otgate — OT policy gateway MCP Server

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add otgate-opcua -- uvx otgate

{
  "mcpServers": {
    "otgate-opcua": {
      "command": "uvx",
      "args": [
        "otgate"
      ]
    }
  }
}

[mcp_servers.otgate-opcua]
command = "uvx"
args = ["otgate"]

{
  "mcpServers": {
    "otgate-opcua": {
      "command": "uvx",
      "args": [
        "otgate"
      ]
    }
  }
}

{
  "servers": {
    "otgate-opcua": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "otgate"
      ]
    }
  }
}

Optional settings from the registry entry, left out of the block above: OTGATE_BACKEND (Backend to gate: 'fake' for the bundled in-memory reactor simulator, 'asyncua' for a real OPC UA server. Start with 'fake' — it needs no plant and no extra dependency), OTGATE_POLICY (Path to the policy YAML. Any tag not listed in it is denied by default), OTGATE_AUDIT (Path to the append-only JSONL audit log. Every call, allowed or not, produces exactly one line), OTGATE_SHADOW (Set to 1 to run in shadow mode: allowed writes are recorded as 'WOULD execute' and never reach the backend. Use this to watch an agent for a while before letting it touch anything), OTGATE_RATE_HISTORY (Path to a JSONL file that keeps the rate-of-change time base across restarts. Without it a restart loses the time base, and rate limits fall back to a one-interval allowance), OTGATE_OPCUA_ENDPOINT (OPC UA endpoint, e.g. opc.tcp://localhost:4840. Required when OTGATE_BACKEND=asyncua).