Skip to main content
Glama

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
OPCUA_PROFILENoAccess profile deciding what the agent may do: observe (default, read-only), operator (plus allowlisted writes and method calls, and alarm actions with OPCUA_ALLOW_ACKNOWLEDGE_ALARMS), or full (every tool).
OPCUA_PASSWORDNoPassword for OPC UA username/password user authentication, supplied through the client's secret storage or environment. Must be provided together with OPCUA_USERNAME.
OPCUA_USERNAMENoUsername for OPC UA username/password user authentication. Must be provided together with OPCUA_PASSWORD.
OPCUA_USER_KEYNoPath to the private key for the X.509 user certificate (for example /etc/opcua/user_key.pem). Used together with OPCUA_USER_CERT.
OPCUA_USER_CERTNoPath to the X.509 user certificate for user authentication (for example /etc/opcua/user.pem). Used instead of OPCUA_USERNAME/OPCUA_PASSWORD, together with OPCUA_USER_KEY, and requires a security policy other than None.
OPCUA_AUDIT_FILENoPath to an append-only audit log recording every control call.
OPCUA_CLIENT_KEYNoPath to this client's private key file for the secured channel (for example /etc/opcua/client_key.pem).
OPCUA_SERVER_URLNoEndpoint URL of the OPC UA server, including any path (for example opc.tcp://192.168.0.10:4840 or opc.tcp://localhost:4840/freeopcua/server/). Defaults to opc.tcp://localhost:4840.opc.tcp://localhost:4840
OPCUA_CLIENT_CERTNoPath to this client's certificate file, used as the client identity when securing the channel (for example /etc/opcua/client.pem).
OPCUA_SERVER_CERTNoPath to the server certificate to pin the server you meant to reach (for example /etc/opcua/server.pem). Alternative to OPCUA_SERVER_TRUST_STORE.
OPCUA_ALLOWED_METHODSNoAllowlist of methods the operator profile may call.
OPCUA_SECURITY_POLICYNoSecurity policy for the OPC UA channel, for example Basic256Sha256 (which implies SignAndEncrypt). The default connection is unencrypted (None).
OPCUA_SERVER_TRUST_STORENoPath to a CA trust store used with OPCUA_SERVER_APPLICATION_URI to verify the server certificate; alternative to pinning with OPCUA_SERVER_CERT.
OPCUA_ALLOWED_WRITE_NODESNoAllowlist of node ids the operator profile may write to.
OPCUA_SERVER_APPLICATION_URINoServer application URI used together with OPCUA_SERVER_TRUST_STORE for CA trust-store verification.
OPCUA_ALLOW_ACKNOWLEDGE_ALARMSNoEnables the alarm-action tools (acknowledge_alarm, act_on_alarm) under the operator profile.

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{}
resources
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
read_opcua_nodesA

Read the current value of one or more OPC UA nodes in a single request. Pass every node you need in one call: the OPC UA server answers them together, so reading fifty nodes costs one round trip rather than fifty. Each node comes back as its own record with the value, its data type, the OPC UA status code, and the source and server timestamps — the quality and the age are what decide whether a value can be acted on, and a bare number carries neither. A node the server rejects is one 'Bad…' status among the results, not a failure of the call.

browse_opcua_nodesA

Explore the OPC UA address space: list a node's children, walk a subtree, resolve a human-readable browse path to a node ID, or search for nodes by name. With the defaults it lists the immediate children of node_id. Raise depth to walk further down, set node_class to 'Variable' to find only readable tags, and include_values to read each one as it is found. browse_path addresses a node by name instead of by ID ('/Objects/Reactor/Temperature'), which is how to start when you do not know the numeric IDs; with depth 0 it simply resolves that path and returns the node it names. name_filter keeps only nodes whose browse name contains the text. Every node also reports its type_definition — what it is, as against what class it belongs to: 'AnalogItemType' for a tag that publishes a unit and a range, a subtype of 'AlarmConditionType' for something act_on_alarm applies to, 'FolderType' for structure. Every traversal is bounded by max_nodes and says in truncated whether it stopped early, so a short list is never mistaken for a complete one.

read_opcua_historyA

Read what a node's value has been over time. Without aggregate_function this returns the raw stored readings, with ReturnBounds=false: no preceding/following boundary values or BadBoundNotFound placeholders. With it, the server computes one summary value per processing_interval over the range instead — 'Average' for a trend, 'Maximum'/'Minimum' for excursions, 'Count' for how often something was recorded — which is how to ask about a week of data without transferring a week of data. Needs a server that keeps history (AccessHistoryDataCapability) or offers aggregates, and aggregate_function needs the aggregates; a call the connected server cannot serve is refused with capability_not_supported and a suggestion, before anything is sent. get_server_status reports which of the two the server offers, and its aggregate function names. Aggregate reads follow native continuation points within the same call, preserving the original interval anchor; they return the completed range or an explicit error within the 5000-value bound. The structured result's completeness says whether the range held more than came back and how to continue; never infer that from the number of records.

read_event_historyA

Read events the OPC UA server stored, for a time range that has already passed. subscribe_events only sees what arrives after you subscribe, so it cannot answer 'what happened overnight' or 'what fired in the ten minutes before the line stopped' — the events are gone by the time anyone asks. This reads them back out of the server's own event archive instead. Same records as read_events and the same fields, so an alarm looks identical whether it was watched live or recovered afterwards. Needs a server that reports AccessHistoryEventsCapability — storing values and storing events are separate features and many servers do one without the other — and against one that does not, a call is refused with capability_not_supported and what to use instead. Point node_id at the notifier that emits the events — the Server object by default, which is where events are collected on most servers. The structured result's completeness says whether the range held more events than came back.

get_server_statusA

Report whether this MCP server is connected to the OPC UA server and what that server says about itself: its endpoint and connection security, its ServerStatus (state, current time, start time, build info) and its NamespaceArray as index -> URI. The one tool that answers while the connection is down — it reports 'connected': false and why, rather than failing — so it is both the health check and the first thing to call when another tool cannot reach the server. The namespace array is also how to tell which 'ns=' index belongs to which namespace URI on this server. 'diagnostics' is the server's own ServerDiagnosticsSummary when it publishes one — session and subscription counts, and how many sessions and requests it has rejected — which is what separates 'the server is slow' from 'the server is refusing us'. OPC UA leaves diagnostics optional, so null there means this server does not say, not zero. 'capabilities' says which optional features — value history, event history, aggregates and their names — the server was found to offer, on which session and when: the answer to why read_opcua_history or read_event_history was refused.

list_subscriptionsA

List the active OPC UA data-change subscriptions, each with the value changes buffered for it since it was created. This is how to collect what subscribe_opcua_nodes has been watching; the same document is also readable as the 'opcua://subscriptions' resource.

list_active_alarmsA

List the alarm and condition instances the server is currently retaining — those that are active, unacknowledged, or both. Asks the server for them directly (the ConditionRefresh method), so the answer is the current state of the plant rather than whatever this MCP server happened to be listening for. Use this to answer 'what is wrong right now'; use read_events to see what has happened since you last looked.

subscribe_opcua_nodesA

Watch one or more OPC UA nodes for value changes instead of polling them. The OPC UA server pushes each new value into a buffer this MCP server keeps; collect them with list_subscriptions or the 'opcua://subscriptions' resource. This is the right way to answer 'tell me when this changes' or 'what has this been doing' over a short window — repeatedly calling read_opcua_nodes both misses changes between calls and costs a round trip each time. Each node gets its own subscription record and its own ID; cancel them with unsubscribe_opcua_nodes. Subscriptions are re-established automatically if the connection drops.

unsubscribe_opcua_nodesA

Cancel one or more active data-change subscriptions and discard what they had buffered. Returns the subscriptions as they were at the moment they were cancelled, so anything still buffered can be read one last time. An ID that is not active is an error naming it, and no subscription is cancelled.

subscribe_eventsA

Start buffering OPC UA events (alarms, condition changes, plain events) from a notifier node. Returns at once; the events themselves are collected in the background and read with read_events. Calling it again for the same node replaces the subscription and discards what it had buffered. Use this to watch for things happening; use list_active_alarms for what is wrong right now.

read_eventsA

Read the events buffered by subscribe_events, oldest first. The events returned are removed from the buffer, so a second call returns only what has arrived since. If the buffer overflowed in the meantime, the result says how many were dropped rather than quietly skipping them — in the structured result's completeness, which also says whether more are still buffered.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription
opcua_subscriptionsActive OPC UA data-change subscriptions and the values buffered for each. Re-read after `subscribe_opcua_node` to see what has changed.

TDQS

A4.3/5.0

Scored across 11 tools

Disambiguation4/5

Most tools target clearly different operations: browsing vs current reads vs history vs live data-change subscriptions vs live events vs alarm listing. The closest pairs are read_events/read_event_history and subscribe_events/subscribe_opcua_nodes, whose names are similar but whose descriptions clearly separate live buffering from archived retrieval and event streams from data-change streams. Slight ambiguity remains from those parallel names, but the descriptions prevent likely misselection.

Naming Consistency4/5

All names follow a snake_case verb_noun pattern, which is readable and predictable. The main inconsistency is the optional 'opcua' qualifier: read_opcua_nodes, browse_opcua_nodes, read_opcua_history, subscribe_opcua_nodes, and unsubscribe_opcua_nodes use it, while read_event_history, subscribe_events, read_events, list_subscriptions, and list_active_alarms do not. This is a minor deviation rather than a chaotic naming scheme.

Tool Count5/5

At 11 tools, the set is well within a reasonable range for an OPC UA monitoring and browsing server. Each tool covers a distinct capability: status, browse, current read, historical read, data-change subscription lifecycle, event subscription/read, event history, active alarms, and subscription listing. No tool appears redundant or purely filler.

Completeness3/5

The read/monitoring surface is fairly complete: browse, current values, historical values, live data changes, event buffering, event history, alarms, and server capability discovery are all present. However, core OPC UA write operations such as writing node values or calling methods are absent, and alarm acknowledgement is not exposed even though alarm listing is. There is also a reference to an 'act_on_alarm' tool in the browse description that is not present in the tool set, indicating a notable surface gap.

Maintenance

ActivityActive
ResponsivenessSlow