is available from what is on the roadmap, and focuses on the design decisions that SAP cannot make for you.

What the MCP Gateway is, and what it is not

The MCP Gateway sits in the API layer of Integration Suite, in front of API artifacts: the API-centric integration design element that combines API policies (authentication, quotas, mediation) with integration steps (mapping, routing, retries) in one artifact, running on the SAP-managed Integration Cell or on Edge Integration Cell in your own landscape. MCP clients (agents and AI applications speaking JSON-RPC 2.0) and ordinary API clients (REST, OData) both arrive here. Behind it sit SAP cloud and on-premise APIs, third-party APIs, and connectivity through adapters, BTP destinations and the Cloud Connector.

API artifacts: one artifact instead of a proxy plus an iFlow

Until now, exposing an integration as a governed API meant two separate pieces: an API proxy in API Management for security and traffic policies, and an iFlow in Cloud Integration for the integration logic. SAP's own July 2026 update describes the result: two loosely coupled capabilities, two messages per call (one for the proxy, one for the iFlow) and two observability planes. API-centric integration converges them.

Two things it is not, both commonly confused:

• It is not Joule's built-in MCP surface. SAP generates MCP access for its own Joule agents from its semantic API catalogue. That is SAP-managed and used inside Joule Studio; you do not build or govern it. The MCP Gateway is the customer-managed path for your APIs, your iFlows and your agents.
• It is not a licence to bypass SAP's API policy. SAP's published guidance limits autonomous AI calling SAP APIs outside SAP-endorsed pathways. SAP lists the MCP Gateway as an endorsed pathway in the SAP Architecture Center reference architecture, which is one of the strongest practical reasons to use it rather than a home-grown MCP server.

Available now vs on the roadmap

Source: SAP Integration Suite monthly customer updates (May and July 2026), SAP blogs on API artifacts and principal propagation for MCP servers, and the September 2026 update as reported by SAP partners and SAP Connect 2026 coverage. Roadmap items are SAP's plans and may change.

Which agents should go through it

SAP's own guidance is clear and worth adopting as policy:

• External, third-party agents (Microsoft Copilot, custom agents on other clouds, partner agents) should reach SAP systems through the MCP Gateway.
• Customer-built agents on BTP, whether pro-code or low-code, should use it too.
• Third-party MCP servers should federate into it once federation ships, so you have one inventory and one audit trail.

Agent-to-agent delegation, for example a non-SAP agent handing a task to Joule, is a different problem solved by A2A. SAP sits on the A2A technical steering committee and positions MCP and A2A as complementary. See A2A for enterprise integration.

Worked example: a leave-balance tool for an HR copilot

An employee asks a copilot, "How many vacation days do I have left?" The data lives in SuccessFactors Employee Central Time Off, and you already run an API proxy in Integration Suite for the self-service portal.

1. Start from an API artifact. Do not create a new connection to SuccessFactors. Build the lookup as an API artifact, or reuse the existing proxy's specification, keeping its OAuth client and policies.
2. Expose one read operation. Curate the server so only the balance lookup is a tool. Leave time-off request creation for a later, separately reviewed tool.
3. Rewrite the generated description. For example: "Returns the calling employee's current time-off balances by type. Read-only. Use only for the signed-in user; never for another employee."
4. Remove the employee ID from the input. The tool should derive the user from the token, not from a model-supplied argument. A model that can pass any userId can be talked into reading a colleague's data. Use principal propagation where it is enabled on your tenant, and enforce this in the API artifact's policies from the authenticated identity either way.
5. Trim the response. Return balance type and amount, not the full time account record.
6. Add quotas and alerts. A per-agent rate limit, and an alert on spikes in denied calls.

The same pattern works for order status from S/4HANA, invoice status from Ariba, or open purchase orders. The rule is constant: the agent becomes one more governed consumer of an interface you already operate.

Design rules from running CPI in production

• Prefer API artifacts and iFlows over raw RFC. RFC function modules carry decades of implicit assumptions about the caller. If you must expose one, wrap it in an iFlow that validates inputs and constrains values.
• Separate read and write servers. Different MCP servers for read-only and side-effecting tools make policy, review and kill switches simpler.
• Make writes idempotent. MCP's 2026-07-28 revision makes retries routine. Require an idempotency key and check it in the iFlow (a data store or the target system's external reference field) before posting.
• Keep business logic out of the MCP layer. Mappings, value-mapping and enrichment belong in the API artifact's integration steps or in an iFlow, where they are tested and monitored.
• Propagate a correlation ID. Carry the agent's trace ID into the message processing log via a header, so one search joins the agent conversation to the MPL entry.
• Mask personal data in traces. HR and payroll payloads in MPL attachments and gateway logs are a compliance risk. Log metadata, not payloads.
• Version tools explicitly. A changed schema is a new tool name or version, never a silent change agents discover in production.

How it compares with other MCP gateways

Many SAP customers will run two: SAP's gateway for SAP-bound tools, and their cloud provider's gateway for everything else. Until MCP federation ships, agree which gateway owns the audit record for each tool, so incidents do not start with a debate about where to look.

Frequently asked questions

Is the SAP Integration Suite MCP Gateway generally available?

SAP delivered the MCP Gateway with its API-centric integration release in Q3 2026. Principal propagation is rolling out from the September 2026 update; MCP federation, the AI Gateway and MCP servers on Edge Integration Cell are on the roadmap. Check SAP's documentation for what your tenant and edition include.

What is the difference between Joule's MCP and the MCP Gateway?

Joule's MCP access is generated and managed by SAP for Joule agents. The MCP Gateway is the customer-managed capability for exposing your own APIs, iFlows and data sources to any approved agent, with your policies.

Can I expose a BAPI or RFC function module as an MCP tool?

SAP lists RFC and remote-enabled function modules from ECC and S/4HANA as a creation path. Because these were not designed for model-chosen inputs, wrap them in validation, expose read operations first and gate writes behind approval.

Should non-SAP agents call SAP APIs directly?

SAP's guidance is that external agents should use the MCP Gateway, which SAP lists as an endorsed pathway. Direct calls bypass central policy and may conflict with SAP's API policy for autonomous AI.

Sources and further reading

• SAP: Edge Integration Cell, an introduction to API artifact
• SAP: Principal propagation for MCP servers, Integration Suite to S/4HANA on-premise
• SAP Integration Suite: what's changing for APIs and AI agents (partner summary)
• SAP Integration Suite monthly update, 28 July 2026 (PDF)
• SAP Integration Suite monthly update, 26 May 2026 (PDF)
• SAP Connect 2026 recap: the integration work behind business AI
• SAP Innovation Guide H2 2025: MCP gateway support
• Speakeasy: Best MCP gateways for enterprise 2026

Related guides

• MCP gateway architecture
• What MCP 2026-07-28 changes
• API-centric integration patterns

← Back to knowledge library