AI Meets SAP Security: How MCP Transforms MTC Skopos
MCP for SoD remediation — Model Context Protocol (MCP) connects AI assistants directly to specialized SoD analysis engines like MTC Skopos, enabling conversational access to pre-computed risk data. Instead of querying raw SAP tables, AI reasons over analyzed results to provide instant, context-aware remediation guidance, conflict summaries, and impact simulations through natural language.
We've connected MTC Skopos to AI assistants using Model Context Protocol (MCP). Translation: you can now have a conversation with your SAP security data.
What is MCP and why it matters
Model Context Protocol (MCP) is a standard way for AI to talk to specialised apps. Think of it as a plug between an AI assistant and your data sources.
Without MCP, the AI can only give generic advice based on general training data. With MCP, the AI reads actual analysis from your systems and answers based on it.
The hard part is not connecting. It is doing the connection efficiently.
Pointing an AI at raw SAP tables burns huge amounts of tokens and time. A single SoD analysis can join millions of rows across dozens of tables. That alone exceeds most AI context windows, which makes real-time conversation impossible.
That's why the MCP server connects directly to MTC Skopos, not to raw SAP tables
Skopos analyses your SAP authorization data ahead of time. It finds SoD conflicts, tracks transaction usage, scores risk severity, maps role relationships, and stores the results in fast lookup structures.
When you ask "What conflicts exist for user SMITHJ?", the MCP server does not trigger table scans. It pulls the pre-computed result from Skopos.
The answer comes back complete:
- SMITHJ has role Z_FI_AP (vendor creation) and role Z_FI_PAYMENT (payment posting)
- That combination creates a P2P-001 conflict
- Skopos returns the severity, the affected transactions, the usage history, and the remediation options
No raw table parsing. No million-row joins.
The Transformation: See It In Action
Before MCP: Generic AI guidance
When asked "What is the most triggered Segregation of Duties conflicts in Finance?", AI provides theoretical knowledge:
- F001 (General Ledger Maintenance + Posting) - undetected errors and financial misstatement
- F002 (Cost Center Maintenance + Cost Transfer) - hiding fraudulent costs
- F012 (Asset Master Maintenance + Asset Transactions) - asset misappropriation
- F064 (Asset Maintenance + Invoice Processing) - manipulation of capitalization
This is helpful background, but it's not YOUR data. It doesn't tell you which risks exist in your environment or who's affected.
After MCP: Your Actual Data
The conversation transforms when you ask: "Can you load analysis from users-analysis--2025-09-28--23-24-58.log" The MCP server retrieves actual analysis from Skopos:
Analysis Overview
- System: SAP PRDCLNT100
- Analysis Type: User-level Segregation of Duties
- Ruleset: Business Risks (SAP)
- Date: September 28, 2025
Key Metrics
- Total Users Analyzed: 2,417
- Distinct SoD Risks: 75 (all High severity)
- Impacted Users: 433
- Impact Rate: ~18% of your user base has violations
Risk Distribution by Business Process
- Procure to Pay (PR00/MM00): 18 risks - Vendor maintenance, invoice processing, payments, inventory
- Sales & Distribution (SD00): 18 risks - Customer maintenance, invoicing, credit management, AR clearing
- Financial Accounting (FI00): 12 risks - GL posting, asset management, bank accounts, cost centers
- Human Resources (HR00): 14 risks - Employee maintenance, payroll processing, time entry
- Basis/Security (BS00): 6 risks - Security administration, transport management, configuration
- Treasury (TR00): 5 risks - Securities, payments, treasury transactions
Now you can have focused conversations based on real data:
"Which Finance risks affect the most users?" Skopos shows F001 (GL Maintenance + Posting) has the highest user count, while F002 (Cost Center manipulation) shows the most transaction activity.
"Show me users with F001 conflicts" Immediate list with role assignments, usage patterns, and last activity dates from your actual system.
"If I remove XK01 from Z_FI_AP, who else is affected?" Skopos returns that 15 users have this role, with usage statistics showing 3 users actively employ the transaction while 12 have never used it.
"What alternative roles could work?" Skopos suggests Z_FI_AP_VIEW as a display-only alternative, already validated against your role catalog.
"Explain our P2P risks to the CFO" 18 users can both create vendors AND process payments to them. That's like giving someone both the company checkbook and the ability to add recipients. Here's the fraud scenario: Monday they create a vendor for their friend's company, Tuesday they process a payment. Without segregation, there's no control stopping this."
"Can you create a visualisation of the risk in the process flow?" Creates a visual
The time savings are real. The bigger win is in accuracy and coverage:
- Accuracy. Recommendations come from Skopos's pre-analysed data, not from manual reading of reports.
- Coverage. The AI sees every angle of Skopos's analysis at once. No manual correlation across separate exports.
Why This Architecture Works
Token Efficiency
Instead of processing millions of SAP table rows through the AI's context window, only Skopos's analyzed results flow through MCP. A query that might require 100,000 tokens if parsing raw tables directly needs only 2,000 tokens when Skopos provides pre-processed insights.
Response Speed
Skopos maintains optimized indexes and cached analyses. Responses are instant because the computational heavy lifting happened during the analysis phase, not during your conversation.
Data Security
Sensitive authorization data stays within Skopos's infrastructure. The AI reasons about summaries and aggregates, not raw user permissions. Your security data never leaves your environment.
Flexibility
The MTC Skopos MCP server publishes three things to AI clients:
- Resources: analysis results, risk matrices, user profiles
- Tools: simulation functions, report generators, conflict checks
- Prompts: common remediation workflows, audit response templates
As Skopos adds support for new authorization objects, Fiori app permissions, or cloud apps, the MCP server picks up the new capabilities. AI clients keep working without any changes.
What this means for security teams
You manage thousands of users and roles across 10+ SAP systems, often in a mix of cloud and on-premise. A first-time risk analysis can reveal 50,000 SoD violations. At a manual review pace, that is roughly two years of part-time work to bring to zero.
On top of that, you handle constant access requests, keep the system audit-ready, and prove that controls are working.
The shift with MCP is from data gatherer to risk manager. Instead of spending days extracting and cross-referencing information, you spend that time on the decisions that need judgement:
- Weighing risk trade-offs
- Working with business process owners
- Prioritising remediation
- Designing controls that fit the organisation
Skopos does the analysis. The MCP server makes it conversational. You bring the judgement.
Real-time monitoring becomes natural
Instead of waiting for the quarterly review, you ask Skopos directly: "What new SoD violations were introduced this month?" The MCP server returns the delta in seconds.
You can also:
- Track which roles generate the most conflicts over time
- Spot authorization creep as it develops
- Give executives a current risk posture instead of a stale quarterly report
No query languages. No jumping between screens. You ask, you get an answer. If you need a slide for the CFO, you ask for it in business language and the AI writes it.
The bottom line
MCP does not replace Skopos's analysis engine. It makes that engine conversational.
Skopos keeps doing what it does best: analysing SAP authorization data, computing conflict patterns, tracking role relationships, and simulating remediation scenarios. The MCP server changes the interface. Instead of running a report and reading a screen, you ask a question and get an answer based on your real data. You can iterate faster, and decisions land sooner.
The future of SAP security analysis is not specialised tools versus AI. It is specialised tools like Skopos plugged into AI through MCP. The engine stays the source of truth. The AI is the interface that makes that truth accessible, explainable, and ready to act on.
Related Articles
- Best SAP SoD Tools & Software Compared - Compare the leading SoD analysis solutions
- Advanced Remediation: AI-Powered SAP Access Risk Resolution - Deep dive into the remediation algorithm
- SoD Conflicts in SAP: How to Detect and Resolve Them - Practical guide to SAP SoD conflict resolution
Ready to experience the difference? [Learn more about MTC Skopos] or [contact our team] to schedule a demonstration.