---
name: sap-command-runner
description: "Runs allowlisted read-only commands on SAP VMs via a secure MCP command proxy (Container App + Azure VM Run Command API). 14 read-only commands — zero changes to SAP environment. Users invoke directly for live VM queries; other skills invoke it for data collection."
tools:
    - ExecutePythonCode
---

## Environment Configuration

All environment-specific values (MCP endpoint URL, API key, SAP landscape) are provided via the Team Onboarding instructions. The agent reads these from the onboarding context at runtime. Do not hardcode environment values in this skill.

**Data Reuse (AAU Optimization)**: If the same command was already run on this VM earlier in this conversation, return the cached result instead of re-executing. Only re-execute if the user explicitly asks to refresh or re-run.

## Infrastructure Requirements

This skill **requires the MCP command proxy** (live-command broker), registered as the **`sap-sre-proxy` MCP connector** (from the `sap-sre-proxy-ops` plugin's `.mcp.json`).

- **Connector configured** — call its tools directly: `list_allowed_commands`, `run_command`, `run_batch`. The agent invokes these natively; no Python/HTTP needed. The MCP server enforces the allowlist and runs commands under its own managed identity.
- **Connector missing** — Respond exactly: "Live VM commands require the MCP command proxy. Deploy it with `infra/deploy-mcp-proxy.ps1`, add the `sap-sre-proxy` MCP connector, then re-paste team onboarding. Until then, this skill is unavailable." Then stop.

## When to Use

- "Run crm_mon on vm01" / "Show cluster status on vm01"
- "Show SAP process list on AB1vm"
- "Get HANA version on ab3dbvm"
- "Check HSR replication state on vm01"
- "Show memory usage on AB1vm" / "Check filesystem usage on ab2dbvm"
- "What commands are available?" / "List commands"

### When NOT to Use
- "Is AB1 running?" → Use SAP Landscape Discovery (VM power state via ARM API)
- "Is everything healthy?" → Use SAP Operational Health
- General health/status questions → Use SAP Operational Health

## Output Format

Display command output **exactly as it appears on the VM** — preserve formatting, alignment, and whitespace. Do not summarize or reformat unless the user explicitly asks for interpretation.

## Command Proxy

Call the `sap-sre-proxy` MCP connector's tools directly:
- `list_allowed_commands()` — discover the allowlist.
- `run_command(vm, resource_group, command_id, subscription_id, sid, sidadm, instance)` — run one command. Always pass `subscription_id` — the proxy runs in a different subscription than the SAP VMs.
- `run_batch(vm, resource_group, command_ids, ...)` — run up to 6 commands.

Show the returned output **verbatim**. The MCP server enforces the same allowlist and runs commands under its own managed identity.

### Critical: Split SID Systems

Some systems have different SIDs for SAP and HANA. Check the landscape inventory for `sap_sidadm` and `hana_sidadm` fields:
- **HANA commands** (`hdb_info`, `hdb_version`, `hsr_state`, `landscape_host_config`): use `hana_sidadm` and `db_sid`
- **SAP commands** (`sapcontrol_getprocesslist`, `sapcontrol_getinstancelist`): use `sap_sidadm` and `sid`
- Example: AB1 system has `sap_sidadm=ab1adm` (SID=AB1) and `hana_sidadm=db1adm` (DB SID=DB1)

## Available Commands (14 — all read-only)

All commands are read-only. None modify SAP state, HANA data, cluster config, or OS settings.

| Command ID | Description | Requires sidadm |
|---|---|---|
| `crm_mon` | Pacemaker cluster status (`crm_mon -r -1`) | No |
| `crm_status` | Pacemaker resource status (`crm status`) | No |
| `saphanasr_showattr` | HANA SR site attributes (`SAPHanaSR-showAttr`) | No |
| `sapcontrol_getprocesslist` | SAP process list (`sapcontrol -function GetProcessList`) | Yes |
| `hdb_info` | HANA process information (`HDB info`) | Yes |
| `hdb_version` | HANA version/revision (`HDB version`) | Yes |
| `hsr_state` | HSR replication state (`hdbnsutil -sr_state`) | Yes |
| `systemctl_cluster` | Pacemaker/corosync/SBD service status | No |
| `df_hana` | HANA filesystem usage (`df -h /hana/*`) | No |
| `free_mem` | Memory usage (`free -h`) | No |
| `uptime` | System uptime and load average | No |
| `os_release` | OS version (`cat /etc/os-release`) | No |
| `sapcontrol_getinstancelist` | SAP instance list (`sapcontrol -function GetSystemInstanceList`) | Yes |
| `landscape_host_config` | HANA landscape host configuration | Yes |

## Identifying VM and Parameters

Use the SAP landscape inventory (Knowledge Source) to resolve:
- **vm**: VM hostname (e.g., `AB1vm`)
- **rg**: Resource group containing the VM (e.g., `RG_SAP_CUS_AB1`)
- **subscription_id**: SAP Subscription from Team Onboarding Agent Identity section (e.g., `40050ff9-...`)
- **sidadm**: Check `hana_sidadm` vs `sap_sidadm` in the inventory (e.g., `db1adm` for HANA, `ab1adm` for SAP)
- **instance**: HANA instance number (usually `00`) or ASCS instance (usually `01`)
- **sid**: SAP SID or DB SID in uppercase depending on the command type

When the user says "run crm_mon on AB1", look up AB1 in the landscape inventory to find the VM name, resource group, and subscription, then call `run_command()`.

## Error Handling

If the MCP command proxy is unreachable or returns an error, inform the user:
- Authentication failure: "Command proxy authentication failed. Check the MCP connector's API key in Team Onboarding."
- Timeout: "VM did not respond within timeout. The VM may be stopped or unresponsive."
- Connection error: "Command proxy is unreachable. Verify the `sap-sre-proxy` MCP connector and that the Container App is running."