User Guide

Getting Started

Installation

1. Extract the ZIP file to any folder
2. Launch MTC_Skopos.exe (Windows) or MTC_Skopos (macOS/Linux) - no installation required
3. No administrator rights needed

System Requirements

First Launch

1. Open MTC Skopos
2. Go to Data Sources to configure your first connection
3. Load a Ruleset file
4. Go to Analysis to run your first risk analysis

Data Sources

MTC Skopos supports three types of data sources:

SAP Remote Connection

Connect directly to a live SAP system via RFC (Remote Function Call).

1. Click Add → SAP Remote
2. Enter connection parameters:

3. Select authentication mode:

   • User/Password: Standard RFC authentication
   • SNC: Secure Network Communications with user/password
   • SNC + X.509 Certificate: SNC with certificate-based SSO

4. For SNC modes, configure:

   • SNC Library Path
   • SNC Quality of Protection
   • SNC Partner Name

5. Click Save

Required SAP Authorizations:

• Read access to USR* tables (user master data)
• Read access to AGR_* tables (role data)
• Execute access to RFC-enabled function modules
• Optional: Usage statistics tables

SAP File Import

Import data exported from SAP as CSV/TSV files.

1. Click Add → SAP Files
2. Select folder containing the exported files
3. MTC Skopos auto-detects the following tables:

4. Click Save

File Format Requirements:

• CSV or TSV with header row (SAP technical field names)
• UTF-8 or ANSI encoding
• Configurable delimiter (comma, semicolon, or tab)

Generic File Import

Import data from non-SAP systems using a standardized format.

1. Click Add → Generic Files
2. Select folder containing:

3. Click Save

Managing Data Sources

• Refresh: Re-import data from a remote SAP system
• Edit: Modify connection settings
• View Statistics: See row counts (total, effective, ignored, unparsable)

Rulesets

Rulesets define the risks that MTC Skopos analyzes. Each ruleset contains risk definitions, business functions, actions, and permission requirements.

Loading a Ruleset

1. Click Load Ruleset
2. Select a ruleset file (CSV/TSV format)
3. Configure the file delimiter if needed
4. The ruleset loads and appears in the available rulesets

Rulesets configured in settings are automatically loaded when MTC Skopos starts.

Ruleset Structure

A ruleset defines:

Included Rulesets

MTC Skopos includes pre-built rulesets:

Custom Rulesets

To use custom rulesets, prepare a CSV/TSV file following the ruleset format and load it into MTC Skopos. The ruleset file can be opened and maintained directly in Microsoft Excel.

Multiple Rulesets

Multiple rulesets can be imported. Select the appropriate one before running your risk analysis.

Technical Considerations

• System: This field identifies the system where the function is expected to be triggered.

  Note: The system value must match exactly with the one defined in the corresponding data source(s).

• Action: The Action field acts as a permission group; permissions with the same action are evaluated together to trigger a function.

  Note: An action is not bound to a specific Tcode. If a transaction is involved, the authorization object S_TCODE must be included separately.

• Object: Represents the authorization object. All objects assigned to the same action are considered during evaluation.

• Field: The authorization field within an object. All fields under the same object are taken into account.

• Value From / To: A string range used for value matching. Values will be considered if they fall within the specified range, starting with special characters (e.g. /) and ending with a letter (e.g. Z).

• Condition (AND / OR): Operators define how multiple values for the same field of the same object are interpreted:

  • AND requires the value to be met.
  • OR requires at least one value to be met.

  Note: Combining AND and OR is technically possible. In that case all values with condition AND are required in combination with at least one value with condition OR.

• Wildcard (*) – ANY vs ALL:

  • To trigger the function by any value: use *
  • To trigger the function by all values: use ' * ' (quoted with a space)

Example Explained

Note: The examples shown are not functionally correct, they're simply meant to explain how the tool processes and interprets technical input.

To trigger the Table Maintenance function, a user or role must be provisioned with either of the following sets of authorizations:

Option 1: Using S_TABU_NAM

• Transaction code: SM30
• Authorization Object: S_TABU_NAM
  • Field ACTVT must include: 03 AND (01 OR 02)
  • Field TABLE must include: Any table starting with Z OR any table from A to BKPF

Option 2: Using S_TABU_DIS

• Transaction code: SM30
• Authorization Object: S_TABU_DIS
  • Field ACTVT must include: 01 OR 02
  • Field DICBERCLS must include: All table groups

Browsing Data

Each data source provides browsing capabilities to explore users, roles, and system information.

Data Source Information

Select a data source and view:

Info Tab:

• Connection type and configuration
• System name and type
• Table statistics (rows loaded, ignored, errors)

Users Tab:

• List of all users with filtering
• User details: ID, Type, Group, Valid dates, Lock status
• Role assignments (single and composite)
• Click a user to see detailed action usage

Roles Tab:

• List of all roles
• Role contents and structure
• User assignments

User Detail View

When viewing a specific user's usage:

Exporting Data Source Information

Export detailed data source information for external tools:

1. Select a data source
2. Click Export
3. Choose output directory
4. Multiple JSON files are created for use with Power BI, AI tools, or custom analysis

Risk Analysis

MTC Skopos provides two analysis modes: User Analysis and Role Analysis.

Running User Analysis

Analyze risks at the user level to identify which users have conflicts.

1. Go to Analysis
2. Select Users mode
3. Select one or more data sources
4. Select a ruleset
5. Configure filters (optional):

6. Enable Cross System to analyze risks spanning multiple systems
7. Click Run Analysis

Running Role Analysis

Analyze risks at the role level to identify inherent conflicts in role design.

1. Go to Analysis
2. Select Roles mode
3. Select data sources and ruleset
4. Configure filters (optional):

5. Click Run Analysis

Understanding Results

Results are displayed in a table with the following information:

Filtering and Sorting Results

• Click column headers to sort
• Use the filter row to search within results
• Results load incrementally for large analyses

Simulation

Simulation allows you to test "what-if" scenarios before making changes in your SAP system.

User Simulation

Test the impact of role assignment changes on a specific user.

1. In Analysis, select Users mode
2. Go to the Simulation panel
3. Use the Roles tab to simulate role changes:

4. Run the analysis with simulation enabled
5. Results show:
   • Added: New risks that would be created
   • Removed: Risks that would be eliminated
   • Unchanged: Existing risks unaffected by the change

Role Simulation

Test the impact of authorization changes within a role.

1. In Analysis, select Roles mode
2. Go to the Simulation panel
3. Use the Authorizations tab to simulate changes:

4. Use the Composite Roles tab to simulate structure changes:

5. Run the analysis to see the impact on all affected users

Remediation

The remediation engine analyzes your risks and generates recommendations for resolving them.

Generating Recommendations

1. Run a user analysis first
2. Go to Remediation
3. Configure remediation parameters
4. Click Generate

Remediation Phases

The algorithm evaluates remediation options in order of impact:

1. Remove user role assignments - Safest option when user has alternative access
2. Remove single role from composite - Modify composite role structure
3. Remove action from role - Last resort, may affect other users

Understanding Recommendations

For each risk, the remediation report shows:

Prioritization

Recommendations are prioritized based on:

• Risk severity (Critical risks prioritized)
• Usage frequency (unused access easier to remove)
• Collateral impact (changes affecting fewer users preferred)

Exporting Recommendations

Export remediation reports for further analysis or to share with stakeholders:

• Export for a specific risk
• Export all recommendations

Reports & Export

Exporting Analysis Results

All analysis results can be exported for audit evidence, further processing, or integration with other tools.

1. Run an analysis
2. Click Export
3. Select output location

Export Format

Reports are exported as TSV (Tab-Separated Values) files, which can be opened in Excel or any spreadsheet application.

Report Types

Detailed Report - Complete risk listing with all columns:

Summary Report - Aggregated view of risks

Execution Log - Audit trail including:

• Version and build information
• Licensed customer
• Execution timestamp

Importing Previous Results

To re-analyze or review previous results:

1. Go to Import Results
2. Select a previously exported report file
3. The results load with their original execution log

MCP Server

The MTC Skopos MCP Server enables AI assistants (Claude, ChatGPT, Copilot) to interact with your risk analysis data using the Model Context Protocol (MCP).

Configuration

The MCP server requires a mtc-skopos.data configuration file in the same directory as the executable. This file contains:

• Datasource configurations
• Analysis criteria and save directory paths

Integrating with AI Assistants

Claude Code CLI:

claude mcp add skopos /path/to/mcp-server

Claude Desktop: Configure in Claude Desktop settings under MCP servers.

Other AI tools: Configure the MCP server path in your tool's MCP configuration.

Available Tools

The MCP server exposes the following tools to AI assistants:

Typical Workflow

1. Initialize: Call init_session to load datasources
2. Find analysis: Call list_analysis_logs to locate relevant analyses
3. Summarize: Call summarize_analysis for overall risk picture
4. Deep dive: Call get_remediation_report or get_analysis_detail for specific risks
5. Role analysis: Call find_roles_by_criteria or describe_role for role-level details

Learn More

For detailed information about MCP integration, see our blog article: AI Meets SAP Security: How MCP Transforms MTC Skopos

Reference

Troubleshooting

Connection Errors

Analysis Issues

File Import Issues