Claude with SAP and ERP over MCP: scope, limits and costs
Claude can query SAP and other ERPs through an MCP server, but with SAP you need to read its API policy first: it restricts using its APIs with generative AI systems that chain calls, except through pathways SAP endorses. Here we set the scope that makes sense, the limits and what each side costs, with the sources linked.
What MCP is and what Claude does with your ERP
MCP (Model Context Protocol) is an open protocol that lets an AI application call external tools. An MCP server publishes named tools with parameters, for example "look up an order status", and Claude decides when to call them. For your ERP this means Claude does not get free access to SAP: access can be limited to the tools you define and the permissions you configure and verify. The current specification defines transports and, for servers reachable over HTTP, an OAuth-based authorization that is optional.
This article does not explain MCP in general. What follows covers only what changes when the target system is SAP.
The limit that decides everything with SAP: its API policy
SAP's API policy (v.4.2026a), section 2.2.2, prohibits using its APIs to integrate with generative or semi-autonomous AI systems that plan, select or execute sequences of calls, and for systematic or large-scale data extraction, except through architectures, data services or pathways that SAP endorses and identifies for that purpose. An agent that only reads is not exempt. Section 3 says SAP may monitor usage and, in case of non-compliance, throttle, suspend or terminate access.
The policy FAQ (v1.3, June 2026) names the endorsed pathways for agentic AI: the MCP Gateway in SAP Integration Suite, the MCP servers SAP generates with Joule Studio, and the A2A protocol. It also says the policy does not change licenses, that any AI platform can connect through those pathways and that Integration Suite is not required. On custom or third-party MCP servers (questions 39 and 56), SAP says that for external agents it endorses the MCP Gateway over community or customer-operated servers, and that they can still be used if all use complies with the contract, the documentation and the API policy, with authentication and authorization on every connection and respect for published limits. Operation and maintenance remain with the customer, and SAP provides no support or stability guarantees for those implementations. The FAQ states it is informational and not a contract.
What SAP does not settle for you
SAP issues no general approval or compliance decision for a specific deployment. An MCP server of your own is possible under those conditions, with risk and maintenance on your side and no SAP support. Before building, ask SAP or your account executive for its position in writing and have your contract reviewed.
What SAP and Anthropic announced, and what they did not
On May 12, 2026 SAP announced plans to expand its collaboration with Anthropic so Claude becomes a reasoning capability inside the SAP Business AI Platform and Joule, with tasks coordinated across S/4HANA, SuccessFactors and Ariba via MCP.
What it does not say, in what we read: launch dates, price or license for that capability, or that a company can connect its own Claude (claude.ai or the API) to its own SAP.
That announcement does not establish a ready integration between your Claude and your SAP: treat it as a project with its own scope.
The scope we propose
This scope is our own proposal, not a feature bundled with SAP or Claude. Starting with limited reading lets you validate permissions and access before adding writes; reading also exposes data and remains subject to the policy.
1. Scoped reading
Includes one to five named tools (for example an order status or a customer balance), validated parameters, a minimal SAP role per tool and a log of every call. Does not include bulk extraction, free-form queries or unpublished APIs.
2. Writing with approval
Includes one specific action that a person approves before it runs. Does not include writes without review or unbounded batches.
3. More systems
Includes adding another module or ERP with its own license and policy review. Does not include assuming one vendor's rule applies to another.
For stage 2 we use the criteria in our human approval guide. Out of scope at every stage: changing your SAP contract, reselling SAP or Claude licenses, and certifying that your architecture complies with SAP, which depends on SAP's position and your contract.
How to connect it securely
SAP publishes a reference architecture for third-party MCP access (updated October 26, 2026). Among other things it asks to: authenticate every inbound request and every call to an SAP API; not store long-lived credentials in the MCP server; not forward the person's token as is but exchange it (RFC 8693) for a narrow credential that identifies the agent and keeps the user context; give each tool the minimum permissions it needs; validate every input; use TLS 1.2 or higher; keep server limits within the SAP API limits; and log every invocation with the caller's identity.
On Claude's side, custom connectors are available on all plans (Free with a single connector) and require the server to be reachable from the internet. On Team they are added by Owners and Primary Owners, and on Enterprise also by people with a custom role that includes that permission. Anthropic warns that it does not verify these services, that a malicious server can hide instructions, and that you should disable write-capable tools when using the research feature.
If you call Claude through the API instead, the API MCP connector is in beta, supports only tool calls, requires a server exposed over public HTTP and is not eligible for zero data retention or HIPAA. If the server runs on a private network you have to solve how Anthropic reaches it: the documentation describes MCP tunnels in research preview, with no commitment on availability or support, only for the API and managed agents, by request and not eligible for zero data retention or HIPAA.
Hidden instructions
An MCP tool returns ERP data and Claude reads it. If a text field carries hidden instructions, the model may follow them. That is why we propose read-only tools first and human approval before any write.
What each part costs
We quote by scope and do not publish a rate or a market range for this kind of project. What is published is the cost of each piece. Anthropic prices come from its pages as of October 30, 2026, in USD before taxes, and Anthropic states they may vary by region.
| Piece | Published cost |
|---|---|
| Claude Team, Standard seat | USD 20 per seat per month billed annually, or USD 25 monthly (Anthropic) |
| Claude Enterprise | USD 20 per seat per month billed annually, 20-seat minimum on self-serve (50 with sales); usage is billed separately at API rates (Anthropic) |
| Claude API, Sonnet 5.5 | USD 2 per million input tokens and USD 10 output (Anthropic) |
| SAP: AI access to S/4HANA Cloud | Licensed by documents created by external systems; reading, updating and deleting do not count; the price is not in the guide (SAP) |
| SAP Integration Suite (MCP Gateway) | SAP publishes Integration Suite pricing by edition; confirm with SAP which edition includes the MCP Gateway and its price |
| Integration fees | Quoted according to scope; we publish no price or range (Duotach) |
An example with our own assumptions, not measured: a query that reads 30,000 tokens and answers with 1,000 costs about USD 0.07 on Sonnet 5.5 (30,000 x 2 / 1,000,000 plus 1,000 x 10 / 1,000,000). At 1,000 queries per month that is about USD 70, before caching and seats. Ten Team Standard seats billed annually are USD 200 per month. Team also includes monthly API credits (USD 20 per Standard seat, in a shared pool capped at USD 500 per month) that the example does not deduct; check their conditions before counting on them.
What moves the project cost, and why it is quoted by scope: how many tools, whether there is writing, the SAP edition (public cloud, private cloud or ECC), whether you already have Integration Suite, the identity model and who runs the server afterwards.
What to ask whoever builds it
Ask in writing: which tools the server exposes and which SAP role each one runs under; how it authenticates and how each secret is rotated; how it logs every call; what happens if SAP throttles or blocks the traffic; what SAP says about the proposed architecture; and who operates the server when the project ends. If they cannot answer one of these, the scope is not defined yet.
How we work at Duotach
We build AI agents connected to your company's systems. For SAP we start with a review of your edition, the published APIs you need and what your contract says, and propose a first reading stage. Do not send credentials through the form. If you are still weighing the whole AI and ERP picture, see the guide to integrating AI with your ERP and the one on Argentine ERPs.
Frequently asked questions
Can I connect Claude directly to SAP APIs?+
Do I need SAP Integration Suite?+
Does using AI with S/4HANA Cloud cost more in licenses?+
Does this apply to other ERPs such as Dynamics, NetSuite or Tango?+
Sources consulted on October 30, 2026
SAP and Anthropic announcement
SAP reference architecture for third-party MCP
Claude Team and Enterprise plans
SAP help pages built with JavaScript could not be read in full with our tools; what we state comes from SAP's PDF documents and the pages cited. This guide is not legal or licensing advice: SAP confirms what your contract covers.
Start with a scoped read
Tell us which SAP query you want to put within Claude's reach and who will use it.