That disclaimer is the author's own: no authentication, authorization or network restriction is built in, and putting those in front of it is your job before it goes anywhere near a plant. The supplied run script also sets `NODE_TLS_REJECT_UNAUTHORIZED` to 0, which is convenient against a self-signed internal certificate and unacceptable outside a trusted network.
A Node server that fronts a WinCC Unified SCADA system's GraphQL API, exposing tag reads and writes, alarm queries and acknowledgement, and object browsing as MCP tools.
- `get-tag-values` for current values and `get-logged-tag-values` for historical data
- `get-active-alarms` and `get-logged-alarms`, with `acknowledge-alarms` and `reset-alarms` to act on them
- `write-tag-values` to set values on the system
- `browse-objects` to find what exists before you query it
- `login-user` for a user session, or an automatic service-account login the server refreshes every minute
Node.js v18 or later and a reachable WinCC Unified GraphQL endpoint in `GRAPHQL_URL`. `GRAPHQL_USR` and `GRAPHQL_PWD` are optional and enable the service-account session. The server listens on port 3000 by default — `MCP_PORT` changes it — and serves MCP at `/mcp`; clients connect through `npx mcp-remote http://localhost:3000/mcp`.
