MCP for Manufacturing: Plant Data, Industrial Servers and Keeping AI Away From Controls

MCP lets an AI assistant answer questions about machines, lines and plants by querying historians, IoT platforms and industrial data hubs in plain English. As of November 2026, HighByte ships MCP in its Intelligence Hub, AWS publishes an open-source IoT SiteWise MCP server, and Inductive Automation has announced MCP support inside a new AI framework for Ignition. The safe pattern is the same everywhere: read plant data first, and keep AI away from anything that moves equipment.

MCP (Model Context Protocol) is an open standard for connecting AI apps to other software through MCP servers. New to it? Start with What Is MCP?.

This guide covers what MCP can do in manufacturing, which industrial servers are documented, what government OT security guidance says and a starter stack. Facts were checked on 2 November 2026. It is not engineering or safety advice: your controls engineers, OT security lead and safety team decide what connects to plant systems.

What MCP can do in manufacturing

The best early uses sit on top of data you already collect:

• Downtime questions. "Which machines on line 3 had the most unplanned stops last week, and what were the top reasons?"
• Shift summaries. Pull production counts, scrap and alarms for a shift report draft.
• Maintenance prep. Combine sensor trends with work order history to brief a technician before a job.
• Quality look-ups. Find which lots ran on a given machine during a drift in a measured value.
• Engineering help. Let an engineer explore asset models and tag structures without writing queries.

These are reporting and investigation jobs. The plant keeps running on its existing control systems.

Which industrial MCP servers exist

HighByte Intelligence Hub

HighByte's Industrial MCP Services page describes "exposing pipelines in the Intelligence Hub as 'tools' that the agent can call." You define each tool's description and parameters. The page says this "gives you direct control over what data AI agents can access." It lists sources you can expose, including an "OPC server, PI System historian, Ignition platform," plus devices, SCADA, MES, historians, ERP and LIMS.

The same page says configuration tools can "create and edit connections, models, instances, and pipelines with external agents." That is a write capability over your data infrastructure. Keep it off for general users.

AWS IoT SiteWise

AWS Labs publishes an open-source AWS IoT SiteWise MCP server. It covers assets and asset models, time-series data, gateways, anomaly detection and bulk metadata transfer. The recommended install is uvx awslabs.aws-iot-sitewise-mcp-server@latest, and it needs Python 3.10 or later and AWS credentials with SiteWise access.

The docs show two client setups: one labeled "Read-Only Mode" and one labeled "Write Operations Enabled," which sets SITEWISE_MCP_ALLOW_WRITES to True. Tool names include create_anomaly_detection_model, list_time_series and delete_time_series. Start with the read-only setup and AWS credentials scoped to read actions. For the wider AWS picture, see our AWS MCP server profile.

Inductive Automation Ignition

Inductive Automation's ICC 2026 recap, dated 30 September 2026, says the company is "rather than releasing a standalone Model Context Protocol (MCP) module" introducing Ignition Catalyst. The Catalyst Agent Module is described as "a user-defined framework for teams to build, run, and embed AI agents," with bidirectional MCP support. The recap says Ignition 2027 releases in February and Ignition 8.3 stays the long-term support release through 2030. It does not give a Catalyst release date.

If you run Ignition, plan around Catalyst rather than a community MCP server.

Data platforms

Many manufacturers send plant data to a cloud warehouse. Our profiles of the Databricks MCP server and the Snowflake MCP server cover querying that data. Reading a warehouse copy keeps the AI one step removed from the plant network.

What we could not confirm

We did not find MCP documentation from the large PLC and automation vendors that we could open and verify on 2 November 2026. Community servers that speak industrial protocols such as Modbus or OPC UA exist. Do not connect one to a production network without your OT security team's review.

OT security guidance

CISA, Australia's ACSC and other partners released joint guidance on securely integrating AI in OT on 3 December 2025. Its four principles:

1. "Understand AI": "Educate personnel on AI risks, impacts, and secure development lifecycles."
2. "Assess AI Use in OT": "Evaluate business cases, manage OT data security risks, and address immediate and long-term integration challenges."
3. "Establish AI Governance": "Implement governance frameworks, test AI models continuously, and ensure regulatory compliance."
4. "Embed Safety and Security": "Maintain oversight, ensure transparency, and integrate AI into incident response plans."

How that maps to MCP:

• Network placement. Run MCP servers that read plant data outside the control network where you can, for example against a historian replica or a data hub.
• Read-only by default. Enable write tools only for specific, reviewed jobs, and never for control actions.
• Incident plans. Add MCP servers to your incident response plan, including how to cut a server off quickly.
• Supply chain. Install only servers from the system's vendor or a source your team has reviewed. Read MCP Supply Chain Risks.

Export controls and customer contracts may also limit where technical data can go. Ask your trade compliance lead before an AI service processes controlled drawings or specs.

Example prompts

• "Which assets on line 3 had the most unplanned downtime last week? Group the stops by reason code."
• "Plot spindle temperature for machine 12 over the last 48 hours and mark any readings above the alarm limit."
• "List the last five work orders for this pump and summarize the repairs."
• "Which lots ran on press 4 between 2 a.m. and 6 a.m. yesterday?"

Each is a question about data already in a historian, data hub or maintenance system. None sends a command anywhere.

Questions for your OT security team

1. Where will the MCP server run, and which network zone can it reach?
2. Which tools are exposed, and are any of them writes?
3. Which credentials does it use, and are they scoped to read actions?
4. How is it patched, and who owns it?
5. Is it in our incident response plan?

A starter stack

Use our tool permission planner to mark each tool allow, ask or block.

What to keep human

• Setpoints, recipes and any command to equipment.
• Safety interlocks and lockout decisions.
• Quality dispositions and lot releases.
• Maintenance sign-off.
• Changes to data pipelines and asset models.
• Anything a regulator or customer audits.

The MCP specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations," per the 2026-07-28 tools specification. In a plant, the simplest way to honor that is not to expose control actions at all.

Next step

Our MCP readiness audit maps your plant data sources, network zones and risks before you connect an AI. If you need a custom read-only server over a historian or MES database, see MCP development. For broader governance, read MCP for IT Leaders.

Frequently asked questions