TiaCommanderCAUTION
Connects any MCP-compatible AI assistant to Siemens TIA Portal via the Openness API
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
New in this release: a new technology_objects tool — 15 actions for listing and reading technology objects, changing parameters, structural edits, export/import, and connecting an object to its hardware; per-project PLC credentials with a new Credentials tab in the Manager — a project's own password is tried first, a global one is the fallback; transactional block overwrites — the block is exported before the import and restored if the import fails, and overwrites no longer lose attributes, block numbers or folder placement; and compiler results that list only real diagnostics, so totals always match the compiler's own count. Dozens more fixes and improvements since v3.15.2 — see CHANGELOG.md for the full list.
\V17 through V20 are supported for project work. V16 and older are detected and refused with a clear message. Only V19 is fully tested; the others are expected to work as TIA Portal maintains backward-compatible Openness APIs across versions.*
Overview
TiaCommander is an MCP server that connects AI assistants to Siemens TIA Portal via the Openness API. It enables AI-assisted PLC programming, project management, library operations, hardware configuration, cross-reference analysis, and deployment — all through natural language.
Tested AI clients: Claude Desktop, Claude Code, VS Code (Copilot), Cursor, Windsurf, Codex CLI, Gemini CLI.
19 tools, 230 actions covering the full TIA Portal project lifecycle.
6db2c90517bfOBSERVED · 2026-10-09Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
# Changelog
- Improved: download connection failures now include a dump of the live connection configuration and, on connect timeouts, a hint to check the CPU protection level (S7-1200/1500 firmware V4.5+ require
| `delete_credential` | | (host; optional passwordClass, scope) Remove stored credential(s) for a host. scope='project' removes the open project's credential; scope='global' re
Gates applied: no_behavioural_pass.
6db2c90517bffull audit observations/trust-audit/mcp-server/a4webdev__tiacommander.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 6db2c90517bf | CAUTION | B | 89 | first audit |
Questions
What is the TiaCommander MCP server?
Connects any MCP-compatible AI assistant to Siemens TIA Portal via the Openness API
Is TiaCommander safe to connect to an agent?
With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does TiaCommander need?
No credential environment variables were found in its source, so it appears to need none.
How does TiaCommander run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (6db2c90517bf), read on 2026-10-09. The repository is watched and re-audited when it changes.