MCP for industrial automation: what exists in 2026, and how to use it safely
The Model Context Protocol has become the standard way to connect AI models to tools. In 2026 it reached the plant floor. Here is the landscape and the rules we apply.
MCP servers for industrial automation now exist from several vendors: Inductive Automation's Ignition MCP Module (announced September 2025, in early access since February 2026), the OPC Foundation's .NET MCP server for OPC UA, the CODESYS Development System MCP Server, Beckhoff's TwinCAT CoAgent built on MCP, HighByte Intelligence Hub, Litmus and Cognite, plus open-source servers for OPC UA, Modbus, MQTT and InfluxDB. In OT, use them read-only by default, outside the control network, with defined tools, logging and a person approving any change, as the December 2025 CISA/NSA guidance on AI in OT advises.
What MCP is, in one paragraph
Anthropic introduced the Model Context Protocol on 25 November 2024 as an open standard for connecting AI assistants to data and tools. OpenAI, Google and Microsoft adopted it in 2025, and in December 2025 Anthropic donated it to the Agentic AI Foundation under the Linux Foundation. An MCP server exposes a list of tools (for example "read tag history" or "compile project"); an AI client such as Claude or ChatGPT can call them.
MCP servers for OT and automation
| Server | From | What it exposes | Status |
|---|---|---|---|
| Ignition MCP Module | Inductive Automation | Tools, resources and prompts you define on an Ignition gateway | Announced 17 Sep 2025; early access since Feb 2026 on Ignition 8.3 nightly builds, without vendor support during early access |
| OPC UA MCP server (OPCFoundation.NetStandard.Opc.Ua.Mcp) | OPC Foundation | OPC UA services as tools | Published as a .NET package, updated Oct 2026 |
| Development System MCP Server | CODESYS | Read projects, write Structured Text, compile | v1.0 Apr 2026, v1.1 Jul 2026 |
| TwinCAT CoAgent | Beckhoff | Multi-agent engineering in TwinCAT, built on MCP | Announced; release on request |
| Intelligence Hub industrial MCP server | HighByte | Modelled industrial data | Since version 4.2 (Jul 2025) |
| Litmus MCP server | Litmus | Litmus Edge data and devices | Open source (May 2025) |
| Industrial MCP | Cognite | Cognite Data Fusion knowledge graph, with the user's permissions | Documented by Cognite |
| Open-source servers | Community | OPC UA (kukapay/opcua-mcp), Modbus, MQTT, InfluxDB 3, a community Ignition REST API server | Use with care: some expose write and even PLC stop commands |
| SIM Solutions AI toolkit | SIM Solutions | WinCC V7 projects, TIA Portal V16 to V20, S7-PLCSIM Advanced, Ignition gateways | Used in our projects; see the AI toolkit |
Rockwell (FactoryTalk Conductor, announced October 2026) and Schneider Electric (agentic manufacturing, April 2026) have announced agent platforms; their announcements do not mention MCP. The OPC Foundation plans to make its 430+ companion specifications ready for retrieval and MCP use.
The risks, named
- Prompt injection and tool poisoning: hidden instructions in data or tool descriptions can make an agent misuse tools. The MCP specification treats tool descriptions as untrusted.
- Excessive agency: listed by OWASP as a top risk for LLM applications; OWASP's 2026 list for agentic applications adds tool misuse, privilege abuse and cascading failures.
- Vulnerable components: for example CVE-2025-6514 in mcp-remote (CVSS 9.6), fixed in version 0.1.16.
- Write access to controllers: some open-source servers include stop and restart commands for PLCs. Never expose those on a production network.
Our rules for MCP in OT
- Read-only by default. Tools that write exist only on development systems and simulators.
- Outside the control network. Data is pushed out of OT; no persistent inbound access, as the CISA/NSA guidance advises.
- Few, specific tools. "Read alarm history of line 2" rather than "run any query".
- Log every call. Who asked what, which data was read, what was changed.
- Human in the loop. A person approves any change; safety decisions are never made by an AI.
See also how to connect AI to PLC and SCADA data and Secure AI in OT.
Questions we get
Does Ignition support MCP?
Yes. Inductive Automation announced an MCP Module in September 2025, and it has been in early access since February 2026. You define the tools, resources and prompts it exposes.
Is there an MCP server for OPC UA?
Yes. The OPC Foundation publishes a .NET MCP server that exposes OPC UA services as tools, and there are open-source OPC UA MCP servers.
Is there an MCP server for Siemens TIA Portal?
Siemens has made no statement on MCP. Independent open-source TIA Portal MCP servers exist, and we use our own connectors for TIA Portal V16 to V20.
Can an AI agent control my plant through MCP?
Technically it could, which is why we do not allow it on production systems. Keep MCP read-only in OT and let people approve changes.
Sources
- Anthropic: Introducing the Model Context Protocol (25 Nov 2024)
- Anthropic: Donating MCP and establishing the Agentic AI Foundation (9 Dec 2025)
- Inductive Automation: MCP Module announced at ICC 2025 (17 Sep 2025)
- Inductive Automation forum: MCP Module early access (13 Feb 2026)
- NuGet: OPCFoundation.NetStandard.Opc.Ua.Mcp (Oct 2026)
- Automation.com: OPC Foundation advances OPC UA for the AI era (20 Apr 2026)
- CODESYS: AI-supported engineering
- Beckhoff: TwinCAT projects with AI-supported engineering
- Automation.com: HighByte industrial MCP server (1 Jul 2025)
- Litmus: Litmus MCP server (29 May 2025)
- Cognite: Industrial MCP
- Rockwell Automation: FactoryTalk Conductor (21 Oct 2026)
- MCP specification: security best practices
- OWASP: Top 10 for LLM applications
- OWASP: Top 10 for agentic applications 2026 (Dec 2025)
- Invariant Labs: MCP tool poisoning (1 Apr 2025)
- JFrog: CVE-2025-6514 in mcp-remote (9 Jul 2025)
- Cyber.gov.au: Principles for the secure integration of AI in OT (3 Dec 2025)
A new line, an upgrade, or AI for your plant?
Tell us about your project and we will set up a technical call.
2800 Mechelen, Belgium E-mail: info@simsolutions.be Enterprise no. / VAT: BE 0680.932.773