Hana MCP Server

Findings (13)

• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  hana-mcp-ui/bin/cli.js:46
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  hana-mcp-ui/bin/cli.js:54
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  hana-mcp-ui/start.js:48
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  hana-mcp-ui/start.js:80
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  hana-mcp-ui/start.js:84
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  hana-mcp-ui/start.js:103
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.12.2: 32 known vulnerabilities

  GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3 +27 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.12: 7 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  form-data@4.0.4: 1 known vulnerability

  GHSA-hmw2-7cc7-3qxx

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@3.1.2: 3 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@2.3.1: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  follow-redirects@1.15.11: 1 known vulnerability

  GHSA-r4q5-vmmm-2653

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (34)

• hana_show_config

  Show the HANA database configuration

• hana_test_connection

  Test connection to HANA database

• hana_list_schemas

  List schemas in the HANA database with optional prefix filter and pagination (HANA_LIST_DEFAULT_LIMIT / offset).

• hana_show_env_vars

  Show all HANA-related environment variables (for debugging)

• hana_list_tables

  List tables in a schema with optional name prefix and pagination (HANA_LIST_DEFAULT_LIMIT / offset).

• hana_describe_table

  Describe the structure of a specific table

• hana_explain_table

  Return column metadata merged with optional business semantics from HANA_SEMANTICS_PATH or HANA_SEMANTICS_URL (JSON keys: SCHEMA.TABLE or DB.SCHEMA.TABLE when catalog_database is set). Optional catalog_database reads SYS.* from another MDC database (e.g. HSP).

• hana_list_indexes

  List all indexes for a specific table

• hana_describe_index

  Describe the structure of a specific index

• hana_execute_query

  Execute SQL against HANA. When HANA_QUERY_LIMITS_ENABLED=true, SELECT/WITH queries are wrapped with LIMIT/OFFSET (HANA_MAX_RESULT_ROWS) and row/column/cell caps apply; results are returned as-is otherwise. INSERT/UPDATE/DELETE are blocked by default; set HANA_ALLOW_INSERT, HANA_ALLOW_UPDATE, HANA_AL

• hana_query_next_page

  Fetch the next page of a truncated SELECT using snapshotId from a previous hana_execute_query result (same SQL and parameters; TTL HANA_QUERY_SNAPSHOT_TTL_MS).

• hana_list_constraints

  List primary key, unique, check, and foreign key constraints for a table (SYS.CONSTRAINTS + SYS.REFERENTIAL_CONSTRAINTS).

• hana_get_table_stats

  Return row count, table type, column-store flag, primary key flag, and disk size (requires MONITORING privilege for disk size) from SYS.TABLES and SYS.M_TABLE_SIZES.

• hana_list_views

  List views in a schema from SYS.VIEWS. Supports prefix filter and pagination.

• hana_describe_view

  Return the view definition (SQL) and column metadata from SYS.VIEWS and SYS.VIEW_COLUMNS.

• hana_list_synonyms

  List synonyms in a schema from SYS.SYNONYMS, showing target object schema, name, and type.

• hana_list_procedures

  List stored procedures and their parameter counts from SYS.PROCEDURES.

• hana_describe_procedure

  Return parameter names, types (IN/OUT/INOUT), data types, and positions from SYS.PROCEDURE_PARAMETERS.

• hana_search_columns

  Find all columns matching a LIKE pattern across all tables (or within a schema). Uses SYS.TABLE_COLUMNS. Results capped at 1000.

• hana_get_sample_data

  Fetch the first N rows from a table using SELECT TOP. Result is shaped by the same row/column/cell caps as hana_execute_query.

• hana_explain_plan

  Run EXPLAIN PLAN for a SELECT/WITH query and return operator tree from EXPLAIN_PLAN_TABLE. Only SELECT/WITH are accepted.

• hana_list_foreign_keys

  List referential constraints (foreign keys) showing column, referenced table/column, and delete rule from SYS.REFERENTIAL_CONSTRAINTS.

• hana_list_privileges

  List effective privileges for a user (or CURRENT_USER if omitted) from SYS.EFFECTIVE_PRIVILEGES. Requires CATALOG READ privilege or querying own privileges.

• hana_get_ddl

  Retrieve the DDL (CREATE statement) for a TABLE, VIEW, PROCEDURE, FUNCTION, TRIGGER, or SEQUENCE from SYS.OBJECT_DEFINITION. Requires appropriate privileges.

• hana_get_column_stats

  Retrieve column statistics (distinct count, null count, min/max) from SYS.COLUMN_STATISTICS (cached) or via live COUNT queries (live=true). With live=true a specific column_name is required.

• hana_list_functions

  List scalar and table functions from SYS.FUNCTIONS. Supports prefix filter and pagination.

• hana_describe_function

  Return parameter names, types, data types, and positions for a function from SYS.FUNCTION_PARAMETERS.

• hana_list_calculation_views

  List calculation views from the _SYS_BIC schema (SAP BW/S4 analytical views). Supports prefix filter and pagination.

• hana_get_session_info

  Return CURRENT_USER, CURRENT_SCHEMA, connected database name, SYSTEM_ID, and HANA version from DUMMY and M_DATABASE.

• hana_search_tables

  Find all tables matching a LIKE pattern across all schemas (or within a specific schema). Uses SYS.TABLES. Results capped at 2000.

• hana_get_expensive_queries

  Return the most expensive statements from M_EXPENSIVE_STATEMENTS ordered by duration. Requires MONITORING privilege.

• hana_get_dependencies

  Show what an object depends on or what depends on it, from SYS.OBJECT_DEPENDENCIES. Capped at 200 rows.

• hana_get_partition_info

  Return partition metadata (type, level, record count, loaded state) from SYS.TABLE_PARTITIONS. Returns empty result for unpartitioned tables.

• hana_list_sequences

  List sequences from SYS.SEQUENCES, showing start, min, max, increment, cycle, and cache settings.