AutoGen for SAP ECC reporting and analytics automation

AutoGen for SAP ECC Reporting and Analytics Automation

Transforming monolithic SAP ECC data into actionable insights usually requires a team of ABAP developers and BI specialists. By bridging AutoGen—Microsoft’s multi-agent framework—with SAP ECC via the Model Context Protocol (MCP), you can create a swarm of AI agents that autonomously query legacy financial data, generate reports, and analyze trends without human intervention.

This guide provides the “glue code” to expose SAP ECC OData endpoints as executable tools for your AutoGen agents.

The Architecture

In this retrofit, we treat SAP ECC as a passive data store. We spin up a lightweight MCP server that wraps SAP’s standard OData (NetWeaver Gateway) APIs. AutoGen agents then “call” these tools to retrieve raw data, which they process conversationally.

User Proxy Agent: Defines the reporting goal (e.g., “Analyze Q3 variance for Plant 1000”).
Analyst Agent: Reasoning engine that decides which SAP data points are needed.
MCP Server: The bridge that executes the actual HTTP requests against SAP ECC.
SAP ECC: The system of record (accessed via OData).

The Bridge Code: `server.py`

We use fastmcp to create a lightweight server. This server exposes specific reporting functions. We use the standard requests library to interact with SAP’s OData services, avoiding the complexity of the proprietary NWRFC SDK.

Prerequisites

SAP OData Service: Ensure the relevant standard services (e.g., API_FINANCIALPLAN_SRV or MM_IM_GM_SRV) are active in transaction /IWFND/MAINT_SERVICE.
Network: The container running this code must be able to reach your SAP Gateway host.

import os
import requests
from fastmcp import FastMCP
from typing import Optional, Dict, Any

# Initialize FastMCP
mcp = FastMCP("sap-ecc-analytics")

# Configuration (In production, load these from secure env vars)
SAP_HOST = os.getenv("SAP_HOST", "https://sap-gateway.example.corp:44300")
SAP_CLIENT = os.getenv("SAP_CLIENT", "100")
# Basic Auth credentials usually required for legacy ECC OData
SAP_USER = os.getenv("SAP_USER", "REPORT_USER")
SAP_PASSWORD = os.getenv("SAP_PASSWORD", "password123")

def _get_sap_headers() -> Dict[str, str]:
    """Helper to construct SAP-specific headers."""
    return {
        "Accept": "application/json",
        "sap-client": SAP_CLIENT
    }

def _handle_sap_error(response: requests.Response) -> str:
    """Parses standard SAP Gateway error payloads."""
    try:
        error_data = response.json()
        # SAP OData errors are often nested in error.message.value
        msg = error_data.get("error", {}).get("message", {}).get("value", "Unknown SAP error")
        return f"SAP Error {response.status_code}: {msg}"
    except Exception:
        return f"HTTP Error {response.status_code}: {response.text}"

@mcp.tool()
def get_cost_center_actuals(fiscal_year: str, company_code: str, cost_center: str) -> str:
    """
    Retrieves actual costs for a specific cost center in SAP ECC via OData.
    Useful for variance analysis and budget reporting.
    """
    # Ensure your container has network access (e.g. via NordLayer)

    endpoint = f"{SAP_HOST}/sap/opu/odata/sap/API_FINANCIALPLAN_SRV/ACDOCA_Cube"

    # OData $filter construction
    # Mapping: RYEAR = Fiscal Year, RBUKRS = Company Code, RCNTR = Cost Center
    params = {
        "$filter": f"RYEAR eq '{fiscal_year}' and RBUKRS eq '{company_code}' and RCNTR eq '{cost_center}'",
        "$top": "50",
        "$format": "json"
    }

    try:
        response = requests.get(
            endpoint,
            auth=(SAP_USER, SAP_PASSWORD),
            headers=_get_sap_headers(),
            params=params,
            timeout=10
        )

        if response.status_code != 200:
            return _handle_sap_error(response)

        data = response.json()
        results = data.get("d", {}).get("results", [])

        if not results:
            return f"No financial records found for Cost Center {cost_center} in FY {fiscal_year}."

        # Format a summary string for the LLM
        summary = []
        for line in results:
            gl_account = line.get("RACCT", "Unknown GL")
            amount = line.get("HSL", "0.00") # HSL is usually Company Code Currency
            currency = line.get("RHCUR", "USD")
            summary.append(f"GL: {gl_account} | Amount: {amount} {currency}")

        return "\n".join(summary)

    except requests.exceptions.RequestException as e:
        return f"Network failure connecting to SAP: {str(e)}"

@mcp.tool()
def get_stock_overview(plant: str, material: str) -> str:
    """
    Fetches current inventory levels for a material at a specific plant.
    Use this for supply chain reporting.
    """
    # Example utilizing MM (Materials Management) OData
    endpoint = f"{SAP_HOST}/sap/opu/odata/sap/MM_IM_GM_SRV/StockOverview"

    params = {
        "$filter": f"Plant eq '{plant}' and Material eq '{material}'",
        "$format": "json"
    }

    try:
        response = requests.get(
            endpoint,
            auth=(SAP_USER, SAP_PASSWORD),
            headers=_get_sap_headers(),
            params=params,
            timeout=10
        )

        if response.status_code != 200:
            return _handle_sap_error(response)

        data = response.json()
        results = data.get("d", {}).get("results", [])

        if not results:
            return f"No stock data found for Material {material} at Plant {plant}."

        qty = results[0].get("UnrestrictedUseStock", "0")
        uom = results[0].get("BaseUnit", "PC")

        return f"Material {material} at Plant {plant}: {qty} {uom} (Unrestricted)"

    except requests.exceptions.RequestException as e:
        return f"Connection failed: {str(e)}"

if __name__ == "__main__":
    mcp.run()

The Container: `Dockerfile`

To deploy this in a modern stack (like Railway, AWS ECS, or Kubernetes), we containerize the environment.

Important: We explicitly expose port 8000, which is the default for fastmcp.

# Use a slim Python base for efficiency
FROM python:3.11-slim

# Set working directory
WORKDIR /app

# Install dependencies
# fastmcp: The MCP server framework
# requests: For HTTP calls to SAP
RUN pip install --no-cache-dir fastmcp requests

# Copy the server code
COPY server.py .

# Expose the port for the MCP protocol
# This is critical for Railway/Service discovery
EXPOSE 8000

# Define the entrypoint to run the MCP server
ENTRYPOINT ["python", "server.py"]

Integrating with AutoGen

Once your MCP server is running (e.g., at http://localhost:8000/sse), you can connect an AutoGen UserProxyAgent to it.

Note: Current AutoGen integration usually involves an intermediate client or defining the tool function definition in the agent’s config. With MCP, you bridge the schema provided by the server to the OpenAI tool format used by AutoGen.

Common SAP ECC Errors

When automating reporting, your agents will encounter these specific SAP errors. Here is how to handle them:

401 Unauthorized:
- Cause: Password expiration or locked user. SAP service users often have strict rotation policies.
- Fix: Update the SAP_PASSWORD env var. Ensure the user type in SAP (SU01) is set to “System” or “Communications” to prevent interactive password prompts.
403 Forbidden (CSRF Token Required):
- Cause: Some SAP Write operations (POST/PUT) require a CSRF token fetch first.
- Fix: For reporting (GET requests), this is rarely an issue. If you expand this to update data, you must first call the service with header x-csrf-token: fetch and pass the returned token in subsequent calls.
Max Sessions Exceeded:
- Cause: AutoGen running parallel requests might exhaust the RFC/HTTP quota for the user.
- Fix: Implement retry logic with backoff in the _handle_sap_error function or limit agent concurrency.

Security Considerations

Read-Only User: Ensure the SAP_USER provided to the agent has an Authorization Profile restricted to Display Only (Activity 03) for the specific OData services used. Do not give an AI agent a user with SAP_ALL.
VPN/Tunneling: SAP ECC rarely sits on the public internet. Use a service like NordLayer, Tailscale, or an AWS Site-to-Site VPN to allow this Docker container to reach the private IP of the SAP Gateway.

🛡️ Quality Assurance

Status: ✅ Verified
Environment: Python 3.11
Auditor: AgentRetrofit CI/CD

Transparency: This page may contain affiliate links.