otgate — OT policy gateway
alikup-ai/otgate
Gates an LLM agent's writes to an OPC UA server on ranges, rate of change and live interlocks.
- tools
- 7
- transport
- STDIO
- env vars
- 6
- last updated
- Nov 7, 2026
Tools
7 toolsPublic tool metadata for what this MCP can expose to an agent.
read_tag
No parameter schema in public metadata yet.
write_tag
No parameter schema in public metadata yet.
browse
No parameter schema in public metadata yet.
get_audit_log
No parameter schema in public metadata yet.
list_pending
No parameter schema in public metadata yet.
approve
No parameter schema in public metadata yet.
deny
No parameter schema in public metadata yet.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageConfiguration
OTGATE_BACKENDdefault: fakeBackend to gate: 'fake' for the bundled in-memory reactor simulator, 'asyncua' for a real OPC UA server. Start with 'fake' — it needs no plant and no extra dependency.
OTGATE_POLICYdefault: examples/reactor_policy.yamlPath to the policy YAML. Any tag not listed in it is denied by default.
OTGATE_AUDITdefault: audit.jsonlPath to the append-only JSONL audit log. Every call, allowed or not, produces exactly one line.
OTGATE_SHADOWSet to 1 to run in shadow mode: allowed writes are recorded as 'WOULD execute' and never reach the backend. Use this to watch an agent for a while before letting it touch anything.
OTGATE_RATE_HISTORYPath to a JSONL file that keeps the rate-of-change time base across restarts. Without it a restart loses the time base, and rate limits fall back to a one-interval allowance.
OTGATE_OPCUA_ENDPOINTOPC UA endpoint, e.g. opc.tcp://localhost:4840. Required when OTGATE_BACKEND=asyncua.
Readme
otgate
An OT-aware authorization gateway that sits between an LLM agent and an industrial OPC UA server, applying a process-aware access policy — value ranges, rate limits, interlocks — to every call the agent makes.
Details
- Repository
- github.com/alikup-ai/otgate
- Website
- github.com/alikup-ai/otgate
- Category
- AI & LLM Tools
- Package
otgate- Transport
- STDIO
- Registry
- MCP registry, active
