Deploy an OPC-UA to MQTT bridge tool (e.g., EMQX Neuron, Unified Automation UaGateway, or a custom stack using an open-source OPC-UA client library like open62541 or node-opcua) on an edge gateway with network access to the OPC-UA server
Connect to the OPC-UA server endpoint (e.g., opc.tcp://<plc-ip>:4840) using the appropriate security mode and authentication (anonymous, username/password, or X.509 certificate); browse the server's address space to identify the NodeIds of the variables to monitor
Configure monitored items or subscriptions on the OPC-UA server for the target NodeIds with a sampling interval matching the process update rate; the server pushes data changes to the gateway client via Publish responses
Map each OPC-UA NodeId to an MQTT topic (e.g., site/<plant>/<machine>/<variable>) and serialize the value, timestamp, and status code into a JSON payload; publish to the MQTT broker on data change or at a maximum publication interval
Implement a store-and-forward buffer on the gateway: queue messages in local storage (e.g., SQLite) when the MQTT broker is unreachable and flush the queue in order when connectivity is restored to prevent data loss during network outages
Apply payload normalization: OPC-UA data types (Int16, Float, DateTime, StatusCode) must be explicitly cast to JSON-compatible types; include the OPC-UA quality/status code alongside the value so consumers can filter bad-quality readings
Known gotchas
OPC-UA subscription notifications use a server-assigned PublishingInterval; if the gateway requests a 100ms interval but the server minimum is 500ms it silently revises the interval upward — always read back the revised interval after creating the subscription
OPC-UA SecurityMode None is convenient for testing but transmits all data including credentials in plaintext; production deployments must use SignAndEncrypt with server certificate validation to prevent man-in-the-middle attacks on the OT network
Some PLC OPC-UA servers have a limit on the number of simultaneous sessions or monitored items per session; exceeding this limit causes new subscription requests to be rejected with BadTooManySubscriptions or BadTooManyMonitoredItems status codes
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp