plctap

Who it's for

An engineer attaching an MCP client to Modbus, FINS, MELSEC / SLMP, Siemens S7, IEC 60870-5-104, EtherNet/IP, OPC UA. Treat the write policy as the safety boundary: a gated write is still a write once you arm it.

Caveat / limitations

MIT, v0.6.2 on PyPI when checked. Install with uvx plctap. detect_device probes common ports and is read-only. plc_write and send_frame are not registered unless PLCTAP_ALLOW_WRITE=true. IEC 104 and OPC UA are read-only in this version, and the OPC UA path is documented as SecurityPolicy None for diagnosis, not as a secured session. EtherNet/IP and MELSEC SLMP share port 44818; the detector uses the response fingerprint. Author is an individual maintainer, not a vendor.

Protocols

• ModbusModbus TCP, UDP, and serial RTU. Still the everyday protocol on meters, drives, and small PLCs. Register meaning is vendor-specific: an address without a map is just a number.
• FINSOmron's Factory Interface Network Service. Word areas such as DM and CIO are the usual agent surface.
• MELSEC / SLMPMitsubishi MELSEC device memory via SLMP (3E frames are the common case). Default ports overlap EtherNet/IP, so fingerprint the response before you assume the protocol.
• Siemens S7S7comm over ISO-on-TCP (port 102) to SIMATIC S7-300, S7-400, S7-1200, and S7-1500. Addressing is by area and byte, not by an OPC UA node.
• IEC 60870-5-104IP transport for IEC 60870-5 telecontrol, common in electrical substations. Reads are often interrogation-based rather than a simple register poll.
• EtherNet/IPCIP over Ethernet, used by Rockwell Allen-Bradley Logix controllers and many other devices. Logix access is usually by tag name, not by a Modbus-style register number.
• OPC UAThe cross-vendor information model most modern PLCs, SCADA hosts, and historians can expose. Security policy, certificates, and user identity matter as much as the node id.

Sources

• GitHubhttps://github.com/ymxc152/plctap
• PyPIhttps://pypi.org/project/plctap/

This page: https://otaihub.com/tools/plctap