Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.efranceschetti/festo-codesys-mcp

NPM · FESTO-CODESYS-MCP · SCANNED AUG 3

MCP server for Festo/CODESYS PLCs: IEC 61131-3 ST + validated PLCopen XML generation.

Available components

+15 this week 61 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (104 of 108), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (104 of 108), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
Schema Quality & AI Usability64
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (poor).Fail
  • Tool/resource definitions use about 6795 tokens (~65/item across 103 items; 18 tools + 85 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 83% of tool parameters carry a description.Partial
  • Structured output schemas are declared (33% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · festo-codesys-mcp

# add to Claude Code
claude mcp add efranceschetti-festo-codesys-mcp -- npx -y festo-codesys-mcp
# add to Codex CLI
codex mcp add efranceschetti-festo-codesys-mcp -- npx -y festo-codesys-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "efranceschetti-festo-codesys-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "festo-codesys-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add efranceschetti-festo-codesys-mcp --command npx --arg -y --arg festo-codesys-mcp
# ~/.hermes/config.yaml
mcp_servers:
  efranceschetti-festo-codesys-mcp:
    command: "npx"
    args: ["-y", "festo-codesys-mcp"]
// mcp.json
{
  "mcpServers": {
    "efranceschetti-festo-codesys-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "festo-codesys-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +4
    • Stability: unverified → 0.27 functional
  • 2 Aug 26 +11
    • Known CVEs: partial → unverified security
    • Malware scan: unverified → pass security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Dependency health: partial → unverified functional
  • 1 Aug 26 +25
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Security disclosure: unverified → fail functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Schema quality: unverified → poor functional
    • Licence: MIT functional
  • 31 Jul 26 −25
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 27 Jul 26 46

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 104 packages

104 packages in the resolved dependency tree · 104 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 18 exposed · ~3,972 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
create_data_type ~144

Generate a CODESYS data type: ENUM (E_*) or STRUCT (ST_*), with .st + PLCopen XML output. USE WHEN: you need an ENUM (state/mode) or STRUCT (config/record) to back FB, GVL, or program declarations. Name auto-corrected to E_ (enum) or ST_ (struct) prefix if missing.

NameTypeReqDescription
kindstringyes
membersarrayyes
namestringyesType name (e.g., E_MachState or MachState, ST_AxisCfg or AxisCfg)
outputDirstringOutput directory (default: cwd)

No output schema declared.

No examples provided.

create_function_block ~246

Generate a CODESYS Function Block (.st + PLCopen XML) with the standard interface built in. USE WHEN: the user asks for a new FB and plc_library returned no reusable match. ALWAYS BEFORE: (1) plc_library action=search — never create what already exists; (2) plc_knowledge topics 'conventions' + 'abbreviations'. Standard pattern: bEnable/bExecute inputs, bDone/bBusy/bErr/nErrId outputs, nState state machine. Name auto-corrected to FB_ prefix. DO NOT: use this for servo motion logic — motion uses MC_*_Festo blocks (topic 'festo-ptp'), not custom FBs.

NameTypeReqDescription
descriptionstringyesWhat this FB does (English)
inOutVarsarray
inputVarsarray
localVarsarray
namestringyesFB name (e.g., FB_ServoAxis or just ServoAxis)
outputDirstringOutput directory (default: cwd)
outputVarsarray
stCodestringyesStructured Text body (the logic)

No output schema declared.

No examples provided.

create_gvl ~142

Generate a Global Variable List (.st + PLCopen XML) with {attribute 'qualified_only'}. USE WHEN: you need globals shared across POUs — I/O map, system flags, HMI tags (GVL_HMI), config. Name auto-corrected to GVL_ prefix if missing. Common: GVL_Sys, GVL_IO, GVL_HMI, GVL_Cfg.

NameTypeReqDescription
isConstantboolean
namestringyesGVL name (e.g., GVL_Sys or just Sys)
outputDirstringOutput directory (default: cwd)
variablesarrayyes

No output schema declared.

No examples provided.

create_program ~155

Generate a CODESYS Program (.st + PLCopen XML) for cyclic control logic. USE WHEN: you need a cyclic PRG (runs once per scan) — PRG_Main, PRG_Auto, sequence orchestration — and no reusable one exists. Programs run once per PLC scan (PRG_Main, PRG_Auto, etc.). Name auto-corrected to PRG_ prefix if missing.

NameTypeReqDescription
descriptionstringyesWhat this program does
localVarsarray
namestringyesProgram name (e.g., PRG_Main or just Main)
outputDirstringOutput directory (default: cwd)
stCodestringyesStructured Text body

No output schema declared.

No examples provided.

create_project_structure ~167

Scaffold a standard CODESYS project directory for Festo CPX-E. USE WHEN: starting a new CODESYS project and you need the standard folder scaffold before creating POUs. Creates: src/0_Types, src/1_Globals, src/2_Programs, src/3_FunctionBlocks, src/4_Functions, src/5_Library, export/xml, docs. Set includeExamples=true to pre-populate with E_MachState, GVL_Sys, and PRG_Main stubs. After scaffolding, create files in order: Types → GVLs → FBs → Programs → generate XML.

NameTypeReqDescription
includeExamplesboolean
projectDirstringyesRoot directory
projectNamestringyesProject name

No output schema declared.

No examples provided.

debug_plc_code ~156

Static analysis for Structured Text bugs — run BEFORE deploying to a real PLC. USE WHEN: ST code is convention-clean and you need runtime-bug analysis, or the user reports misbehavior. Catches: WHILE/REPEAT loops (watchdog risk), missing error handling (bErr/nErrId), CiA 402 safety gaps (MC_Power without MC_Stop), state machine issues (missing IDLE/ERROR), Hungarian notation violations, REAL-INT type mismatches, unused timer outputs. Returns categorized Critical/Warning/Suggestion results.

NameTypeReqDescription
codestringyesThe Structured Text code to analyze
contextstringAdditional context (e.g., "EtherCAT axis", "conveyor control")

No output schema declared.

No examples provided.

explain_error_code ~172

Decode Festo/CODESYS/EtherCAT error codes using ALL embedded references. USE WHEN: any Festo/CODESYS/EtherCAT error code appears — 0x…, 16#…, drive fault, AL status. Never guess meanings. Accepts hex (0x7500), IEC (16#8011), or decimal formats. Searches: CiA 402, Festo PtP, CODESYS ground truth, ALL embedded topics, and all device manuals. If not found locally, search the web — then save useful findings to knowledge/manuals/ for future use.

NameTypeReqDescription
errorCodestringyesThe error code (e.g., "0x7500", "16#8011", "MC error 4357")
sourcestringError source platform
NameTypeReqDescription
errorCodestringyes
foundbooleanyes
manualHitsbooleanyes
messagestringyes
snippetCountnumberyes
sourcestringyes
sourcesMatchedarrayyes

No examples provided.

generate_plcopen_xml ~180

Batch-convert a directory of .st files into a single PLCopen TC6 0200 XML for CODESYS import. USE WHEN: .st sources are final and reviewed, and the user wants a CODESYS-importable file. ALWAYS BEFORE: plc_knowledge topic 'ground-truth' (anti-hallucination XML rules) if you have not loaded it this session. ALWAYS AFTER: validate_plcopen_xml -> validate_plcopen_xsd -> validate_plcopen_semantic. Never hand the XML to the user before the chain passes. DO NOT: hand-write PLCopen XML — always generate it from .st sources with this tool.

NameTypeReqDescription
outputFilestringyesOutput XML file path
projectNamestring
sourceDirstringyesDirectory containing .st files

No output schema declared.

No examples provided.

plc_knowledge ~504

Load embedded PLC reference documentation — the source of truth for Festo/CODESYS/EtherCAT/PLCopen. USE WHEN: before writing ANY Structured Text (load 'conventions' + 'abbreviations' first), before generating XML (load 'ground-truth'), before motion code (load 'festo-ptp' + 'ethercat-cia402'), or whenever a technical fact is needed — never answer from memory. Actions: 'topic' (load by name), 'search' (BM25 full-text across ALL topics + manuals), 'list_manuals', 'read_manual'. Topics (27): conventions, abbreviations, hungarian-notation, state-machines, engineering-discipline, ground-truth, xml-rules, plcopen-schema, plcopen-example, plcopen-extensions, festo-cpx, festo-ptp, festo-cdpx-hmi, festo-vtux-terminal, festo-cmmt-st, festo-mqtt, motion-patterns, ethercat-cia402, eplan, hmi-web-architecture, opcua-websocket-gateway, hmi-embedded-deploy, plc-architecture-patterns, plc-alarm-patterns, codesys-recipe-manager, codesys-gotchas, plc-testing-twin. Covers: Festo CPX/PtP/CMMT/MQTT, CODESYS, EtherCAT CiA 402, PLCopen XML, naming conventions, engineering discipline & quality gates, custom Web HMI + OPC-UA gateway, PLC program architecture + alarm design, recipes, testing without hardware, CODESYS gotchas, 19 device manuals. If information is not found here, you may search the web — but suggest saving useful findings to knowledge/manuals/ for future use.

NameTypeReqDescription
actionstringyes'topic': load reference by name | 'search': full-text across ALL topics + manuals | 'list_manuals': show available manuals | 'read_manual': load complete manual
filenamestringManual filename for action=read_manual (e.g., "festo-cpx-e-system")
querystringSearch term for action=search (e.g., "P-0-4014", "homing method", "CMMT fault")
topicstringTopic name for action=topic. Use "all" to load every topic concatenated.

No output schema declared.

No examples provided.

plc_library ~261

Access the 38-block reusable ST library (30 Function Blocks + 8 shared DUTs) — ALWAYS check here BEFORE creating new FBs. USE WHEN: about to create any FB, or looking for ready-made motor/valve/PID/sensor/safety logic. Actions: 'search' (keyword match), 'list' (browse by category), 'get' (full source code). Categories: types (8), motion (4), actuators (5), sensors (4), safety (2), system (5), utilities (10). Contains ready-to-use blocks for motors, valves, PID, sensors, safety, and more. DO NOT create a new FB if a similar one already exists here.

NameTypeReqDescription
actionstringyes'search': find blocks by keyword | 'list': browse all blocks (optionally by category) | 'get': retrieve full .st source code
categorystringFilter by category for action=list, or category hint for action=get
namestringBlock name for action=get (e.g., "FB_StandardMotor", "E_AxisState")
querystringSearch term for action=search (e.g., "motor", "temperature", "pid")

No output schema declared.

No examples provided.

plc_lookup ~207

Quick lookup for PLC conventions and error codes — instant answers without loading full knowledge topics. USE WHEN: you need a single fact — prefix, state number, error code — without loading a full topic. Try this BEFORE plc_knowledge for point lookups. Actions: 'hungarian' (type→prefix), 'type_prefix' (POU→prefix), 'state' (state number→name), 'error_code' (decode Festo/CiA402/CODESYS error), 'fb_interface' (standard FB pattern), 'list_standard' (full reference).

NameTypeReqDescription
actionstringyes'hungarian': get prefix for a type | 'type_prefix': get prefix for POU type | 'state': decode state number | 'error_code': decode error | 'fb_interface': show standard FB pattern | 'list_standard': f…
valuestringThe value to look up (type name, POU type, state number, or error code)
NameTypeReqDescription
actionstringyes
detailsobjectyes
foundbooleanyes
messagestringyes

No examples provided.

plc_validate ~267

Validate PLC code against conventions — composable validators with consistent results. USE WHEN: you need to check ST against conventions programmatically — naming, FB interface, or state machine — without a full review. Actions: 'naming' (check variable names + Hungarian notation), 'fb_interface' (check FB pattern), 'state_machine' (check nState pattern), 'batch' (validate multiple items at once). Returns {valid, message, details} for each check.

NameTypeReqDescription
actionstringyes'naming': check variable/POU naming | 'fb_interface': check FB bEnable/bDone pattern | 'state_machine': check nState 0/90/99 | 'batch': multiple validations
codestringST code to validate (for fb_interface, state_machine)
itemsstringJSON array of {type, input, extra?} for batch mode
pouNamestringPOU name (for naming action with pouType)
pouTypestringPOU type: functionBlock, program, enum, struct (for naming action)
typeNamestringType name like BOOL, INT, REAL (for naming action)
varNamestringVariable name (for naming action)
NameTypeReqDescription
actionstringyes
detailsobject
failednumberyes
messagestringyes
passednumberyes
resultsarray
validbooleanyes

No examples provided.

review_st_code ~133

Validate ST code against naming conventions — returns ONLY violations, not reference dumps. USE WHEN: immediately after writing or editing any ST code. Checks: Hungarian notation (b=BOOL, n=INT, r=REAL, t=TIME, fb=FB instance), POU prefixes (FB_, PRG_, FC_), FB interface pattern (bEnable/bDone/bBusy/bErr/nErrId), state machine (0=IDLE, 90=DONE, 99=ERROR), snake_case detection. Includes quick-reference table when violations are found.

NameTypeReqDescription
codestringyesThe Structured Text code to review

No output schema declared.

No examples provided.

st_find_references ~200

Find all references (usages) of an ST identifier across a directory of .st files — token-aware and comment/string-safe (unlike grep: ignores comments, strings, typed literals, and substring matches). USE WHEN: you need every usage of an ST identifier across files before renaming or refactoring. Each reference carries file, line/column, the line text, the containing POU, whether it is the declaration site, and disambiguation hints (e.g. resolves E_X.MEMBER member access via the qualifier). Note: sourceDir must be inside the workspace unless FESTO_MCP_ALLOW_OUTSIDE_WORKSPACE=1.

NameTypeReqDescription
caseInsensitivebooleanIEC is case-insensitive (default true)
includeDeclarationbooleanInclude the declaration site (default false)
namestringyesIdentifier to search for (whole token)
sourceDirstringyesDirectory containing .st files (recursive scan)
NameTypeReqDescription
definitionsarrayyes
namestringyes
referenceCountnumberyes
referencesarrayyes
sourceDirstringyes

No examples provided.

st_symbols ~254

Index a directory of .st files and navigate symbols across files — dialect-aware (CODESYS V3.5), comment/string-safe, better than grep. USE WHEN: you need to navigate an existing .st project — outline symbols or resolve a definition across files (better than grep). Actions: 'outline' — project map. Returns top-level symbols (functionBlock/program/function/enum/struct/gvl) by default; pass kindFilter to include vars/members (e.g. ["inputVar","globalVar"]). 'definition' — resolve a name (case-insensitive) to its definition(s); requires 'name'. Notes: sourceDir must be inside the workspace unless FESTO_MCP_ALLOW_OUTSIDE_WORKSPACE=1. Line numbers and find-references arrive in a later version (this version returns file + container).

NameTypeReqDescription
actionstringyes'outline' = project map | 'definition' = resolve a name
kindFilterarrayFilter by SymbolKind (e.g. ["functionBlock","globalVar"])
namestringSymbol name (required for action=definition)
sourceDirstringyesDirectory containing .st files (recursive scan)
NameTypeReqDescription
actionstringyes
fileCountnumberyes
sourceDirstringyes
symbolCountnumberyes
symbolsarrayyes

No examples provided.

validate_plcopen_semantic ~334

Compares variable/initializer counts between source .st files and generated PLCopen XML. USE WHEN: after validate_plcopen_xsd passes, to confirm no variables/initializers were silently dropped vs the .st sources. Detects bugs where the generator silently drops variables or initializers: - VARS_MISSING — ST has more vars than XML (Bugs A/B/F) - INITS_MISSING — ST has more initializers than XML (Bug E) - AT_ADDR_LOST — ST has vars with AT %IX/QX, XML has 0 <address> tags (Bug A) - POU_MISSING_IN_XML — POU declared in .st but absent in XML Use AFTER validate_plcopen_xsd. If XSD passes but semantic fails, the XML is structurally valid but missing content — exactly the silent-failure scenario that caused the 2026-05-22 incident (203 CODESYS errors). Tolerances are configurable; defaults are permissive (-25% vars, -30% inits). Output: { gate, valid, summary, errors[{line, location, code, message}], counts }

NameTypeReqDescription
filePathstringyesPath to PLCopen XML file (e.g. master-final.xml)
initsTolerancenumberXML/ST init ratio threshold (default 0.70)
sourceDirstringyesDirectory containing source .st files (recursive scan)
varsTolerancenumberXML/ST var ratio threshold (default 0.75)

No output schema declared.

No examples provided.

validate_plcopen_xml ~230

Fast smoke check for PLCopen XML — XML well-formedness + 13 structural regex heuristics. USE WHEN: immediately after generate_plcopen_xml, as the fast first gate before the XSD/semantic validators. Use AFTER generate_plcopen_xml as a quick gate before the heavier validators. Checks: XML well-formedness, PLCopen namespace, XHTML namespace, fileHeader, contentHeader, coordinateInfo (fbd/ld/sfc), mandatory instances footer, zero-ID rule on connectionPoints, ST code wrapping in xhtml, inOutVariables on blocks, structural hierarchy. Returns: PASSED/ISSUES counts and VALID/FIX verdict. NOTE: this is a sanity check only. For full validation use: - validate_plcopen_xsd — XSD official PLCopen TC6 v2.00 (catches structural issues) - validate_plcopen_semantic — count vars/inits source ST vs XML (catches Bugs A/B/E/F: missing vars/inits)

NameTypeReqDescription
filePathstringyesPath to PLCopen XML file
NameTypeReqDescription
countsobjectyes
failednumberyes
failedChecksarrayyes
filePathstringyes
passednumberyes
passedChecksarrayyes
validbooleanyes

No examples provided.

validate_plcopen_xsd ~220

Strict schema validation against the official PLCopen TC6 v2.00 XSD (embedded). USE WHEN: after validate_plcopen_xml passes and you need strict schema conformance before import. Catches structural issues that the fast sanity check misses: malformed elements, required attributes missing, type mismatches, etc. Use AFTER generate_plcopen_xml for full structural validation before CODESYS import. Output: { gate, valid, summary, errors[{line, location, code, message}], counts } Codes: FILE_NOT_FOUND, XSD_NOT_FOUND, XSD_PARSE_ERROR, XML_PARSE_ERROR, XSD_VIOLATION. NOTE: requires lxml in the MCP python venv. Pair with validate_plcopen_semantic for end-to-end coverage (XSD catches structure, semantic catches missing vars/inits).

NameTypeReqDescription
filePathstringyesPath to PLCopen XML file
xsdPathstringOptional custom XSD path. Default: bundled tc6_xml_v200_patched.xsd

No output schema declared.

No examples provided.