OPC UA MCP servers for AI agents, compared
The cross-vendor information model most modern PLCs, SCADA hosts, and historians can expose. Security policy, certificates, and user identity matter as much as the node id.
An OPC UA MCP server lets an AI client such as Claude Desktop, Cursor, or VS Code call OPC UA browse, read, history, and sometimes write as MCP tools. The server adds no safety of its own.
As of 3 November 2026, OT AI Hub lists 6 OPC UA tools for AI agents: 3 expose writes by default, 2 gate writes behind a flag, and 1 is read-only.
Those counts use the write policy on each entry. plctap is gated because plc_write can be armed for other protocols. In v0.6.2 its OPC UA path is read-only and documented as SecurityPolicy None.
A gated write is still a write once you arm it.
The comparison
Every OPC UA tool in the index, sorted from read-only to writes exposed. A cell says Not stated when the entry does not record that fact.
| Name | Maintainer | Language / runtime | Write policy | Tools exposed | Security policy | License | Maturity | Last verified |
|---|---|---|---|---|---|---|---|---|
| Proxus Industrial MCP Server | Proxus | Single binary or GHCR image. Language not stated. | Read-only | Read, named maps, connection diagnostic. No write tool. | Security policies and certificates supported. | Not stated. Filed as free, not open source. | Preview | 2026-11-03 |
| IndustriConnect OPC UA MCP | IndustriAgents | Python and Node | Writes gated | Browse, read, history, alarms, method calls. Writes need an operator profile and an allowlist. | Pinned certificate or a trust store for an authenticated server. | Open source. License name not stated in the entry. | Community | 2026-11-03 |
| plctap | ymxc152 | Python (PyPI, uvx) | Writes gatedOPC UA path is read-only in v0.6.2. | detect_device is read-only. plc_write and send_frame register only if PLCTAP_ALLOW_WRITE=true. OPC UA path is read-only in v0.6.2. | OPC UA path documented as SecurityPolicy None. | MIT | Community | 2026-11-03 |
| FieldWorks protocol adapters | FieldWorks | Rust | Writes exposed | Shared surface includes setpoint writes. OPC UA adapter marked complete. | Not stated | Apache-2.0 | Preview | 2026-11-03 |
| kukapay/opcua-mcp | kukapay | Python | Writes exposed | Read, write, browse, and batch, including write_opcua_node and a multi-write. | Not stated | MIT | Community | 2026-11-03 |
| OPC Foundation OPC UA MCP | OPC Foundation | .NET (dotnet tool) | Writes exposed | Profiles: core, machinery, alarms, history, and others. Default profile can write. | Not stated | MIT | Available | 2026-11-03 |
How to read writes exposed and writes gated
Writes exposed means a write tool is in the default catalog, with no arming step. Writes gated means that tool stays unregistered until a setting is turned on. The cells link to those definitions.
Pick by situation
The same servers, grouped by the job. The write-policy label in the table still governs.
Read-only discovery on a live line
Proxus Industrial MCP Server is the only read-only OPC UA entry. Proxus says no tool writes a value or changes a controller, and the assistant can reach only devices named in proxus-mcp.json. Read-only is the sensible default on a live line. Certificates are supported. The checked build was beta 0.1.0-beta.5. No source license was stated. The Proxus platform MCP is a different product.
Official reference implementation
The OPC Foundation OPC UA MCP is the official .NET tool, package OPCFoundation.NetStandard.Opc.Ua.Mcp. Profiles cover core, machinery, alarms, history, and others. Writes are exposed: the default profile is broad, and UA services include writes. Use a least-privilege user on a test server. The license is MIT.
One server, many protocols
plctap (ymxc152) is one Python server for Modbus, FINS, MELSEC, S7, IEC 104, EtherNet/IP, and OPC UA. Writes are gated: plc_write stays off unless PLCTAP_ALLOW_WRITE=true. In v0.6.2 the OPC UA path is read-only, at SecurityPolicy None. The license is MIT.
Python and Node, with history and alarms
IndustriConnect OPC UA MCP is published by IndustriAgents at IndustriAgents/OPCUA-MCP. Python and Node expose browse, read, history, alarms, and gated writes. Writes and method calls need an operator profile, an allowlist, and a pinned certificate or trust store. A mock plant is in the repo. The license name is not stated.
Smallest possible test rig
kukapay/opcua-mcp is a small Python server for a simulator. Read, write, browse, and batch are on together, including write_opcua_node. No allowlist and no arming switch are documented, so writes are exposed. The license is MIT. Use it on a simulator.
Rust, multi-protocol, preview
FieldWorks protocol adapters are a preview Rust workspace (Apache-2.0). OPC UA and MQTT are implemented. Modbus, DNP3, and EtherNet/IP are stubs, and MQTT here is not Sparkplug B. Setpoint writes are on the shared surface, so writes are exposed. Security policy support is not stated.
What an agent can and can't do over OPC UA
Over OPC UA, the agent can call only the tools the MCP server registered, and the session can still refuse them. Browse returns node ids, browse names, and references. Read returns a value, a status code, and a source timestamp. History, where implemented, is a historian query. Alarms are a different service from a value read. A method call can start a job or change a state machine, so treat a method as control.
A write sets a variable. Proxus Industrial MCP Server publishes no write tool. IndustriConnect OPC UA MCP keeps writes and method calls behind an operator profile and an allowlist. plctap can arm plc_write for other protocols, while its checked OPC UA path does not write. The OPC Foundation OPC UA MCP, kukapay/opcua-mcp, and FieldWorks protocol adapters expose a write on the default surface.
The MCP process holds the session and the application certificate. Security policy, message security mode, and the user identity token decide what that session may do. A node id names a node. Permission comes from the user and the security mode. SignAndEncrypt both signs and encrypts the session. A read-only OPC UA user will reject a write even when the MCP server offers the tool. Put the first connection on a test server whose certificate you already trust.
Security checklist before you attach an MCP client
Make the OPC UA session harder to misuse than the prompt before Claude, Copilot, or Cursor is attached.
- Use a test server or a simulator for the first connection.
- Use an OPC UA user that can read only the nodes you named.
- Prefer SignAndEncrypt when the server documents it. If the only documented mode is SecurityPolicy None, stay on a lab network.
- Leave gated writes off. A server with no gate does not belong on a host that can route to the plant.
- Log every tool call, arguments included, where the agent cannot rewrite the log.
The gate is a switch you throw.
Not yet in the index
On 3 November 2026, public search also showed mwieczorkiewicz/opcua-mcp and vogler75/opcua-mcp-server. They are under review, not entries, so this page states no write policy, security policy, or license for them. Send a repository URL through the submission form.
- mwieczorkiewicz/opcua-mcphttps://github.com/mwieczorkiewicz/opcua-mcp
- vogler75/opcua-mcp-serverhttps://github.com/vogler75/opcua-mcp-server
FAQ
What is an OPC UA MCP server?
An OPC UA MCP server connects to an OPC UA endpoint and exposes services such as browse, read, history, and sometimes write as Model Context Protocol tools. A client such as Claude Desktop, Cursor, or VS Code calls those tools. It adds no safety of its own. As of 3 November 2026, what the agent can change depends on which tools the server turns on and on the OPC UA user and security policy.
Which OPC UA MCP servers are read-only by default?
As of 3 November 2026, OT AI Hub lists 6 OPC UA tools. Only Proxus Industrial MCP Server is read-only. IndustriConnect OPC UA MCP and plctap gate writes behind a setting. FieldWorks protocol adapters, kukapay/opcua-mcp, and OPC Foundation OPC UA MCP expose a write tool by default. plctap is counted as gated; its checked OPC UA path is read-only.
Is there an official OPC Foundation MCP server?
Yes. The OPC Foundation publishes the OPC Foundation OPC UA MCP, an open-source .NET tool with selectable profiles: core, machinery, alarms, history, and others. OT AI Hub classifies it as writes exposed, because the default profile is broad and UA services include writes. As of 3 November 2026, use a least-privilege OPC UA user on a test server with that default.
Can an AI agent write to OPC UA nodes through MCP?
Yes, when the MCP server exposes a write tool and the OPC UA session is allowed to write. As of 3 November 2026, OT AI Hub lists 3 servers that expose a write by default, 2 that gate it, and 1 that is read-only. A gated write is still a write once you arm it. The OPC UA user can still reject the call.
Which OPC UA MCP server supports certificates or security policies?
As of 3 November 2026, Proxus supports OPC UA security policies and certificates. IndustriConnect requires a pinned certificate or a trust store before writes and method calls. plctap documents its OPC UA path as SecurityPolicy None. Security policy support is not stated for the OPC Foundation tool, kukapay/opcua-mcp, or FieldWorks.
Sources
Sources below are the pages opened for each entry. The access date is that entry's last verified date. Corrections go through the form. Last verified for this comparison: 2026-11-03.
Proxus Industrial MCP Server
Verified 2026-11-03
- Product pagehttps://proxus.io/tools/industrial-mcp-server/
IndustriConnect OPC UA MCP
Verified 2026-11-03
- Repositoryhttps://github.com/IndustriAgents/OPCUA-MCP
- IndustriAgentshttps://industriagents.com/connect
plctap
Verified 2026-11-03
FieldWorks protocol adapters
Verified 2026-11-03
- Repositoryhttps://github.com/fieldworks-build/fieldworks-adapters
OPC Foundation OPC UA MCP
Verified 2026-11-03
- McpREADMEhttps://github.com/OPCFoundation/UA-.NETStandard/blob/master/tools/Opc.Ua.Mcp/McpREADME.md
- UA-.NETStandardhttps://github.com/OPCFoundation/UA-.NETStandard