What is Model Context Protocol (MCP) in Manufacturing?

How Model Context Protocol can expose governed industrial data tools to AI clients while preserving identity, authorization, audit, and control-system boundaries.

priority_high

Evidence, Scope, and Limits

Evidence level: Medium (field observations + public standards; not a universal benchmark).
Measurement scope: Performance and economic outcomes vary by hardware, topology, workload shape, sampling profile, and process constraints.
Primary references: IEC 62443-2-1, ISA-95 / IEC 62264, NIST SP 800-82r3.
Implementation docs: Edge Architecture and Unified Namespace.

The AI Dilemma in Manufacturing

The industrial sector is caught in a paradox. On one side, executives and engineers are eager to leverage Large Language Models (LLMs) like ChatGPT, Claude, and Gemini to analyze production bottlenecks, triage maintenance alerts, and generate shift handover reports. On the other side, OT (Operational Technology) and Cyber Security teams share a collective operational burden: What if a hallucinating AI accidentally writes a command to a PLC and stops the entire production line?

In manufacturing, AI cannot be given unfettered access to control systems. The risks of unexpected setpoint changes, safety interlock overrides, or high-impact downtime are simply too great.

This is where the Model Context Protocol (MCP) enters the picture, bridging the gap between cutting-edge AI assistants and secure, mission-critical industrial networks.

Scoped AI access follows approved tool contracts

Separated AI data path and machine control path

Outcomes depend on workload profile, hardware capacity, and deployment topology.

What is Model Context Protocol (MCP)?

The Model Context Protocol (MCP) is an open protocol for connecting AI applications to data sources and tools. MCP standardizes discovery and invocation; it does not provide security by itself. Identity, authorization, input validation, network boundaries, audit, and human approval remain responsibilities of the implementation.

In a standard IT environment, an MCP server might expose approved enterprise data tools. In manufacturing, an implementation can expose scoped machine telemetry, Unified Namespace data, or maintenance records without giving the AI client direct credentials to the underlying PLC, SCADA, or database. Whether that boundary is secure depends on the surrounding identity, policy, network, and tool implementation.

Why Manufacturing Needs MCP

Integrating AI into the shop floor using legacy methods usually involves brittle custom API scripts or risky direct database connections. MCP solves three fundamental industrial pain points:

The "Read-Only" Safety Boundary

AI models act as clients. They ask the MCP Server for specific data (e.g., "What is the current temperature of Oven 3?"). The MCP Server executes the query, fetches the data, and returns the result to the AI. Because the MCP Server handles the actual data extraction, you can enforce Read-Only operations through scoped tools, role-based access, and network segmentation. Under this architecture, direct machine "Write" commands are intentionally excluded from the MCP tool surface.

Guardrails and Scoping (Governance)

With an MCP Server, you define the exact scope of what the AI is allowed to see. You can expose the last 7 days of OEE data and error logs, while keeping sensitive financial data or critical control tags outside exposed tool scopes. The AI doesn't get raw SQL access; it gets access to governed, pre-approved "Tools".

Auditability

The MCP service should record the authenticated principal, selected tool, parameters, result status, and relevant correlation data according to retention and privacy policy. Audit completeness depends on identity propagation and the surrounding application, not the protocol name alone.

How Proxus Secures AI with the Proxus MCP Server

person

Engineer / ChatGPT

verified_user

Proxus MCP Server

Read-Only OData

database

ClickHouse Telemetry DB

dns

Proxus Edge Gateway

memory

Mission-Critical PLC

Within the Proxus Industrial Data Platform, MCP is an optional governed consumer path for approved operational data. It does not replace dashboards, workflows, APIs, or established OT control interfaces.

The Proxus MCP Server is a dedicated architectural component built specifically for industrial enterprise environments:

OData-backed schema discovery: In supported deployments, approved Proxus entities and fields can be exposed through governed metadata and query tools. Available schema, relationships, and permissions depend on the deployed version and authenticated user's scope.
Governed telemetry queries: Approved tools query the operational data boundary rather than exposing arbitrary database execution. This narrows the surface but does not remove prompt-injection or authorization risk.
User-context authorization: Connected clients operate within the authenticated Proxus user's permitted scope. Roles, object and field permissions, gateway/UNS scope, and edition/version behavior must be verified in the deployed environment.

info

Outbound-Only Architecture

Remember: The Proxus MCP Server sits on the IT layer. It communicates with the Edge Gateways via outbound-only MQTT streams. This architecture blocks direct inbound OT access from the AI path; however, OT safety still depends on strict IAM boundaries, audited tool scopes, and control-path isolation.

Real-World MCP Use Cases in the Factory

With a governed MCP implementation, teams can support workflows such as these while keeping the AI data path separate from machine control:

Maintenance triage: A machine faults during an unattended shift. The technician asks an approved assistant to summarise recent alarms and compare them with governed error-code references. The result is a hypothesis for review, not a verified root cause.
Shift handover drafting: A production manager asks the assistant to draft a handover report containing throughput, configured OEE exceptions, and outstanding maintenance work. A responsible user reviews the source data and draft before release.
Energy Optimization: "Cross-reference our real-time energy consumption (kWh) over the weekend with the production schedule. Were any high-draw machines left idling?"

Conclusion

MCP can provide a consistent tool interface between approved AI clients and an industrial data platform. A governed middle layer such as the Proxus MCP Server can reduce direct data-source exposure, but safety depends on the complete identity, authorization, audit, network, tool, and control-path design. AI remains a consumer of governed operational data, not the product category itself.

When this may not be suitable

Lower-frequency telemetry may not justify full distributed complexity.
Small single-line plants may prefer simpler architectures first.
Strict legacy constraints may require phased adoption.
Safety-critical closed-loop control should remain in PLC/Safety PLC layers.

Results vary with workload, hardware, and topology.

Frequently Asked Questions

What is MCP in simple terms?

MCP is an open protocol through which AI applications discover and invoke defined tools. A particular server may expose only read operations, but MCP itself is not inherently read-only or a complete security boundary.

Can MCP be used to control machines?

The protocol can represent tools with side effects, so the answer depends on the server. In industrial deployments, keep data exploration separate from machine-control authority. Any command path requires explicit authorization, validation, human or workflow approval where appropriate, audit, timeout, and safety design.

How does MCP differ from REST APIs for AI access?

REST defines resource-oriented HTTP interfaces, while MCP defines a protocol for AI-facing tools, resources, and prompts. MCP can standardize discovery and parameter schemas, but authentication, authorization, compatibility, and the mapping to Unified Namespace data still require implementation work.

To evaluate how this topic fits into a customer-controlled operational data architecture, review the Proxus Industrial Data Platform and the implementation documentation linked above.

References

Anthropic, "Model Context Protocol Specification" - The open standard defining server-client communication for AI tool use. modelcontextprotocol.io
IEC 62443 - Industrial cybersecurity standard relevant to securing AI access to OT systems.
NIST AI RMF (AI Risk Management Framework) - Framework for managing risks in AI deployments, applicable to industrial MCP implementations.

Explore the Proxus MCP Server Architecture →