Industrial MCP server security starts where the vendor's defaults stop
Industrial MCP server security does not come with the vendor's server. Of five vendor OT servers checked on 19 September 2026, the OPC Foundation's exposes Write, Call and DeleteNodes in its default profile, and Litmus gates destructive calls with an argument the model fills in. Pexon's rule: run such servers read-only, in the level 3.5 DMZ, one identity per agent.
The position
A vendor's MCP server describes what the vendor thinks an agent could do. Safe on a plant is a property of the deployment: an allowlist, a zone and an identity, and no repository ships those for your site.
Five vendor servers, read on 19 September 2026
What the vendor's own documentation says each server can do
| Vendor server | What "the vendor's server is safe" assumes | What the repository or documentation actually says |
|---|---|---|
| OPC Foundation Opc.Ua.Mcp (UA-.NETStandard) | The reference stack ships conservative defaults | The default profile is full, which exposes Write, HistoryUpdate, AddNodes, DeleteNodes, Call and certificate trust tools. The smallest profile, core, still contains WriteValue and CallMethod. There is no read-only profile. |
| Siemens WinCC OA (winccoa-ae-js-mcpserver) | Official means production-ready as shipped | Read-only monitoring by default, which is the right start. One environment variable, TOOLS, adds dp_set, alarm_delete or manager_control, and the README warns the server can modify configuration and runtime data. |
| Litmus Edge (litmus-mcp-server) | An approval step protects state changes | 62 tools, including container deployment and tag deletion. Destructive SDK calls require a user_approved argument that the assistant may only set after you approve. The server receives that argument from the model. |
| AWS IoT SiteWise (awslabs/mcp) | Cloud means no plant risk | Read-only unless SITEWISE_MCP_ALLOW_WRITES is set to True. The good case here: the remaining question is how narrow the IAM role behind it is. |
| Ignition MCP Module (early access) | The module ships safe tools | It ships no tools at all; each project defines its own. Ignition's API keys, per the 8.3 documentation, grant full access to the Gateway's HTTP API routes, including configuration, tags and projects. |
Two of five default to read-only. None of the five knows your Purdue levels, your OPC UA user roles or which person is asking, because none of them can.
Why the vendor server is the wrong unit of trust
A vendor MCP server is built for the vendor's broadest customer. That customer includes the system integrator commissioning a new line, who genuinely needs to create datapoints, trust certificates and restart managers. Shipping those tools is not negligence. It is the product doing its job for someone other than an agent on a running plant.
The consequence for a plant is that safety sits one configuration line away. In WinCC OA the line is TOOLS, in SiteWise it is SITEWISE_MCP_ALLOW_WRITES, and in the OPC Foundation server it is the profile flag, where the default is the widest option. A disabled tool is still compiled into the process that holds the credentials. We treat that as different from a tool that was never registered, because the second one cannot be switched on by the next person who edits the environment file.
The model is not a control.
Litmus shows the pattern most clearly. Its approval gate is written as an instruction the assistant is expected to follow, and the server itself receives a boolean. Whatever the model reads, including a tag description or an alarm text someone typed years ago, is input to the component that decides whether that boolean is true. A control that the controlled party can satisfy is a convention, and conventions are not what IEC 62443 zone owners sign.
This tool can modify your WinCC OA system configuration and runtime data. Changes made through this MCP server directly affect your SCADA system and connected industrial processes.
The deployment answer
What a read-only deployment pins down, as one file
An illustrative policy for an OPC UA server behind MCP, not a product file format. Every line is a decision someone at the plant has to sign, and the values are examples to be sized per site.
# industrial-mcp-policy.yaml (illustrative)
# Principle: the allowlist is the product. A tool not listed is not registered.
server: opcua-dmz-aggregator # aggregating server at level 3.5, never a PLC-embedded server
upstream:
endpoint: opc.tcp://ua-agg.dmz.plant.example:4840
security_policy: Basic256Sha256 # signed and encrypted channel
user_token: x509 # an OPC UA user whose role can only read
tools:
register: [Browse, TranslateBrowsePaths, Read, HistoryRead]
# Write, Call, HistoryUpdate, AddNodes, DeleteNodes, TrustCertificate: never registered
identity:
one_identity_per_agent: true # the maintenance agent is not the quality agent
on_behalf_of: end_user # the person's token is exchanged at the boundary
limits:
history_read_max_values: 10000 # example cap; forces aggregates over raw exports
calls_per_minute_per_agent: 60 # example budget
audit:
log: every_call # tool, arguments, identity, result size, durationIf the server process could be restarted with a wider profile by editing one line, the policy lives in the wrong place. The register list belongs in code that is reviewed, not in an environment variable.
Where IEC 62443 and NIS2 come in
IEC 62443-3-2 is the part of the series that assesses a system as zones and the conduits between them. An MCP server that connects an agent in the office network to anything below the DMZ is a conduit, and it belongs in that assessment with an owner, a direction and a list of what may pass. Placing the server at level 3.5 against a historian or an aggregating OPC UA server keeps the new conduit where the existing IT/OT boundary already is, instead of opening a second one.
NIS2 does not mention MCP. Article 21(2) of Directive (EU) 2022/2555 lists the measures in-scope entities must take, and two of them read directly on a vendor server: supply chain security, point (d), and access control policies, point (i). Energy is an Annex I sector and several manufacturing subsectors sit in Annex II. A vendor MCP server with write tools one variable away is a supplier component whose access you have to be able to explain.
When the vendor server is enough, and when it is not
The consensus holds
- Test system: A WinCC OA or SiteWise pilot on a non-production instance, left at its read-only default, is a reasonable first week.
- Cloud copy: SiteWise reads data that already left the plant; the review is about an IAM role, not a conduit.
- Engineering use: An integrator configuring a dev gateway with the vendor's full tool set is the use the tools were built for.
The consensus fails
- Default is wide: The OPC Foundation server starts with every tool class, including Write and DeleteNodes.
- Gate is the model: An approval flag the assistant sets is not a control a zone owner can rely on.
- No identity: One API key or service account for every user means the audit log names the server, not the person.
- Direct to level 2: Any server pointed at a PLC-embedded OPC UA endpoint crosses a zone the plant already drew.
What this costs us to say
We sell the work of restricting these servers, so we have a reason to find them unsafe, and the counter-argument is real: WinCC OA and SiteWise default to read-only, and a restriction layer is one more component someone has to keep alive through the vendor's next release. Where the vendor default already matches the plant's zone model, use it unchanged. Which systems ship a server at all, and which do not, is mapped on MCP servers for industrial systems.
Where this leads
- Claude MCP server development for internal systems — the engagement that builds the restricted server, with the tool list agreed first
- MCP servers for industrial systems: 52 systems mapped — which ERP, PLM, MES and OT vendors ship a server, dated
- MCP server for enterprise systems: build, secure, operate — the IT-side controls: registry, sandboxing, per-call authorisation
What OT security asks before the first agent gets a tool
Is a vendor MCP server safer than a community one?
Mostly yes, on maintenance and code quality, and not on scope. A vendor server is patched, follows the product's API changes and is written by people who know the system. It is also written for the vendor's widest customer, including the integrator who needs configuration tools, so its tool catalogue is broader than an agent on a production plant should see. Use the vendor's server as the base and restrict what it registers.
Can an AI agent write to a PLC or SCADA system through MCP?
Technically yes, and we do not build it. Several servers checked on 19 September 2026 can write datapoints, OPC UA node values or tags once the right tool is enabled. Our position is that nothing an agent does reaches a controller: OT data is read from a historian or an aggregating server in the DMZ, and any write happens in a system of record, one named operation at a time, with a person's identity attached.
Do NIS2 or IEC 62443 say anything about MCP?
Neither names MCP, but both cover what an MCP server touches. NIS2, Directive (EU) 2022/2555, requires in Article 21(2) measures including supply chain security (point d) and access control policies (point i) from in-scope energy and manufacturing entities. IEC 62443-3-2 assesses a system as zones and conduits, and an MCP server that reaches into a control zone is a new conduit that belongs in that assessment.
What does a read-only deployment of an industrial MCP server cost?
The two-week Readiness Blueprint is fixed at €4,900: one system, the agreed read-only tool list, the zone placement and a test of whether the person's identity carries through to the source. A first production deployment is usually a use-case pilot from €15,000. All prices are net and exclude VAT.
What can a read-only MCP deployment not protect against?
It cannot make a wrong answer right. Read access still exposes process data, which is often the most sensitive intellectual property a plant has, so scoping who may read what remains necessary. A read-only server can still load a historian with large queries unless budgets are enforced. And an operator who acts on a wrong summary causes the same damage a write would have; that is a procedure question, not a server setting.
Next step
Get the tool list and the zone placement agreed before anything connects
Two weeks, fixed price: one OT system, a read-only tool list signed by the people who own the plant, the placement in your zone model, and a test of whether the person's identity reaches the source.