WinCC Unified

This MCP server connects Siemens WinCC Unified SCADA systems to MCP-compatible clients, exposing WinCC Unified functionality as a set of MCP tools. You can authenticate, browse objects, read and write tag values, access historical data and alarms, and manage alarm states through a consistent, extensible interface.

How to use

You interact with the WinCC Unified MCP server through an MCP client. First, connect the client to the server using the http endpoint or by starting a local MCP process if you are using the stdio workflow. Once connected, you can perform operations such as logging in, listing SCADA objects, reading current tag values, querying historical data, retrieving active and logged alarms, writing values to tags, and acknowledging or resetting alarms. Use the client’s tools to issue the corresponding MCP requests against the server and rely on the server to translate those requests into WinCC Unified GraphQL calls.

How to install

Prerequisites you need before installation: Node.js v18.x or later and npm. You also need access to a running WinCC Unified GraphQL server.

Steps to install and start the server on your machine:

1. Clone or download the project folder that contains the MCP server code.

2. Open a terminal in the project directory.

3. Install dependencies

npm install

4. Set required environment variables for configuration (see the Configuration section for details).

5. Start the server using the standard runtime command

node index.js

Additional setup notes

The server listens by default on port 3000. You can override this with the MCP_PORT environment variable, for example: MCP_PORT=8080 node index.js.

Configuration

Configure the server with environment variables grouped as shown below. Adjust these values to match your WinCC Unified environment.

GRAPHQL_URL: The full URL of your WinCC Unified GraphQL server (required). Example: https://your-wincc-server.example.com/graphql

GRAPHQL_USR: Optional service account username. If provided with GRAPHQL_PWD, the server will attempt automatic login on startup and refresh the session periodically. The token is stored globally for use by tools when a user login has not occurred.

GRAPHQL_PWD: Optional password for the service account.

NODE_TLS_REJECT_UNAUTHORIZED: Set to 0 to disable TLS certificate validation (development only). This may be necessary if using HTTPS with a self-signed certificate.

Connecting with a Claude Desktop Client

To use this MCP server with Claude or other MCP clients, configure the client to connect to the server’s MCP endpoint. Create or update an MCP server entry that points to the server’s /mcp endpoint.

Security and notes

This server is not hardened for production use. You should implement proper authentication, authorization, network restrictions, and HTTPS before exposing it in a live environment.

Tools exposed by the server

The server exposes a collection of MCP tools that map to WinCC Unified capabilities. The tools include: login-user, browse-objects, get-tag-values, get-logged-tag-values, get-active-alarms, get-logged-alarms, write-tag-values, acknowledge-alarms, and reset-alarms. Each tool corresponds to a specific interaction with the WinCC Unified GraphQL API, enabling you to perform authentication, object browsing, data reads, historical data queries, alarm retrieval, and alarm management.

Available tools

login-user

Logs a user into WinCC Unified using provided credentials and stores the session token for subsequent requests.

browse-objects

Queries tags, elements, types, alarms, and other named objects based on filter criteria.

get-tag-values

Reads current values of specified tags, with option for direct PLC reads when directRead is true.

get-logged-tag-values

Queries historical values from the logging database for specified tags.

get-active-alarms

Fetches currently active alarms from the connected systems.

get-logged-alarms

Fetches historically logged alarms from storage.

write-tag-values

Writes new values to specified tags using a TagValueInput list.

acknowledge-alarms

Acknowledges one or more alarms by name and optional instanceID. If instanceID is 0 or omitted, all instances are acknowledged.

reset-alarms

Resets one or more alarms by name and optional instanceID. If instanceID is 0 or omitted, all instances are reset.