sap-command-runner

---

name: sap-command-runner description: "Runs allowlisted read-only commands on SAP VMs via a secure MCP command proxy (Container App + Azure VM Run Command API). 14 read-only commands — zero changes to SAP environment. Users invoke directly for live VM queries; other skills invoke it for data collection." tools: - ExecutePythonCode

Environment Configuration

All environment-specific values (MCP endpoint URL, API key, SAP landscape) are provided via the Team Onboarding instructions. The agent reads these from the onboarding context at runtime. Do not hardcode environment values in this skill.

Data Reuse (AAU Optimization): If the same command was already run on this VM earlier in this conversation, return the cached result instead of re-executing. Only re-execute if the user explicitly asks to refresh or re-run.

Infrastructure Requirements

This skill requires the MCP command proxy (live-command broker), registered as the sap-sre-proxy MCP connector (from the sap-sre-proxy-ops plugin's .mcp.json).

• Connector configured — call its tools directly: list_allowed_commands, run_command, run_batch. The agent invokes these natively; no Python/HTTP needed. The MCP server enforces the allowlist and runs commands under its own managed identity.
• Connector missing — Respond exactly: "Live VM commands require the MCP command proxy. Deploy it with infra/deploy-mcp-proxy.ps1, add the sap-sre-proxy MCP connector, then re-paste team onboarding. Until then, this skill is unavailable." Then stop.

When to Use

• "Run crm_mon on vm01" / "Show cluster status on vm01"
• "Show SAP process list on AB1vm"
• "Get HANA version on ab3dbvm"
• "Check HSR replication state on vm01"
• "Show memory usage on AB1vm" / "Check filesystem usage on ab2dbvm"
• "What commands are available?" / "List commands"

When NOT to Use

• "Is AB1 running?" → Use SAP Landscape Discovery (VM power state via ARM API)
• "Is everything healthy?" → Use SAP Operational Health
• General health/status questions → Use SAP Operational Health

Output Format

Display command output exactly as it appears on the VM — preserve formatting, alignment, and whitespace. Do not summarize or reformat unless the user explicitly asks for interpretation.

Command Proxy

Call the sap-sre-proxy MCP connector's tools directly:

• list_allowed_commands() — discover the allowlist.
• run_command(vm, resource_group, command_id, subscription_id, sid, sidadm, instance) — run one command. Always pass subscription_id — the proxy runs in a different subscription than the SAP VMs.
• run_batch(vm, resource_group, command_ids, ...) — run up to 6 commands.

Show the returned output verbatim. The MCP server enforces the same allowlist and runs commands under its own managed identity.

Critical: Split SID Systems

Some systems have different SIDs for SAP and HANA. Check the landscape inventory for sap_sidadm and hana_sidadm fields:

• HANA commands (hdb_info, hdb_version, hsr_state, landscape_host_config): use hana_sidadm and db_sid
• SAP commands (sapcontrol_getprocesslist, sapcontrol_getinstancelist): use sap_sidadm and sid
• Example: AB1 system has sap_sidadm=ab1adm (SID=AB1) and hana_sidadm=db1adm (DB SID=DB1)

Available Commands (14 — all read-only)

All commands are read-only. None modify SAP state, HANA data, cluster config, or OS settings.

Command ID	Description	Requires sidadm
crm_mon	Pacemaker cluster status (crm_mon -r -1)	No
crm_status	Pacemaker resource status (crm status)	No
saphanasr_showattr	HANA SR site attributes (SAPHanaSR-showAttr)	No
sapcontrol_getprocesslist	SAP process list (sapcontrol -function GetProcessList)	Yes
hdb_info	HANA process information (HDB info)	Yes
hdb_version	HANA version/revision (HDB version)	Yes
hsr_state	HSR replication state (hdbnsutil -sr_state)	Yes
systemctl_cluster	Pacemaker/corosync/SBD service status	No
df_hana	HANA filesystem usage (df -h /hana/*)	No
free_mem	Memory usage (free -h)	No
uptime	System uptime and load average	No
os_release	OS version (cat /etc/os-release)	No
sapcontrol_getinstancelist	SAP instance list (sapcontrol -function GetSystemInstanceList)	Yes
landscape_host_config	HANA landscape host configuration	Yes

Identifying VM and Parameters

Use the SAP landscape inventory (Knowledge Source) to resolve:

• vm: VM hostname (e.g., AB1vm)
• rg: Resource group containing the VM (e.g., RG_SAP_CUS_AB1)
• subscription_id: SAP Subscription from Team Onboarding Agent Identity section (e.g., 40050ff9-...)
• sidadm: Check hana_sidadm vs sap_sidadm in the inventory (e.g., db1adm for HANA, ab1adm for SAP)
• instance: HANA instance number (usually 00) or ASCS instance (usually 01)
• sid: SAP SID or DB SID in uppercase depending on the command type

When the user says "run crm_mon on AB1", look up AB1 in the landscape inventory to find the VM name, resource group, and subscription, then call run_command().

Error Handling

If the MCP command proxy is unreachable or returns an error, inform the user:

• Authentication failure: "Command proxy authentication failed. Check the MCP connector's API key in Team Onboarding."
• Timeout: "VM did not respond within timeout. The VM may be stopped or unresponsive."
• Connection error: "Command proxy is unreachable. Verify the sap-sre-proxy MCP connector and that the Container App is running."