# OTDeck (mcpb · otdeck-mcp-0.4.0.mcpb)

Read MQTT, Modbus and OPC UA from AI agents; writes only after the user allows each in OTDeck.

- Trust score: 32/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-06

## Components

- mcpb · `otdeck-mcp-0.4.0.mcpb`: 32/100 (this document), [markdown](https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp.md), [page](https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/otdeck/releases/releases/download/v0.4.0/otdeck-mcp-0.4.0.mcpb`
- Transport: `stdio`
- SHA-256: `5bec1b4327ee5604ca42e8f459ecf8adac1bbecec9ed50fe0996681872a0ac13`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-06.

- **Supply Chain Security**: 0/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (SEE LICENSE IN https://otdeck.com/legal/terms) isn't a recognized OSI-approved license.
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2714 tokens (~180/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the OTDeck MCP server?

OTDeck ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, 5bec1b4327ee5604ca42e8f459ecf8adac1bbecec9ed50fe0996681872a0ac13; the commands to do that are on this page. If it does not match, do not open it.

- Download bundle: `https://github.com/otdeck/releases/releases/download/v0.4.0/otdeck-mcp-0.4.0.mcpb`
- SHA-256: `5bec1b4327ee5604ca42e8f459ecf8adac1bbecec9ed50fe0996681872a0ac13`

### Verify on macOS / Linux

```bash
echo "5bec1b4327ee5604ca42e8f459ecf8adac1bbecec9ed50fe0996681872a0ac13  otdeck-mcp-0.4.0.mcpb" | shasum -a 256 -c
```

### Verify on Windows (PowerShell)

```powershell
(Get-FileHash -Algorithm SHA256 .\otdeck-mcp-0.4.0.mcpb).Hash -eq "5bec1b4327ee5604ca42e8f459ecf8adac1bbecec9ed50fe0996681872a0ac13"
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-06 (score 32, +1)

- [functional regression] Schema quality: 2305 → 2714

### 2026-11-05 (score 31, 0)

- [security regression] Stability: 0.00 → unverified

### 2026-11-04 (score 31)

First indexed and scored.

## MCP tools (15)

### `browse` (~124 tokens)

List the children of an OPC UA node (hierarchical references): node id, browse and display name, node class. Start at i=85 (Objects) and descend; variables are what read_nodes reads.

Input parameters:

- `connection` (string, required): OPC UA connection name or id
- `limit` (integer): max children returned (default 200, max 1000)
- `node_id` (string): node to list the children of, e.g. i=85 (Objects, the default), i=84 (Root) or ns=2;s=Plant1.Line1

Output parameters:

- `children` (null|array)
- `connection` (string)
- `node_id` (string)
- `note` (string)
- `role` (string)

### `list_connections` (~86 tokens)

List the connections configured in OTDeck: name, protocol (mqtt, modbus, opcua), role (lab, staging, production), address, agents (read, or write when the user lets agents ask for writes), the tools for it, the Modbus register ranges and the OPC UA watch list set up in the app. Use the name as `connection` in other tools.

### `list_events` (~190 tokens)

Listen to the events of an OPC UA object (default the Server object, every event) for wait_ms and return them newest first, plus the alarms the server still retains (Alarms & Conditions: active, acknowledged, confirmed, severity 1-1000). Read-only: acknowledging alarms is done by a person in the OTDeck app.

Input parameters:

- `connection` (string, required): OPC UA connection name or id, see list_connections
- `limit` (integer): at most this many events, newest first (default 50, at most 200)
- `min_severity` (integer): only events with at least this severity (1-1000)
- `notifier` (string): object whose events to receive (default i=2253, the Server object: every event)
- `wait_ms` (integer): how long to listen for new events (default 2000, at most 10000)

Output parameters:

- `alarms` (null|array)
- `connection` (string)
- `events` (null|array)
- `note` (string)
- `notifier` (string)
- `role` (string)

### `list_recordings` (~44 tokens)

List the recordings saved by the OTDeck app (newest first): id, name, start, length, sample count and per series the source and min/max/mean.

Output parameters:

- `recordings` (null|array)

### `list_topics` (~136 tokens)

List MQTT topics seen on a connection with message counts, rate, retained flag and the last value (truncated). The first call on a connection listens for wait_ms to collect retained and live messages.

Input parameters:

- `connection` (string, required): connection name or id, see list_connections
- `filter` (string): MQTT topic filter, default # (every topic); + matches one level, # the rest
- `limit` (integer): max topics returned (default 500, max 5000)
- `wait_ms` (integer): on a fresh connection, how long to collect messages first (default 1500, max 10000)

Output parameters:

- `note` (string)
- `topics` (null|array)
- `total` (integer)

### `publish_message` (~212 tokens)

Ask the user to publish one MQTT message (QoS 0-2, optionally retained). Every call opens a window in the OTDeck app: the user sees the values now and the new ones with your reason, and allows or denies it (no answer in 60 s is a denial). Works only on connections the user set to Read and write for agents (OTDeck Pro).

Input parameters:

- `connection` (string, required): MQTT connection name or id (it must be set to Read and write for agents)
- `encoding` (string): text (default), hex or base64
- `payload` (string, required): message payload (up to 64 KB)
- `qos` (integer): 0 (default), 1 or 2
- `reason` (string, required): one sentence for the user: why this message is needed; shown in OTDeck before they allow it
- `retain` (boolean): keep the message on the broker for new subscribers
- `topic` (string, required): topic name, without + or #

Output parameters:

- `connection` (string)
- `result` (string)
- `written` (null|array)

### `read_history` (~219 tokens)

Read the raw history an OPC UA server keeps for a node (HistoryRead): values with time, number and status, plus min/max/mean, for a time range (default the last hour). The node's AccessLevel must include history read; OTDeck pages through the server's continuation points and releases what it does not read.

Input parameters:

- `connection` (string, required): OPC UA connection name or id, see list_connections
- `from` (string): start, RFC 3339 (default: seconds before to)
- `max_values` (integer): at most this many values (default 500; at most 5000, 1000 on production connections)
- `node_id` (string, required): node id of a variable whose AccessLevel includes history read, e.g. ns=2;s=Plant1.Line1.Press.Temperature
- `seconds` (integer): length of the range ending at to when from is not given (default 3600)
- `to` (string): end, RFC 3339 (default: now)

Output parameters:

- `connection` (string)
- `count` (integer)
- `from` (string)
- `max` (null|number)
- `mean` (null|number)
- `min` (null|number)
- `more` (boolean)
- `node_id` (string)
- `note` (string)
- `role` (string)
- `to` (string)
- `values` (null|array)

### `read_nodes` (~99 tokens)

Read the current Value of OPC UA nodes: value (strings and arrays truncated), number when numeric, data type, status (Good/Uncertain/Bad with its meaning) and timestamps.

Input parameters:

- `connection` (string, required): OPC UA connection name or id
- `node_ids` (null|array, required): node ids to read the Value of, e.g. ns=2;s=Plant1.Line1.Press.Temperature (find them with browse)

Output parameters:

- `connection` (string)
- `role` (string)
- `values` (null|array)

### `read_recording` (~147 tokens)

Read a recording: its summary and, per series, statistics and thinned points (≤500, minima and maxima kept) for an optional time range. Reads the file only; no device is contacted.

Input parameters:

- `from` (string): RFC 3339 start time (default: the beginning)
- `id` (string, required): the recording id from list_recordings
- `points` (integer): points per series, up to 500 (default 100); min and max of each interval are kept
- `series` (null|array): labels of the series to return (default: all)
- `to` (string): RFC 3339 end time (default: the end)

Output parameters:

- `complete` (boolean)
- `ended` (string)
- `id` (string)
- `name` (string)
- `note` (string)
- `samples` (integer)
- `seconds` (number)
- `series` (null|array)
- `started` (string)

### `read_registers` (~391 tokens)

Read Modbus coils, discrete inputs, holding or input registers and decode them (int16/uint16/int32/uint32/int64/uint64/float32/float64/string/hex/bool) with byte and word order. Addresses are 0-based protocol addresses. Use `range` to read a range configured in the app; such a range may carry a scale (value and number are then scaled, raw_value is the register value), a unit and a description from the register map. A device exception is returned in plain words in `error` (with the code in `exception`), not as a failed call.

Input parameters:

- `address` (integer): 0-based protocol address of the first register (register 40001 in 1-based notation is holding address 0)
- `byte_order` (string): big (AB, default) or little (BA): byte order inside each register
- `connection` (string, required): Modbus connection name or id, see list_connections
- `count` (integer): number of values to read (default 1); a float32 takes 2 registers, a float64 4
- `length` (integer): for type string: registers per string (2 characters each)
- `range` (string): label or id of a register range configured in the app (list_connections shows them); replaces table/address/count/type
- `table` (string): coils, discrete (discrete inputs), holding (default) or input (input registers)
- `type` (string): bool, int16, uint16 (default), int32, uint32, int64, uint64, float32, float64, string or hex; coils and discrete inputs are always bool
- `word_order` (string): high (default, ABCD) or low (CDAB): which register holds the high word of 32/64-bit values

Output parameters:

- `at` (string)
- `connection` (string)
- `error` (string)
- `exception` (integer)
- `note` (string)
- `range` (object)
- `role` (string)
- `values` (null|array)

### `read_topic` (~110 tokens)

Read the latest value of an MQTT topic (or of every topic matching a filter, up to 100). Waits up to wait_ms when no value is known yet; retained values arrive at once.

Input parameters:

- `connection` (string, required): connection name or id
- `topic` (string, required): topic name, or a filter with + and # for several topics
- `wait_ms` (integer): how long to wait for a value when none is known yet (default 3000, max 30000)

Output parameters:

- `note` (string)
- `values` (null|array)

### `sample_messages` (~132 tokens)

Listen to an MQTT topic filter and return the messages that arrive (up to limit, for at most wait_ms). Payloads are decoded as JSON or text (binary as hex) and truncated to a few KB.

Input parameters:

- `connection` (string, required): connection name or id
- `filter` (string, required): MQTT topic filter, e.g. factory/line1/# or +/+/temperature
- `limit` (integer): max messages (default 20, max 200)
- `wait_ms` (integer): how long to listen (default 5000, max 30000); returns early when limit is reached

Output parameters:

- `messages` (null|array)
- `note` (string)

### `trend_snapshot` (~133 tokens)

Recent values of the series on the OTDeck app's trend panel (what the engineer is watching): per series the source, min/max/mean and thinned points over the last `seconds` (≤300). Needs the app running with values on its trend panel.

Input parameters:

- `points` (integer): points per series, up to 300 (default 60); min and max of each interval are kept
- `seconds` (integer): how far back, up to 300 (default 60)
- `series` (null|array): labels or ids of the series to return (default: all on the panel)

Output parameters:

- `note` (string)
- `series` (null|array)
- `writtenAt` (string)

### `write_nodes` (~161 tokens)

Ask the user to write the Value of OPC UA nodes; OTDeck converts the text to each node's data type. Every call opens a window in the OTDeck app: the user sees the values now and the new ones with your reason, and allows or denies it (no answer in 60 s is a denial). Works only on connections the user set to Read and write for agents (OTDeck Pro).

Input parameters:

- `connection` (string, required): OPC UA connection name or id (it must be set to Read and write for agents)
- `reason` (string, required): one sentence for the user: why this write is needed; shown in OTDeck before they allow it
- `writes` (null|array, required): nodes and their new values (up to 25)

Output parameters:

- `connection` (string)
- `result` (string)
- `written` (null|array)

### `write_registers` (~371 tokens)

Ask the user to write Modbus holding registers (functions 06/16) or coils (05/15) at consecutive 0-based addresses, encoded like read_registers decodes them. Every call opens a window in the OTDeck app: the user sees the values now and the new ones with your reason, and allows or denies it (no answer in 60 s is a denial). Works only on connections the user set to Read and write for agents (OTDeck Pro).

Input parameters:

- `address` (integer, required): 0-based protocol address of the first register or coil
- `byte_order` (string): big (default) or little
- `connection` (string, required): Modbus connection name or id, see list_connections (it must be set to Read and write for agents)
- `reason` (string, required): one sentence for the user: why this write is needed; shown in OTDeck before they allow it
- `scale` (number): multiplier of a scaled register (the scale read_registers reports for the range, e.g. 0.1): values are then engineering values and the register gets value / scale, which must be a whole number for in…
- `table` (string): holding (default) or coils; input registers and discrete inputs cannot be written
- `type` (string): holding registers: int16, uint16 (default), int32, uint32, int64, uint64, float32, float64; a 32-bit value takes 2 registers
- `values` (null|array, required): values to write to consecutive addresses (up to 100), as text: numbers for registers, true/false or 1/0 for coils
- `word_order` (string): high (default) or low

Output parameters:

- `connection` (string)
- `result` (string)
- `written` (null|array)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp#diagnostics

## Score history

- 2026-11-06: 32
- 2026-11-05: 31
- 2026-11-04: 31

## Common questions

### What is the OTDeck MCP server?

OTDeck is an MCP server listed in the public MCP registry as com.otdeck/otdeck-mcp. Read MQTT, Modbus and OPC UA from AI agents; writes only after the user allows each in OTDeck. This page covers its MCPB bundle (https://github.com/otdeck/releases/releases/download/v0.4.0/otdeck-mcp-0.4.0.mcpb).

### Is the OTDeck MCP server safe to use?

OTDeck scores 32 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the OTDeck MCP server expose?

OTDeck exposes 15 tools: browse, list_connections, list_events, list_recordings, list_topics, and 10 more. Their descriptions and schemas cost roughly 2,555 tokens of context every time the server is loaded.

### What did VerifyMCP test on the OTDeck MCP server?

VerifyMCP ran 12 checks on OTDeck, covering Source repository, Provenance, License, Maintenance and 8 more. 4 items could not be completed, a gap on our side rather than a finding about OTDeck: Malware scan, Known CVEs, Install scripts and Dependency health. One category scores 0 for that reason, because we only credit what we can confirm. Endpoint Security and Transport & Reachability do not apply to an MCPB bundle, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Website: https://otdeck.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-otdeck-otdeck-mcp/otdeck-mcp