Back to Browse

Ignition MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server for Inductive Automation Ignition: tags, alarms, history, and Perspective

About

MCP server for Inductive Automation Ignition: tags, alarms, history, and Perspective

Security Report

4.2
Use Caution4.2High Risk

ignition-mcp is a well-architected MCP server with solid security foundations: authentication is mandatory, write operations are gated behind explicit opt-in, and the bridge plane uses HMAC-SHA256 request signing. However, several code quality and vulnerability concerns reduce confidence. The bridge implementation has a time-skew vulnerability (±300s window), insufficient input validation in some handlers, and the path traversal protection, while present, relies on string operations rather than canonicalization. Additionally, error handling is inconsistent and SQL injection is possible in db_query when mutating is true. These issues are moderate in severity but should be addressed before production use. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

file_delete

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Gateway base URL, e.g. http://localhost:8088Optional

Environment variable: IGNITION_URL

Ignition API key in 'name:secret' formRequired

Environment variable: IGNITION_API_TOKEN

HMAC secret shared with the mcp-bridge WebDev project; enables live tag/alarm/history/Perspective toolsRequired

Environment variable: IGNITION_BRIDGE_SECRET

Set to 'true' to enable mutating tools (each call still requires confirm=true)Optional

Environment variable: IGNITION_ALLOW_WRITES

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-jsgorana-ignition-mcp": {
      "env": {
        "IGNITION_URL": "your-ignition-url-here",
        "IGNITION_API_TOKEN": "your-ignition-api-token-here",
        "IGNITION_ALLOW_WRITES": "your-ignition-allow-writes-here",
        "IGNITION_BRIDGE_SECRET": "your-ignition-bridge-secret-here"
      },
      "args": [
        "ignition-mcp"
      ],
      "command": "uvx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!