calmcp

A read-only MCP server that bridges AI assistants to SAP Cloud ALM, exposing read APIs through four intent-based tools. It runs locally over stdio or remotely over Streamable HTTP, and can be deployed to SAP BTP Cloud Foundry.

→ consetto/calmcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 4 credentials: CALM_API_KEY, CALM_CLIENT_SECRET, CALM_DCR_SIGNING_SECRET, CALM_HTTP_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretCALM_API_KEY— CALM_SANDBOX true to use the SAP Business Accelerator Hub sandbox with .

configCALM_CLIENT_ID— , CALM_CLIENT_SECRET OAuth2 client-credentials from the service binding.

🔐 secretCALM_CLIENT_SECRET— CALM_CLIENT_ID, OAuth2 client-credentials from the service binding.

configCALM_CORS_ORIGINS— PORT, HTTP transport port and allowed CORS origins.

🔐 secretCALM_DCR_SIGNING_SECRET

🔐 secretCALM_HTTP_API_KEY— Microsoft Copilot Studio). Set and the caller sends Authorization: Bearer <key>.

configCALM_PUBLIC_URL— Public base URL used in OAuth metadata and the callback. Defaults to the first route in VCAP_APPLICATION, so it's normally not needed.

configCALM_SANDBOX— true to use the SAP Business Accelerator Hub sandbox with CALM_API_KEY.

configCALM_TENANT— , CALM_REGION Tenant subdomain and region (e.g. eu10) for OAuth2 mode.

configCALM_TRANSPORT

configPORT— , CALM_CORS_ORIGINS HTTP transport port and allowed CORS origins.

configVCAP_APPLICATION— CALM_PUBLIC_URL Public base URL used in OAuth metadata and the callback. Defaults to the first route in , so it's normally not needed.

configVCAP_SERVICES— CALMCP_Viewer role collection). calmcp detects the bound service from and enables

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/consetto-calmcp-2iwa0f)](https://m8ven.ai/mcp/consetto-calmcp-2iwa0f)

commit: 70c8964c16a319008a93020c3a226715c34d6bf6

code hash: 9251dd7ae16f4dcda22ef7b0f2c656c77859b3f1d30d2f2551caa2a0868a799e

verified: 6/15/2026, 12:46:01 PM

view raw JSON →