Marc Schier
be50f02700
# Description Expose existing stack APIs through **337 additional domain MCP tools**: 114 industrial-companion tools, 35 WoT/xRegistry/document tools, and 188 higher-level stack-workflow tools. The fully enabled catalogue contains **492 tools**; profile selection is not an execution grant. The packages now follow the reviewed structure: **`Opc.Ua.Mcp.Workflows`** contains roles/users, files, alarms and history; **`Opc.Ua.Mcp.WotCon`** contains management/documents and independently registered live WoT execution. GDS and schema tools remain separate packages. The executable composes **18 libraries**. | Workflow | Added domain tools | Profiles | | --- | ---: | --- | | GDS directory, certificates, reference-only credentials/tokens and Part 21 onboarding | 46 | `gds`, `certificates`, `credentials`, `onboarding` | | Roles/users, regular and temporary files, alarms/conditions and historical access | 74 | `roles`, `users`, `files`, `alarms`, `history` | | Bounded runtime types, XSD/BSD/UA JSON, PubSub and REST OpenAPI artifacts | 6 | `schemas` | | Named PubSub transports, remote configuration, declarative adapters/bridges and SKS | 52 | `pubsub-runtime`, `pubsub-configuration`, `pubsub-bridge`, `pubsub-security` | | Live HTTP(S), MQTT, Modbus TCP and OPC UA WoT forms | 10 | `wot-runtime` | - Reuse typed clients, generated proxies, SDK transports, schema providers and injected services rather than introducing another session manager or protocol engine. - Require host enablement plus exact caller/session/secret/network grants. Protected generic Call/Write/node-management/history/file paths enforce the same policy. - Bind classifications, dispatches, file handles and historical cursors to actual UA generations. Recovery cannot retarget an old handle or authorized mutation. Preserve acknowledged results after late cancellation; do not imply atomicity or retry business commands. - Use opaque secret-store references, explicit writable-store registration, issuer/resource/caller binding and reserved capacity before issuance. Report remote success/local persistence failure as partial completion; redact provider-controlled diagnostic text. - Bound new named runtimes to eight per host, two per caller, five-minute idle expiry and a thirty-minute absolute lease by default. Pending/closing resources consume quota; failed cleanup remains visible. Credential invalidation and session recovery close dependent runtimes. - Keep document planning separate from execution, artifacts root-confined and real JSON inputs typed. Preserve old profile ordinals while widening the set to 64 bits. CI grades fully enabled privileged catalogues rather than connection-only views. **Limitations:** live Kafka remains explicitly unavailable because the backend cannot enforce policy on broker-discovered connections; configuration/schema/capability inspection stays available. The latest public Dekaf v1.23.5 was also checked and its DNS injection remains internal. No private-API workaround or bootstrap-only security claim was added. Full legacy Core registration retains its documented JSON-reflection limitation: native tests isolate its four connection descriptors and validate the expanded production registrations, not whole-host NativeAOT support. ## Related Issues - Fixes #4730. ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [x] I have addressed **all** PR feedback received.
2.5 KiB
OPCFoundation.NetStandard.Opc.Ua.Mcp.PubSub.Diagnostics
OPC UA Model Context Protocol (MCP) tools for PubSub protocol diagnostics,
packaged so they can be embedded in any MCP server host rather than only run as
the shipped opcua-mcp tool.
Use this package when an application wants to let an LLM capture and inspect PubSub network traffic alongside tools of its own.
Tools
PubSub packet capture to pcapng, and decode of captured PubSub traffic including key-log handling.
Security
The decode tool loads PubSub key material. It is disabled by default and is
registered only when a host opts in, using the same
Pcap:EnableDiagnosticsTools / OPCUA_PCAP_ENABLE_DIAGNOSTICS gate as
OPCFoundation.NetStandard.Opc.Ua.Mcp.Diagnostics.
pubsub_decode_pcap, pubsub_dissect_capture, pubsub_load_keylog and
pubsub_write_pcap confine caller paths to the capture root. Root precedence is
OpcUaMcpOptions.PcapBaseFolder, then PcapOptions.BaseFolder, then the
platform's per-user diagnostics directory. No caller argument can read or write
outside it. Key-log output contains live symmetric keys; protect it as secret
material and remove it when no longer needed.
See the capture/dissection tool catalogue for what each tool does.
Usage
builder.Services.AddOpcUaMcpCore();
builder.Services.AddOpcUaMcpDiagnostics(); // shared capture services
builder.Services.AddOpcUaMcpPubSubDiagnostics();
builder.Services.AddMcpServer()
.WithStdioServerTransport()
.WithOpcUaMcpFilters()
.WithOpcUaCoreTools(McpToolProfile.PubSub)
.WithOpcUaPubSubDiagnosticsTools(McpToolProfile.PubSub, diagnosticsEnabled)
.WithTools<MyApplicationTools>();
A profile that selects neither PubSub nor diagnostics contributes no tools rather than failing, so the same profile value can be passed to every OPC UA tool package a host references.
Related packages
| Package | Adds |
|---|---|
OPCFoundation.NetStandard.Opc.Ua.Mcp.Core |
Part 4 service tools, session management, filters (required) |
OPCFoundation.NetStandard.Opc.Ua.Mcp.Diagnostics |
UA-TCP packet capture, decode and replay (supplies the shared capture services) |
OPCFoundation.NetStandard.Opc.Ua.Mcp.PubSub |
PubSub runtime, actions and discovery |
OPCFoundation.NetStandard.Opc.Ua.Mcp |
the ready-to-run opcua-mcp server composing all of the above |
License
OPC Foundation MIT License 1.00 — http://opcfoundation.org/License/MIT/1.00/