WinCC Unified MCP Server

A Model Context Protocol (MCP) server designed to interface with SIEMENS WinCC Unified SCADA systems via their GraphQL API. This server exposes various WinCC Unified functionalities as MCP tools, allowing AI assistants and other MCP-compatible clients to interact with the SCADA system.

- Connects to a WinCC Unified GraphQL endpoint.
- Provides MCP tools for:

- User authentication (login-user).
- Browsing SCADA objects (browse-objects).
- Reading current tag values (get-tag-values).
- Querying historical/logged tag data (get-logged-tag-values).
- Fetching active alarms (get-active-alarms).
- Fetching logged alarms (get-logged-alarms).
- Writing values to tags (write-tag-values).
- Acknowledging alarms (acknowledge-alarms).
- Resetting alarms (reset-alarms).

- Node.js (v18.x or later recommended).
- npm (which typically comes with Node.js).
- Access to a running WinCC Unified GraphQL server endpoint.

The server is configured using environment variables:

- GRAPHQL_URL:Required. The full URL of your WinCC Unified GraphQL server. Example:https://your-wincc-server.example.com/graphql
- GRAPHQL_USR: (Optional) Username for a service account. If provided along withGRAPHQL_PWD, the server will attempt to log in with these credentials on startup and periodically (every minute) to maintain a session. This token is stored globally and used by tools if a user-specific login hasn't occurred.
- GRAPHQL_PWD: (Optional) Password for the service account.

Example environment variable setup (Linux/macOS):

export GRAPHQL_URL="http://localhost:4000/graphql" export GRAPHQL_USR="username1" export GRAPHQL_PWD="password1" export NODE_TLS_REJECT_UNAUTHORIZED=0 # Set to 0 to disable TLS certificate validation (development only)

Install dependencies:If you haven't already, install the necessary Node.js packages:

Set Environment Variables:Ensure theGRAPHQL_URL(and optionallyGRAPHQL_USR,GRAPHQL_PWD) environment variables are set as described in the "Configuration" section.

Run the server:You can use the providedrun.shscript (on Linux/macOS):

Therun.shscript executesexport NODE_TLS_REJECT_UNAUTHORIZED=0before starting the server withnode index.js. TheNODE_TLS_REJECT_UNAUTHORIZED=0setting disables TLS certificate validation, which might be necessary if your WinCC Unified GraphQL server uses HTTPS with a self-signed or internally-issued certificate.Warning:Disabling certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0) should only be done in trusted development or internal network environments, as it bypasses important security checks.

Alternatively, you can run the server directly:

# On Linux/macOS, if your GraphQL server uses HTTPS with a self-signed certificate: # export NODE_TLS_REJECT_UNAUTHORIZED=0 # On Windows (PowerShell), if needed: # $env:NODE_TLS_REJECT_UNAUTHORIZED = "0" node index.js

The MCP server will start and listen on port3000by default. You can configure the port using theMCP_PORTenvironment variable:

MCP requests are expected at the/mcpendpoint (e.g.,http://localhost:3000/mcp).

Security Notice:This server has not been hardened or secured for production use. It is the responsibility of the user to implement appropriate security measures (such as authentication, authorization, network restrictions, and HTTPS) before deploying or exposing this server in any environment.

To use this MCP server with the Claude AI desktop application (or other clients supportingmcp-remote), you need to configure the client to connect to this server. For the Claude Desktop application, this is typically done by editing aclaude_desktop_config.jsonfile. The location of this file varies by operating system but is usually within the Claude application's support or configuration directory.

Add or update themcpServerssection in yourclaude_desktop_config.jsonfile like this:

{ "mcpServers": { "WinCC Unified": { "command": "npx", "args": ["mcp-remote", "http://localhost:3000/mcp"] } } }

- "WinCC Unified": This is a user-defined name for this server connection that will appear in the Claude application. You can change it to something meaningful to you (e.g.,"WinCC_Unified_Plant_A").
- "command": "npx": This tells the client to usenpx(Node Package Execute) to run themcp-remotetool.
- "args": ["mcp-remote", "http://localhost:3000/mcp"]:

- mcp-remote: This is the command-line MCP client. Ensure thatnpxcan find it. You might need to install@modelcontextprotocol/toolsglobally (npm install -g @modelcontextprotocol/tools) or have it available in a project context accessible bynpx.
- http://localhost:3000/mcp: This is the URL where your WinCC Unified MCP server is listening. Adjust the hostname and port if your server runs elsewhere or on a different port.

After saving this configuration, restart your Claude Desktop application. It should now list "WinCC Unified" (or your chosen name) as an available MCP server, allowing you to use its tools.

The server exposes the following tools for interacting with WinCC Unified:

-

login-user: Logs a user in to WinCC Unified using username and password. Stores the session token for subsequent requests. It is optionally, because the MCP server could be started in the way that it is doing automatically a logon with the service account.

browse-objects: Queries tags, elements, types, alarms, logging tags and basically anything that has a configured name, based on the provided filter criteria.

get-tag-values: Queries tag values from WinCC Unified. Based on the provided names list. If directRead is true, values are taken directly from PLC.

get-logged-tag-values: Queries logged tag values from the database.

get-active-alarms: Query active alarms from the provided systems.

get-logged-alarms: Query logged alarms from the storage system.

write-tag-values: Updates tags, based on the provided TagValueInput list.

acknowledge-alarms: Acknowledge one or more alarms. Each alarm identifier must have the name of the configured alarm, and optionally an instanceID. If the instanceID is 0 or not provided, all instances of the given alarm will be acknowledged.

reset-alarms: Reset one or more alarms. Each alarm identifier must have the name of the configured alarm, and optionally an instanceID. If the instanceID is 0 or not provided, all instances of the given alarm will be reset.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Bumblebee Endpoint Receipt is a paid remote MCP endpoint for developer endpoint scanner MCP. It exposes structured JSON tools, a public server card, token-based access, usage receipts, and a

ClawManager Fleet Control is a paid hosted remote MCP for ClawManager. It exposes Streamable HTTP tool calls, bearer-token access, public server-card metadata, usage logs, and receipt-orient

Interact with the Honeybadger API for error monitoring and reporting using LLMs.

AI-powered industrial fault diagnosis MCP server. 313 fault codes across Allen-Bradley, Siemens, ABB, Mitsubishi, Fanuc. 8 diagnostic tools for Claude Code.

A feature-rich gateway and proxy that federates MCP and REST services, unifying discovery, authentication, rate-limiting, and observability into a single endpoint for AI clients.

Crowdsourced MCP server reliability scoring — 615+ servers monitored, 2.17M+ health checks, real-time reliability data

Paid remote MCP for server uptime checks, schema validation, auth failure detection, SLA receipts, and status report exports.

Control Opentrons robots, manage protocols, and search API documentation.

Interact with your OpsLevel account using read-only access.

Full MCP server for the https://portkey.ai AI Gateway Admin API with 151 tools across 18 domains.