UA-.NETStandard MCP server

What you actually use it for

• Driving a client programmatically over a documented tool interface instead of writing a bespoke client for every diagnostic task.
• Decoding a capture of an encrypted channel, by dumping session keys and decoding the pcap with them, which plain Wireshark cannot do.
• Summarising which service calls a client actually made during a fault window, rather than inferring it from application logs.
• Exporting a live server's address space to NodeSet2 so you can work offline against a large or slow machine.
• Exercising PKI management and configuration operations repeatably as part of a commissioning script.
• Letting an assistant browse and read a server under supervision while you keep the credentials and scope under your control.

Walkthrough

1. Install the tool or run the containerIt is distributed as an installable .NET tool and as a container image. Choose based on where the OPC UA endpoint is reachable from, since the tool needs a network path to the server like any other client.
2. Choose the narrowest profile that does the jobThe server publishes several tool profiles, from a full set down to core, services, administration, pubsub and diagnostics subsets. Start with the smallest profile that covers your task; a full profile hands out PKI and configuration operations you probably did not intend to expose.
3. Connect with a read-only identity firstConfigure a user identity whose Part 18 role cannot write or call methods. Anything driving this interface can write and call if permitted, and an automated caller does not hesitate before an unsafe write.
4. Browse and read before anything elseUse the view and attribute tools to establish the address space and the namespace mapping. Record namespace URIs, not indexes, in whatever configuration comes out of the session.
5. Capture and decode an encrypted session when you need the payloadStart a capture, dump the keys and decode the capture with them, then summarise the service calls. This is the practical modern way to see inside a signed and encrypted channel, and it is why this tool matters for troubleshooting.
6. Export the nodeset and move offlineFor a large address space, export it once and analyse the file, rather than repeatedly browsing a production server that has better things to do.
7. Treat every capture and key dump as sensitiveDumped session keys and decoded captures contain everything the channel was protecting. Store them like credentials, and delete them when the investigation closes.

What it will not do

• Client-side only: it does not make your server conformant or diagnose the server's internals.
• Key dumping and capture decoding deliberately defeat channel confidentiality, so both the capability and its output need governance before use on a production network.
• Requires a .NET runtime or a container platform on a host with a route to the endpoint.
• Tool names, profiles and behaviour are tied to the reference stack's release train and will move.
• An agent driving it can perform writes and method calls if the identity permits, so access control is not optional.

Alternatives

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.