Skybuffer Apps in LibreChat: Patch Installation

Purpose and scope

The Skybuffer Apps patch adds business apps such as Launchpad, Procurement Desk and Executive Briefing to LibreChat. The apps work with SAP through LibreChat’s MCP connection to the Skybuffer AI MCP server.

This manual is for the administrator who runs LibreChat with Docker Compose. It takes a clean LibreChat v0.8.8 or your own fork of it to a running installation with the apps, in five steps:

Step	What you do	Where
1	Apply the patch to the LibreChat sources	git, on the server or a workstation
2	Build your own LibreChat image	Docker Compose
3	Connect the SAP MCP server	librechat.yaml
4	Set the apps repository	.env
5	Check the apps	LibreChat in the browser

What the patch adds

The patch is the file skybuffer-apps-settings-v0.8.8.patch. It adds:

• Apps (/apps): the button in the sidebar opens the list of apps, or a home app set in .env; an app opens at /apps/<id>.
• Settings → Apps: install apps from the Skybuffer apps repository, upload your own, choose the MCP server and the model the apps use.
• Settings → Models (admins only): add OpenAI-compatible model connections in the browser instead of librechat.yaml.

All Skybuffer code goes into a new folder skybuffer/ at the root of the repository. In LibreChat’s own files the patch changes about 250 lines in 19 files, mostly the Settings dialog and translation.json. The patch needs no database migrations; the apps store their data in new MongoDB collections whose names start with skybuffer.

Prerequisites

• LibreChat v0.8.8, installed from the git repository and running with Docker Compose:

  git clone https://github.com/danny-avila/LibreChat.git
  cd LibreChat
  git checkout v0.8.8

  The patch changes source code. It cannot be applied to the ready-made LibreChat image, so you build your own image in step 2.
• From Skybuffer:
  • the patch file;
  • the address of the SAP MCP server of your system;
  • a read-only GitHub token for the apps repository, one per installation.
• About 10 GB of free disk space and 20 to 40 minutes for the image build.

Installation steps

Step 1: Apply the patch

Find out which LibreChat you have. In the LibreChat folder, run:

git describe --tags --match 'v*'

• v0.8.8: a clean clone. Follow 1a.
• v0.8.8-<N>-g<hash>: N commits of your own on top of the release, a customized fork. Follow 1b.

1a. Clean clone of LibreChat

Work in the LibreChat folder on the host where you run docker compose. Do not patch inside a running container: it holds the built app without sources and is recreated from the image on the next docker compose up.

git status                           # must be clean; commit or stash your changes first
git am /path/to/skybuffer-apps-settings-v0.8.8.patch

git am creates a commit, so git needs a committer name and email. If it stops with Committer identity unknown, typical on a server as root, run git am --abort, set them for this repository only and apply again:

git config user.name  "LibreChat admin"
git config user.email "admin@example.com"

The author of the commit stays Skybuffer; these settings only name who applied it.

If git am stops with a conflict, run git am --abort and send its output to Skybuffer. Without git history, for example in a copy of the folder, apply the patch with patch -p1 < /path/to/skybuffer-apps-settings-v0.8.8.patch.

1b. Customized fork of LibreChat

Apply the patch on a branch of its own made from the clean v0.8.8, then merge that branch into your fork. Do this on a workstation, where your IDE shows conflicts side by side, not on the server:

git fetch https://github.com/danny-avila/LibreChat.git tag v0.8.8   # only if your fork has no v0.8.8 tag
git switch -c skybuffer-apps v0.8.8
git am /path/to/skybuffer-apps-settings-v0.8.8.patch
git switch <your branch>
git merge skybuffer-apps

Conflicts appear only where your own changes touch the same lines of LibreChat’s files; the new skybuffer/ folder never conflicts. Keep both sides, build, test and push your branch. On the server, take the result with git pull --ff-only.

The separate branch keeps the Skybuffer commit on its v0.8.8 base: git log skybuffer-apps shows exactly what came from Skybuffer, git revert removes it, and the next Skybuffer patch is merged the same way.

If your fork is based on another LibreChat release, ask Skybuffer for a patch made for that release.

Step 2: Build your own image

Create docker-compose.override.yml next to docker-compose.yml, or add these keys to its existing api: section; a service can appear only once:

docker-compose.override.yml

services:
  api:
    image: librechat-skybuffer:v0.8.8
    build:
      context: .
      target: node
    volumes:
      - type: bind
        source: ./librechat.yaml
        target: /app/librechat.yaml

Build and start:

docker compose build api
docker compose up -d

Build on another machine

You can build on a build machine or in CI and only run the image on the server. On the build machine, after step 1 and the override file above:

docker compose build api
docker save librechat-skybuffer:v0.8.8 | gzip > librechat-skybuffer-v0.8.8.tar.gz

On the server, load it with gunzip -c librechat-skybuffer-v0.8.8.tar.gz | docker load, or push and pull it through your registry. In the server’s override file keep image: and volumes: and drop build:, then run docker compose up -d.

Step 3: Connect the SAP MCP server

The apps call SAP tools through an MCP server configured in LibreChat. Add it to librechat.yaml; if you have no such file yet, create it with cp librechat.example.yaml librechat.yaml.

Configure the server in librechat.yaml, not in the browser

LibreChat also lets you add MCP servers in the browser, but for the apps this does not work reliably:

• A server added in the browser is visible only to the user who added it, unless they share it. The apps of all other users then report that SAP is not connected.
• The browser form has no requiresOAuth setting, so the technical-user server below never connects.
• Its connection timeout is 30 seconds. The SAP MCP server lists about 250 tools, which can take longer on a busy system.

If a SAP server was already added in the browser, delete it there before you add it to librechat.yaml.

Name the server sap-erd and give it the title SAP ERD: the apps look for a server of that name. Case, spaces, hyphens and underscores do not matter. With another name, choose the server for the apps in Settings → Apps, under One MCP server for all apps.

Choose how the server signs in to SAP:

Technical user

All users work in SAP as one technical user. This needs nothing beyond the MCP server and is the quickest way to see the apps working.

librechat.yaml

mcpServers:
  sap-erd:
    title: SAP ERD
    type: streamable-http
    url: https://sap.example.com/<MCP path from Skybuffer>
    requiresOAuth: false   # the SAP server publishes OAuth metadata for every path
    timeout: 120000        # some SAP calls are slow
    initTimeout: 120000    # listing ~250 tools takes time

requiresOAuth: false is required. Without it LibreChat finds the OAuth metadata that the SAP server publishes, waits for a sign-in that never comes, and the server stays grey.

The technical user comes from the logon data of the ICF node in SICF. If the node has none, SAP asks for a user and password; send them as a header and keep the value in .env:

librechat.yaml

    headers:
      Authorization: 'Basic ${SAP_MCP_BASIC}'

.env

SAP_MCP_BASIC=<base64 of user:password>

Each user's own SAP user (OAuth)

Every user works in SAP with their own SAP user and authorizations. The SAP Basis consultant configures SAP first, as described in OAuth Configuration for SAP MCP Server. In step 4 of that manual, the redirect URI is LibreChat’s:

https://<your LibreChat domain>/api/mcp/sap-erd/oauth/callback

The server name sap-erd is part of this URI. Do not rename the server later, or sign-ins fail until the redirect URI in SOAUTH2 is changed too.

librechat.yaml

mcpServers:
  sap-erd:
    title: SAP ERD
    type: streamable-http
    url: https://sap.example.com/sap/bc/abap/skybfr/mcp
    timeout: 120000
    initTimeout: 120000
    oauth:
      authorization_url: https://sap.example.com/sap/bc/abap/skybfr/yai_mcp_oa2/authorize?sap-client=100
      token_url: https://sap.example.com/sap/bc/abap/skybfr/yai_mcp_oa2/token?sap-client=100
      client_id: AI_CLIENT
      client_secret: '${SAP_MCP_CLIENT_SECRET}'
      scope: /SKYBFR/YAI_MCP
      token_exchange_method: basic_auth_header

.env

SAP_MCP_CLIENT_SECRET=<the password of the OAuth client user>

Use the values from step 7 of the OAuth manual. Each user then connects the server once: in a chat, open the MCP servers, choose SAP ERD → Connect, sign in to SAP and click Allow. The apps cannot open a sign-in themselves, so until a user has connected the server, their apps report that SAP is not connected. LibreChat keeps the tokens in its database and refreshes them; users sign in again only after the refresh token expires in SAP.

Apply the change:

docker compose restart api

Step 4: Set the apps repository

Add to LibreChat’s .env file:

.env

# Apps repository: the catalog in Settings → Apps
SKYBUFFER_APPS_REPO=https://github.com/Skybuffer/open-webui-apps
SKYBUFFER_APPS_REF=v2026.11.10          # a release tag from Skybuffer
SKYBUFFER_APPS_TOKEN=<token from Skybuffer>

# Optional
# SKYBUFFER_APPS_ONLY=launchpad,procurement-desk   # catalog keys to offer; empty: all
# SKYBUFFER_APPS_HOME=launchpad                    # app shown at /apps; "none": the list of apps
# SKYBUFFER_APPS_SAMPLE_MODEL=<endpoint>/<model>   # model for apps that use AI; default: first custom endpoint

The token gives read access to the apps repository. Keep it only in .env; LibreChat never sends it to the browser.

Leave CSP_ENABLED off, as it is by default: with CSP on, the browser blocks the apps’ scripts.

Apply the change with docker compose restart api.

Step 5: Check the apps

1. Sign in to LibreChat as an admin. On a new installation, the first registered user is the admin.

2. Check that the sidebar has the Apps button, and that the Settings dialog has the tabs Apps and Models.

3. In Settings → Apps, the section Apps repository lists the Skybuffer apps. Install Launchpad.

4. Check that the SAP ERD server is green in a chat. With OAuth, connect it first, as described in step 3.

5. Open Apps. Launchpad starts, asks once to be allowed to call SAP, and shows data from SAP.

Troubleshooting

Logs: docker compose logs api --tail 200. For the MCP connection only:

docker compose logs api --since 10m 2>&1 | grep -i -E "mcp|sap-erd"

Symptom	Cause	Fix
The section Apps repository shows an error	Wrong or expired token, or a tag that does not exist	Check SKYBUFFER_APPS_TOKEN and SKYBUFFER_APPS_REF, then restart
An app says “SAP ERD is not connected for you”	No MCP server named SAP ERD for this user, the server was added in the browser by another user, or a server chosen for the apps was renamed or deleted	Configure the server in librechat.yaml as in step 3; check the server chosen in Settings → Apps
An app says “SAP ERD is not connected for you” with OAuth	The user has not connected the server yet	The user connects SAP ERD once in a chat
The SAP ERD server does not turn green	See the check below
An app reports a timeout	A slow SAP call	Raise timeout of the server in librechat.yaml
The model fails on tool_search with “input failed schema validation”	The model asked for more than 50 results	Add to the agent’s instructions: “tool_search: max_results at most 50; to find SAP tools, pass mcp_server sap-erd and a short query”

The SAP ERD server does not turn green. From the LibreChat server, send a request to the MCP URL:

curl -s -o /dev/null -D - -X POST -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"ping"}' \
  https://sap.example.com/<MCP path from Skybuffer>

Answer	Meaning	Fix
200	SAP accepts the request; LibreChat expects an OAuth sign-in	Add requiresOAuth: false (technical user)
401 with WWW-Authenticate: Basic	SAP needs a user and password	Enter logon data on the ICF node in SICF, or send the Authorization header (technical user)
401 with WWW-Authenticate: Bearer	The OAuth endpoint, as expected	Configure the oauth section (OAuth)
No answer, timeout or certificate error	Network, firewall or TLS between LibreChat and SAP	Check the route and the SAP certificate from the LibreChat host

Remove the apps

git revert <commit of the patch>     # clean clone: or git checkout v0.8.8
docker compose build api && docker compose up -d

Remove the SKYBUFFER_* lines from .env. The skybuffer* collections in MongoDB do no harm; drop them if you want a clean database.

Updating LibreChat

Update on a workstation, not on the server: merge conflicts are much easier to resolve in an IDE than over SSH.

1. Merge the new LibreChat release into your branch:

   git remote add upstream https://github.com/danny-avila/LibreChat.git   # once
   git fetch upstream --tags
   git merge v0.8.9                                                        # the new release

2. Resolve conflicts in LibreChat’s files changed by the patch, keeping both LibreChat’s change and the Skybuffer lines. Build, test and push.

3. On the server, run git pull --ff-only, then docker compose build api && docker compose up -d, or run an image built elsewhere.

Or ask Skybuffer for a patch made for the new release: Skybuffer resolves the conflicts, and you apply it to the clean release or merge it into your fork as in 1b.