Read-only TCP connectivity probe for likely S7/OPC UA/Web API endpoints. Does not authenticate or read PLC data.

Analyze a saved exact HMI observation and existing PLC export without TIA. Link trigger/acknowledgement tags and optional reset tags to exact PLC tag or DB definitions, writers, clear candidates, guards and screen references. Explicit connection-to-software-path bindings prevent cross-PLC guesses. Optional official alarm XLSX supplements classic HMI evidence; its HMI ownership is caller-selected, not verified. Does not execute scripts or inspect runtime.

Apply an explicitly approved exact HMI import plan once. Backs up the original object, rechecks baseline under exclusive access, imports, compiles and reads back. No download. Failure can leave unsaved engineering changes; never replay a token.

Create a new isolated classic WinCC project only after explicit approval of the exact immutable plan. Does not attach to an existing project or download. Compiles, saves and independently reopens the generated project. Partial failed output is retained. Two headless TIA sessions; can take several minutes (TIA_MCP_HMI_WRITE_TIMEOUT_MS, default 15 min).

Consume one import plan token and import its blocks into the exact running TIA process with the version-selected importer: back up every target, override-import (data blocks first), compile, re-export and compare every block, roll back on any failure, and optionally save. blocks must repeat the planned blocks in the planned order. Never downloads to a PLC.

Apply one explicitly approved immutable Unified property plan, recheck baseline under exclusive access, keep scoped recovery values, compile the hosting device and verify in a fresh helper session. No object reconstruction, download or automatic rollback.

Apply an explicitly approved Unified project creation plan once in an isolated TIA process. Create native objects, compile the created device, save and independently reopen for requested-value verification. No download; partial failed output is retained. Two headless TIA sessions; can take several minutes (TIA_MCP_HMI_WRITE_TIMEOUT_MS, default 15 min).

Build or refresh a persistent project-neutral symbol definition, read/write reference, and data-flow cache from an existing Simatic ML export. It writes only under the export's _codex_index folder and never changes the TIA project or PLC.

Read-only exact plan for replacement of one existing classic V20 screen/template. Captures live baseline, full exact diff, compile/save scope and immutable one-time approval token. Rejects renamed objects and changed external references.

Offline immutable plan to create a NEW isolated classic WinCC V20 project and device, import generated screen/template candidates, compile, save and reopen for verification. Requires an exact Siemens catalog type identifier. Does not access TIA or overwrite an existing directory.

Read-only validation for importing 1 to 20 candidate Simatic ML blocks as one change (for example a DB member plus the FC networks that use it). Binds one short-lived confirmation token to the exact live TIA process and project, every candidate XML digest and target identity, each target's current content digest, the importer and API identity, and the save choice. Several blocks also return each candidate as compact text for review; tia_apply_import then imports them in one session, data blocks first, with one software compile, and rolls all of them back on any failure.

Read-only exact plan for existing Unified control geometry, ARGB colors, text in one existing language and font size. Rejects dynamically bound properties and stale identities. Compile covers the entire hosting device; save is optional and covers the entire project.

Create an immutable offline plan for a NEW isolated Unified V20 project. Exact catalog ID, destination, startup screen, objects and scripts are included. No existing project is opened or overwritten.

Read-only capability diagnosis shared with the CLI: installed files, policy gates and stale native binaries. By default it attaches to nothing and starts nothing. Optional sections: projectPath or portalVersion adds environment (project path and version-adapter validation); liveCore=true starts the resident read-only core when absent and adds its version, uptime and attached session; onlineReport=true adds the online-monitoring boundary report.

Create an offline native XML candidate using exact UTF-16 ranges and expected text. Preserves every unedited range, including unknown vendor XML. Does not import, compile or establish dependency compatibility.

Replace the text of one uniquely named classic HMI object in one existing language. Supports Text, TextOn or TextOff. Preserves other languages, events, bindings and unknown XML; replaces formatting only inside the selected text value.

Export classic V20 screens, templates, tag tables, VB scripts, text/graphic lists, project graphics and connections as native XML in one read-only attachment, with hashes and external-reference inventory. Alarms, recipes and library types are excluded; dependency closure is incomplete.

Reuse one canonical JSON observation per exact project and HMI, or read alarms, tags, connections, screens and scripts through public Openness APIs. Set refresh only after a project change. Does not execute scripts, modify the project, export PLC blocks, or produce an importable WinCC backup. Partial reads never replace a usable observation.

Read-only classic WinCC V20 native screen/template XML export using the official API. Discover exact targets first, then list object paths with an empty objectPath. Requires exact PID, process start and project. Dependencies are not included; this is not a complete HMI backup.

Create one exact-session snapshot of every PLC block, PLC type/UDT, and complete tag table with the official TIA Openness export APIs, then build the existing offline index and execution model. Hardware/network/HMI objects are outside this program-source snapshot. It never modifies, saves, compiles, or downloads the project.

One-call lookup across block inventory, call edges, persistent symbol definitions, read/write references, data flows and saved engineering notes for an indexed S7-1200/S7-1500 export. query is one string, or up to 50 strings (block aliases, symbols, addresses) resolved together in a single cached call.

Generate classic V20 native screen/template candidates with text, rectangles, buttons, navigation, momentary tag commands and IO fields. No visual template required. Dependencies must be provided when planning a project. Native serialization requires later TIA validation.

Generate an offline WinCC Unified V20 public-API creation program with screens, reusable layouts, internal/external tags, explicit connections, discrete alarms, native controls, navigation and event script bodies. This JSON is not a native import archive. No TIA access or network probing.

Details of the block currently selected/open in TIA Portal. source=live (default) reads it from the exact running V20 project: official attributes, cross references and, from one temporary block export, interface and program body; nothing is persisted. source=export resolves it through an exactly matching existing export instead: offline metadata, call relations, interface members and existing non-stale reference results; never creates or refreshes an export.

Perform one bounded passive observation of the selected TIA Portal version (V20 by default; other supported versions explicitly selectable), exact project and visible editor evidence. Does not attach, click, focus, poll, capture the screen or access a PLC.

Read one exact live GRAPH block and return a step's exits or a transition's predecessor/successor steps, actions, interlocks and Boolean guards. Sequence numbers disambiguate reused step numbers. No UI navigation, project write, scheduler simulation or PLC runtime monitoring.

Report separate HMI software/version adapters and implemented authoring boundaries. Availability is not live verification.

Read a bounded hardware/network/HMI/PLC-tag observation from an already prepared exact V20 session and report evidence-backed configuration diagnostics. Includes exposed HMI tags, connections and Unified alarms; classic HMI alarms are explicitly unsupported when not exposed. Never compiles, exports files, changes a project or contacts a PLC.

Read-only Unified V20 inspection. Empty targetPath lists targets; empty screenPath lists screens including groups; empty objectName lists screen items. A selected primitive returns a scoped property baseline and scripts, not a complete native import archive.

List compact export summaries under bounded roots. By default each project scope returns its valid current snapshot, or its latest indexed snapshot with the current-pointer failure reason; historyCount counts all snapshot directories. includeHistory shows all snapshots. Child directories starting with '_' are tool test directories: skipped by default and always excluded from automatic matching; the search root itself is exempt. _codex_index is always skipped. omitted counts collapsed history snapshots, skipped test directories, project-filtered entries, and matching entries beyond maxResults; project filters run before maxResults. Explicit listing never makes an invalid or historical snapshot eligible for automatic matching.

List exact HMI software names, hardware paths and API types in a prepared project without reading PLC programs or exporting configuration.

Explicit UI navigation action. Resolves one object in the exact current PID/project and invokes only the official ShowInEditor API for PlcBlock, PlcType, or PlcTagTable. Exact network/line navigation is never claimed from ReferenceLocation metadata.

Prepare one exact resident read-only Openness session without enumerating project objects. A cold session first returns an explicit Portal-authorization check; call again only after the user has Portal visible and is ready to approve the Siemens access prompt.

Generate self-contained offline HTML to preview a design, screen navigation, local IO values and press/release buttons. Never connects to equipment. This is not TIA runtime simulation or a verified native rendering.

Resolve blocks, PLC data types/UDTs, tag tables or PLC tags in the exact running TIA V20 project through the resident session (attached automatically when Portal is visible). One object: give resourceKind and name; returns direct official attributes, optional CrossReferenceService evidence and, for a block, interface and program body from one temporary XML. Several objects: give queries (up to 50) for a shallower result per object in one call; cross references default off there.

Read one exported block, DB, UDT or tag table. Give exportDir with name/number/relativePath; view=text also accepts xmlPath for a single Simatic ML file such as an import candidate. Views: text (default) is compact text, the interface then one line per coil, assignment, instruction box or block call in each network (LAD/FBD), or the SCL source, with every instruction box shown including GET/PUT/MOVE; xml is the raw exported XML, only needed to prepare an import; interface is the flattened interface/member table; context is the metadata, direct callers, direct callees and same-number companion objects.

Read compact summary metadata from an existing _codex_index/tia-export-index.json. Coverage includes issueCount; includeCoverageIssues explicitly returns the full summary.analysis.coverage.issues array. includeProfile adds the detected PLC family (S7-1200, S7-1500 or unknown) from project evidence.

Read an existing official WinCC alarm XLSX export, including classic HMI alarms unavailable through Openness. Preserves multilingual text, trigger and acknowledgement columns with worksheet/row evidence. Does not launch Excel, evaluate formulas, attach to TIA or import anything. Workbook project identity is not independently verifiable.

Verify all current snapshot XML against the manifest, rebuild the execution model offline and publish its analysis under the current-pointer lock.

Persist an evidence-backed engineering explanation under the export cache so a stronger model can analyze once and later models can reuse it. The note is bound to the current export signature and marked stale after program changes.

Search persisted model-authored engineering notes and report whether each note still matches the current export signature.

Search one export index; bounded and read-only. in=text (default): plain-text search across the indexed XML files. in=inventory: block/type/tag names and call edges. in=symbols: symbol table from block interfaces, DB members and PLC tag tables, filtered by scope and query. in=references: call edges, symbol/tag definitions and XML text matches for the query together, filtered by kind.

Search prepared live inventory by partial name/group path or exact block kind/number. Returns exact identities for subsequent reads. No whole-project XML export, program-body scan, navigation or PLC access. Pagination requires an unchanged project inventory.

Walk downstream, upstream or both directions through indexed call edges from one block. Without name/number/relativePath it lists the OB entry blocks and their direct calls instead.

Recursively trace where a value comes from or where it is used, using evidence-backed SCL assignments, GRAPH actions, and LAD/FBD network flows from a cached S7-1200/S7-1500 export.

Find symbol definitions, writers, readers, and direct upstream/downstream flows across SCL, LAD/FBD calls, and GRAPH actions. The cache is rebuilt automatically when the export signature changes.

Offline scoped edit of one uniquely named native screen object. Change existing geometry or RGB color properties while preserving all other native XML, bindings and extensions verbatim.