Winccua MCP Server

Most developer tooling work still happens through a UI a human drives. Winccua MCP server moves it into the conversation instead. A Model Context Protocol (MCP) server designed to interface with SIEMENS WinCC Unified SCADA systems via their GraphQL API. This server exposes various WinCC Unified functionalities as MCP tools, allowing AI assistants and other.

The short version

• Connects to a WinCC Unified GraphQL endpoint
• Provides MCP tools for:
• User authentication (login-user)
• Browsing SCADA objects (browse-objects)
• Reading current tag values (get-tag-values)
• Querying historical/logged tag data (get-logged-tag-values)

Getting it running

The server ships on npm as @modelcontextprotocol/tools, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

What it needs from you

Configuration is passed through the environment: GRAPHQL_URL, GRAPHQL_USR, GRAPHQL_PWD, NODE_TLS_REJECT_UNAUTHORIZED. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

• Node.js (v18.x or later recommended). - npm (which typically comes with Node.js). - Access to a running WinCC Unified GraphQL server endpoint.

How it compares

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. It is maintained by vogler75; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.