README

Command-line tool for OPC UA servers. Browse, read, write, watch, discover endpoints, manage certificates, and generate PHP code from NodeSet2.xml -- all from the terminal.

Built on top of php-opcua/opcua-client, the pure PHP OPC UA client.

Installation

composer require php-opcua/opcua-cli

The binary is installed at vendor/bin/opcua-cli.

For global installation:

composer global require php-opcua/opcua-cli

Quick Start

# Discover what's available
opcua-cli endpoints opc.tcp://localhost:4840

# Browse the address space
opcua-cli browse opc.tcp://localhost:4840

# Read a value
opcua-cli read opc.tcp://localhost:4840 "i=2259"

# Write a value
opcua-cli write opc.tcp://localhost:4840 "ns=2;i=1001" 42 --type=Int32

# Watch a value in real time
opcua-cli watch opc.tcp://localhost:4840 "ns=2;i=1001"

Commands

browse -- Browse the address space

opcua-cli browse opc.tcp://localhost:4840
opcua-cli browse opc.tcp://localhost:4840 /Objects/MyPLC
opcua-cli browse opc.tcp://localhost:4840 "ns=2;i=1000"
opcua-cli browse opc.tcp://localhost:4840 /Objects --recursive --depth=3
opcua-cli browse opc.tcp://localhost:4840 /Objects --json

├── Server (i=2253) [Object]
├── MyPLC (ns=2;i=1000) [Object]
│   ├── Temperature (ns=2;i=1001) [Variable]
│   └── Pressure (ns=2;i=1002) [Variable]
└── DeviceSet (ns=3;i=5001) [Object]

read -- Read a node value

opcua-cli read opc.tcp://localhost:4840 "i=2259"
opcua-cli read opc.tcp://localhost:4840 "ns=2;i=1001" --attribute=DisplayName
opcua-cli read opc.tcp://localhost:4840 "ns=2;i=1001" --json

NodeId:     ns=2;i=1001
Attribute:  Value
Value:      23.5
Type:       Double
Status:     Good (0x00000000)
Source:     2026-03-24T15:30:00+00:00
Server:     2026-03-24T15:30:00+00:00

write -- Write a value to a node

opcua-cli write opc.tcp://localhost:4840 "ns=2;i=1001" 42
opcua-cli write opc.tcp://localhost:4840 "ns=2;i=1001" 42 --type=Int32
opcua-cli write opc.tcp://localhost:4840 "ns=2;i=2000" true --type=Boolean

endpoints -- Discover server endpoints

opcua-cli endpoints opc.tcp://localhost:4840

Endpoint: opc.tcp://localhost:4840
Security: None (mode: None)
Auth:     Anonymous, UserName

Endpoint: opc.tcp://localhost:4840
Security: Basic256Sha256 (mode: SignAndEncrypt)
Auth:     Anonymous, UserName, Certificate

watch -- Watch a value in real time

# Subscription mode (default) -- server pushes changes
opcua-cli watch opc.tcp://localhost:4840 "ns=2;i=1001"

# Polling mode -- read every 250ms
opcua-cli watch opc.tcp://localhost:4840 "ns=2;i=1001" --interval=250

[15:30:00.123] 23.5
[15:30:00.625] 23.6
[15:30:01.127] 23.4
^C

generate:nodeset -- Generate PHP classes from NodeSet2.xml

opcua-cli generate:nodeset path/to/Opc.Ua.Di.NodeSet2.xml \
  --output=src/Generated/Di/ --namespace=App\\OpcUa\\Di

Generates:

• NodeId constants -- one class with all node IDs as string constants
• PHP enums -- BackedEnum for each OPC UA enumeration type
• DTOs -- readonly classes with typed properties for structured DataTypes
• Codecs -- ExtensionObjectCodec implementations for binary encoding/decoding
• Registrar -- batch-registers all codecs with the client

No server connection required -- reads the XML file locally.

dump:nodeset -- Export server address space to NodeSet2.xml

opcua-cli dump:nodeset opc.tcp://192.168.1.100:4840 --output=MyPLC.NodeSet2.xml
opcua-cli dump:nodeset opc.tcp://192.168.1.100:4840 --output=MyPLC.NodeSet2.xml --namespace=2

The exported file can be fed directly to generate:nodeset.

trust -- Trust a server certificate

opcua-cli trust opc.tcp://server:4840 --trust-store=~/.opcua

trust:list -- List trusted certificates

opcua-cli trust:list --trust-store=~/.opcua

trust:remove -- Remove a trusted certificate

opcua-cli trust:remove ab:cd:12:34:... --trust-store=~/.opcua

Security Options

All commands support full security configuration:

# Username/password authentication
opcua-cli read opc.tcp://server:4840 "i=2259" -u admin -p secret

# Full security with certificates
opcua-cli read opc.tcp://server:4840 "i=2259" \
  --security-policy=Basic256Sha256 \
  --security-mode=SignAndEncrypt \
  --cert=/path/to/client.pem \
  --key=/path/to/client.key \
  --ca=/path/to/ca.pem \
  -u operator -p secret

Output Options

JSON

Add --json (or -j) to any command for machine-readable output:

opcua-cli browse opc.tcp://localhost:4840 --json | jq '.[].name'
opcua-cli read opc.tcp://localhost:4840 "i=2259" --json | jq '.Value'

Debug Logging

# Log to stdout (incompatible with --json)
opcua-cli read opc.tcp://localhost:4840 "i=2259" --debug

# Log to stderr (compatible with --json)
opcua-cli read opc.tcp://localhost:4840 "i=2259" --debug-stderr --json

# Log to file
opcua-cli read opc.tcp://localhost:4840 "i=2259" --debug-file=/tmp/opcua.log --json

Global Options

Ecosystem

Requirements

• PHP >= 8.2
• php-opcua/opcua-client

Versioning

This package follows the same version numbering as php-opcua/opcua-client. Each release of opcua-cli is aligned with the corresponding release of the client library to ensure full compatibility.

License

MIT. See LICENSE.