OPC UA MCP Server

io.github.midhunxavier/opcua

Connect AI assistants to industrial OPC UA: browse, read, history, subscriptions, events and alarms.

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "opcua": {
      "command": "npx",
      "args": [
        "-y",
        "opcua-mcp-server@0.6.0"
      ],
      "env": {
        "OPCUA_SERVER_URL": "<your OPCUA_SERVER_URL>",
        "OPCUA_PYTHON_BACKEND": "asyncua",
        "OPCUA_SECURITY_POLICY": "None",
        "OPCUA_CLIENT_KEY": "<your OPCUA_CLIENT_KEY>",
        "OPCUA_PASSWORD": "<your OPCUA_PASSWORD>",
        "OPCUA_USER_KEY": "<your OPCUA_USER_KEY>",
        "OPCUA_PROFILE": "<your OPCUA_PROFILE>",
        "OPCUA_ALLOW_ACKNOWLEDGE_ALARMS": "false",
        "OPCUA_ALLOW_INSECURE_CONTROL": "false",
        "OPCUA_ALLOW_UNVERIFIED_SERVER_CONTROL": "false",
        "OPCUA_ALLOW_OUT_OF_RANGE_WRITES": "false",
        "OPCUA_AUDIT_FSYNC": "always",
        "OPCUA_AUDIT_CHAIN": "none",
        "OPCUA_AUDIT_CHAIN_KEY_FILE": "<your OPCUA_AUDIT_CHAIN_KEY_FILE>",
        "OPCUA_RECONNECT_INITIAL_DELAY_MS": "1000",
        "OPCUA_RECONNECT_MAX_DELAY_MS": "8000",
        "OPCUA_RECONNECT_MAX_RETRY": "3",
        "OPCUA_SESSION_TIMEOUT_MS": "60000"
      }
    }
  }
}

Environment variables

OPCUA_SERVER_URLrequiredURL of the OPC UA server to connect to, including any path the server expects. Read once at startup: one process serves one endpoint. Verify who answers with an exact server certificate pin or a configured CA trust store.
OPCUA_PYTHON_BACKENDSelect the Python client implementation. The maintained asyncua client is the default; legacy provides the one-release rollback path for uncovered vendor incompatibilities. This setting affects the Python server only.
OPCUA_SECURITY_POLICYEncryption suite to negotiate for the secure channel. Anything other than None needs a client certificate and key. The two AES suites are Node-only: the Python runtime refuses them at startup rather than downgrading. None is unencrypted and unauthenticated, and keeps control tools blocked unless insecure control is explicitly allowed. An unknown policy stops the server at startup.
OPCUA_CLIENT_KEYsecretPath to the private key matching the client certificate. A path, never key material. Whoever can read the file can impersonate this client: keep it readable only by the account running the server. A path that does not exist stops the server at startup.
OPCUA_PASSWORDsecretPassword for the username. Without a security policy it crosses the network in clear text. Supply it through the client's secret storage, never on a command line.
OPCUA_USER_KEYsecretPath to the private key for the user certificate. It signs the server's challenge and is never sent. Whoever can read the file can log in as this user: keep it readable only by the account running the server.
OPCUA_PROFILErequiredWhich tools are offered. observe reads, browses, reads history and monitors; operator adds explicitly allowlisted writes, method calls and alarm actions; full exposes every tool and is meant only for a tightly scoped OPC UA account. Unset fails closed to observe; an unknown profile stops the server at startup.
OPCUA_ALLOW_ACKNOWLEDGE_ALARMSLet the operator profile act on alarms: acknowledge_alarm and every act_on_alarm action.
OPCUA_ALLOW_INSECURE_CONTROLPermit control tools on an OPC UA channel with no security policy (None). Does not cover a secured channel to an unverified server; that is OPCUA_ALLOW_UNVERIFIED_SERVER_CONTROL. Fail-open override: writes, method calls and alarm actions then travel unauthenticated and unencrypted. Reported as control=INSECURE-OVERRIDE in the startup line, get_server_status and every audit record. Never enable it against production equipment.
OPCUA_ALLOW_UNVERIFIED_SERVER_CONTROLPermit control tools on a secured OPC UA channel whose server is not authenticated: neither pinned with OPCUA_SERVER_CERT nor validated by OPCUA_SERVER_TRUST_STORE. Does not cover a channel with no security policy; that is OPCUA_ALLOW_INSECURE_CONTROL. Fail-open override: writes, method calls and alarm actions are then encrypted to whichever server answered the endpoint, which may be an impostor. Reported as control=UNVERIFIED-OVERRIDE in the startup line, get_server_status and every audit record. Never enable it against production equipment.
OPCUA_ALLOW_OUT_OF_RANGE_WRITESAllow a write outside the EURange the OPC UA server itself published for the node. A published InstrumentRange still applies. Fail-open override: it discards the only value bound a deployment with no policy file has.
OPCUA_AUDIT_FSYNCWhen an audit-file record counts as written. always fsyncs each record before the control call proceeds, so it survives a power loss; none leaves it to the operating system, so it survives only a crash of this process. none can lose the records of control calls that already reached the plant if the machine loses power.
OPCUA_AUDIT_CHAINAdds seq, prev_hash and hash to every audit record so edits, deletions and reordering can be detected with --verify-audit. sha256 catches accidental or naive edits; hmac-sha256 also resists anyone without the key. Requires the audit file. Set without an audit file, or hmac-sha256 without a key file, stops the server. No chain detects a truncated tail.
OPCUA_AUDIT_CHAIN_KEY_FILEsecretPath to the HMAC key for the hmac-sha256 audit chain: at least 32 bytes, for example from openssl rand -hex 32. Surrounding whitespace is ignored. Whoever can read the key can forge the chain: a key readable or writable by group or others stops the server. Refused unless the chain is hmac-sha256.
OPCUA_RECONNECT_INITIAL_DELAY_MSWait before the first attempt to repair a dropped or refused connection, in milliseconds. It doubles with each further attempt.
OPCUA_RECONNECT_MAX_DELAY_MSCeiling for the doubling retry delay, in milliseconds.
OPCUA_RECONNECT_MAX_RETRYRetries after the first attempt, per connection round, before a tool call gives up: a whole number from -1 to 1000. 0 never retries; -1 never stops trying, in bounded rounds of four retries so no single call waits forever.
OPCUA_SESSION_TIMEOUT_MSSession lifetime asked of the OPC UA server, in milliseconds. It also sets the keep-alive period, so it decides how quickly an idle connection notices the server has gone.

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category: Developer Tools
Version: 0.6.0
Registry: active
Published: 11/5/2026

Browse all Developer Tools →

io.github.midnight-rgb/mcp

midnight-rgb

Domain registrar for AI agents. Search, register, and manage domains via API.

Developer ToolsAdded 7 months ago

Crypto Pulse

midnight232

x402 Solana crypto pulse for agents + free BTC/ETH/SOL prediction arena

Developer ToolsAdded 1 week ago

MidOS - MCP Community Library

MidOSresearch

Curated knowledge for AI agents — 19K chunks, 121 skills, semantic search via MCP

Developer ToolsAdded 8 months ago

MidOS - MCP Community Library

MidOSresearch

Curated knowledge API for AI agents - skill packs, semantic search, validated patterns.

Developer ToolsAdded 8 months ago

io.github.miduo100/agent-virtual-world

miduo100

AI enters a live multiplayer 3D world as a visible avatar: walk, talk to real players, and be seen.

Developer ToolsAdded 1 month ago

io.github.mifactory-bot/mifactory-agent-memory

mifactory-bot

Persistent memory for AI agents across Claude, ChatGPT and any MCP client.

Developer ToolsAdded 7 months ago

Add the badge to your site

Show visitors that OPC UA MCP Server is listed here — it’s also the link we check for a free listing.

HTML — for your website

<a href="https://serverdex.io/server/io-github-midhunxavier-opcua?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="OPC UA MCP Server — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![OPC UA MCP Server — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-midhunxavier-opcua?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.

Connect this server

More Developer Tools servers

io.github.midnight-rgb/mcp

Crypto Pulse

MidOS - MCP Community Library

MidOS - MCP Community Library

io.github.miduo100/agent-virtual-world

io.github.mifactory-bot/mifactory-agent-memory

Add the badge to your site