go-opcua — OPC UA Client and Server Library for Go (Golang)

go-opcua is a pure Go implementation of OPC Unified Architecture (OPC UA), providing comprehensive client and server capabilities for industrial automation, SCADA, industrial IoT (IIoT), and Industry 4.0 applications.

Connect to OPC UA servers, browse address spaces, read and write values, subscribe to data changes and events, call methods, and access historical data.

Build OPC UA servers with custom namespaces, variables, methods, subscriptions, events, access control, and historical data support.

go get github.com/otfabric/go-opcua

Requires Go 1.26 or later (go.mod and CI matrix; toolchain/golang.org/x/tools used for code generation).

• go-opcua — OPC UA Client and Server Library for Go (Golang)
  • Table of contents
  • Overview
  • Documentation
  • Quickstart
    • Read a value
    • Subscribe to changes
    • Browse the address space
    • Run a server
  • go-opcua compared with other OPC UA stacks
    • Features
    • Interop evidence
  • Client Features
  • Server Features
  • Service Support Matrix
  • Package Structure
  • Examples
  • Testing and production readiness
  • Protocol Support
  • License

go-opcua gives you everything needed to interact with OPC-UA servers or build your own.

• Client and server — Full OPC UA client and server implementations using OPC UA Binary over UA-TCP, WebSockets and HTTPS.
• Pure Go — No CGO or native C library dependencies. Cryptography is the Go standard library, plus ChaCha20-Poly1305 from golang.org/x/crypto for two of the ECC security policies.
• Secure communication — OPC UA message signing, encryption, X.509 certificates, and multiple authentication mechanisms.
• Data access — Read, write, browse, and manage OPC UA nodes.
• Subscriptions — Real-time data-change notifications, monitored items, events, and subscription management.
• Historical data — Historical reads, updates, and pluggable server-side history providers.
• Method calls — Invoke OPC UA methods or expose custom methods from your server.
• Resilience — Automatic reconnect, retry policies, and subscription recovery.
• Observability — Structured logging, pluggable metrics, and live server diagnostics (ServerDiagnosticsSummary, session diagnostics, DiagnosticInfo on request).
• Interoperability tested — Tested in both directions against open62541 (C), Eclipse Milo (Java), async-opcua (Rust), UA-.NETStandard (C#), node-opcua (TypeScript) and asyncua (Python).

Built for developers integrating PLCs, industrial gateways, SCADA systems, and industrial IoT applications.

MIT licensed · Pure Go · Client + Server · No CGO

For full API details see API.md.

package main

import (
    "context"
    "fmt"
    "log"

    "github.com/otfabric/go-opcua"
    "github.com/otfabric/go-opcua/ua"
)

func main() {
    ctx := context.Background()

    c, err := opcua.NewClient("opc.tcp://localhost:4840")
    if err != nil {
        log.Fatal(err)
    }
    if err := c.Connect(ctx); err != nil {
        log.Fatal(err)
    }
    defer c.Close(ctx)

    v, err := c.Node(ua.MustParseNodeID("i=2258")).Value(ctx) // or ua.StandardNodeID("CurrentTime") for symbolic name
    if err != nil {
        log.Fatal(err)
    }
    fmt.Println("Server time:", v.Value())
}

sub, notifs, err := c.NewSubscription().
    Interval(500 * time.Millisecond).
    Monitor(ua.MustParseNodeID("ns=2;s=Temperature")).
    Start(ctx)
if err != nil {
    log.Fatal(err)
}
defer sub.Cancel(ctx)

for msg := range notifs {
    if msg.Error != nil {
        log.Println("error:", msg.Error)
        continue
    }
    for _, item := range msg.Value.(*ua.DataChangeNotification).MonitoredItems {
        fmt.Printf("Value: %v\n", item.Value.Value.Value())
    }
}

node := c.Node(ua.MustParseNodeID("ns=0;i=85")) // Objects folder
refs, err := node.References(ctx, 0, ua.BrowseDirectionForward, ua.NodeClassAll, true)
if err != nil {
    log.Fatal(err)
}
for _, ref := range refs {
    fmt.Printf("  %s: %s\n", ref.BrowseName.Name, ref.NodeID.NodeID)
}

package main

import (
    "context"
    "log"

    "github.com/otfabric/go-opcua/server"
    "github.com/otfabric/go-opcua/ua"
)

func main() {
    srv, err := server.New(
        server.EndPoint("localhost", 4840),
        server.EnableSecurity("None", ua.MessageSecurityModeNone),
        server.EnableAuthMode(ua.UserTokenTypeAnonymous),
    )
    if err != nil {
        log.Fatal(err)
    }

    ns := server.NewNodeNameSpace(srv, "example") // registers the namespace

    n := ns.AddNewVariableStringNode("temperature", float64(21.5))
    ns.Objects().AddRef(n, 47, true) // HasComponent

    if err := srv.Start(context.Background()); err != nil {
        log.Fatal(err)
    }
    defer srv.Close()

    select {} // run until killed
}

go-opcua is tested against six other implementations in every applicable client/server direction (see Testing and production readiness): open62541 (C), Eclipse Milo (Java), async-opcua (Rust), the OPC Foundation UA-.NETStandard reference stack (C#), node-opcua (TypeScript) and opcua-asyncio (Python, asyncua). Each runs as a container from opcua-interop. The tables show where the stacks differ, so you can pick the right one for your project, and what the interop suite has actually exercised.

✅ = available · — = not available · · = not documented or not verified here. "Delegated" means the server SDK routes the service to the application and has no built-in implementation. The peer columns describe the stacks at the versions above, from their public sources, documentation and adapter behaviour as of October 2026; what the interop suite has proven is in the next table. If you spot an inaccuracy, please open an issue and we will correct it.

¹ Part 6 §7.1.3: the server opens the connection to a listening client and announces itself with ReverseHello (server.WithReverseConnect, opcua.ReverseConnect). Verified against open62541, async-opcua and node-opcua in both directions; the UA-.NETStandard adapter does not wire it.

² go-opcua follows open62541 1.5.9 where it and Part 6 1.05.07 differ (see Security); open62541 is the only ECC peer the suite can test, because UA-.NETStandard 2.0.1 refuses ECC certificates from the RSA test CA. The Brainpool curves come from a pure Go implementation that is not constant time; see Security.

³ node-opcua registers only with a discovery server that has a certificate, and reports success when the registration failed.

⁴ asyncua 2.1.0 ignores TimestampsToReturn, IndexRange, the sampling interval, MonitoringMode Sampling and ModifySubscription, applies the absolute deadband against the previous sample and does not apply a percent deadband, and moves a user's subscription to an anonymous session on TransferSubscriptions. See Interop gaps.

⁵ Milo's server SDK routes these service sets to the application's AddressSpace; in the reference server used for the interop tests, AddNodes returns BadNotSupported.

⁶ The go-opcua server applies all three triggers, absolute deadband on numeric scalars and arrays, and percent deadband on variables with an EURange property; it also honours the sampling interval and the IndexRange of a monitored item.

⁷ Publisher and subscriber, standalone (pubsub.New) or in the server (server.WithPubSub); UADP with Variant, DataValue and RawData fields, delta frames, keep-alive and events; JSON ua-data, ua-metadata, ua-status; PubSub-Aes128/256-CTR with keys from a static key ring, a Security Key Service or SetSecurityKeys push; remote configuration with pubsub/remote; chunked NetworkMessages, UADP discovery and the diagnostics objects. Transports: UDP unicast and multicast, raw Ethernet (Linux, macOS, FreeBSD; no TSN scheduling), MQTT 3.1.1 and 5.0, AMQP 1.0; PubSub Actions (request / response) with Go handlers. Interoperability-tested in both directions against open62541 (UDP, multicast, Ethernet, MQTT 3.1.1 and 5.0, SKS) and UA-.NETStandard (UDP, MQTT 3.1.1 and 5.0, message security, chunked NetworkMessages, UADP discovery); the AMQP transport is tested through RabbitMQ 4 and ActiveMQ Artemis. See PubSub.

⁸ An encoding of values (ua.EncodeJSON, ua.EncodeXML), not a transport. Verified live in both directions against open62541, Milo and UA-.NETStandard, and against a recorded open62541 corpus. See JSON and XML Data Encodings.

Each ledger row is one capability in one direction (go-opcua client → peer server, or peer client → go-opcua server), checked by a test. unsupported rows record what the peer (or its adapter) lacks or where it deviates from the specification; the test pins that behaviour or skips with the reason. unverified rows carry the reason they are still open: mostly an adapter command or fixture that opcua-interop does not have yet (a push certificate management or GDS client, peer server conditions for the Part 9 1.05 alarm methods), or a peer whose support is not established (see interop/GAPS.md).

Interop with these stacks found and fixed go-opcua defects that a Go-to-Go test cannot show, among them the RSA-OAEP-SHA256 block size (UA-.NETStandard), the first sequence number of a channel (async-opcua), the renewal of a superseded token (asyncua) and in-place key swaps on renewal (open62541, Milo). The known gaps, the peer deviations you may meet and their workarounds are listed in Interop gaps and workarounds.

Choose go-opcua if you write Go and want client and server in one library with no cgo and a permissive license, context control on every call, reconnect with subscription recovery, retries and observability built in, and a server that includes discovery, history and query out of the box.

Choose open62541 if you need a C library for embedded or bare-metal targets, time-scheduled PubSub over Ethernet (TSN), constant time Brainpool ECC security policies (OpenSSL), or a stack with an OPC Foundation certified server profile.

Choose Eclipse Milo if you are on the JVM and want asynchronous client and server SDKs with strong support for dynamically decoded custom data types.

Choose UA-.NETStandard if you build on .NET and need the OPC Foundation reference implementation.

Choose async-opcua, node-opcua or asyncua if you work in Rust, JavaScript / TypeScript or Python; check the footnotes and Interop gaps and workarounds for the server behaviour you rely on.

— = API present but server returns StatusBadServiceUnsupported, or client has no dedicated helper (use Client.Send).

Test-only packages (interop/, conformance/, chaos/, tests/) are not part of the public library surface.

The examples/ directory contains runnable programs:

Note: examples/server/server.go is a minimal low-level uacp transport stub (TCP listener only), not a full OPC-UA server. For a runnable server, use one of the server/*_server examples above.

Run any example:

go run examples/datetime/datetime.go -endpoint opc.tcp://localhost:4840

go-opcua is continuously interoperability-tested in all applicable client/server directions against open62541, Eclipse Milo, async-opcua, UA-.NETStandard, node-opcua and asyncua, all six in every interop CI run. The directional evidence ledger is maintained in interop/COVERAGE.md and interop/testdata/ledger-*.json; see Interop evidence.

• Verify gate: make verify — go vet, unit tests, race tests, and interop (make vet, make test-norace, make test, make interop).
• Unit tests: make test-norace (go test -count=1 ./...), make test (same with -race).
• Coverage: make coverage writes coverage.out for core library packages (90% gate); CI passes the same COVER_PKGS list as coverpkg to the shared workflow so Codecov matches. make cover opens the report.
• Integration tests (tag-gated, not in go test ./...): make integration (Go client vs FreeOpcUa Python server; needs make install-py-opcua), make selfintegration (Go client vs in-process Go server).
• Interop tests (tag-gated): make interop — go test -tags=interop ./interop/... against the digest-pinned opcua-interop v0.14.0 adapter containers of all six peers (OPEN62541_IMAGE, MILO_IMAGE, ASYNC_OPCUA_IMAGE, DOTNET_IMAGE, NODE_OPCUA_IMAGE, ASYNCUA_IMAGE override them); the UA-.NETStandard GDS adapter (DOTNET_GDS_IMAGE) is opt-in. go test ./interop/ checks the ledgers without Docker. See INTEROP.md.
• Chaos and parallelism tests (Go client vs Go server in one process, no Docker; part of go test ./... with a short fault phase): make chaos runs them with a 30 s fault phase per scenario (CHAOS_DURATION, CHAOS_SEED, CHAOS_LOG). chaos/ covers the unsecured state machines, chaos/secure the RSA, ECC and AEAD security policies (incl. bit flips, replayed, lost and reordered chunks), chaos/datachange DataChangeFilter and sampling, chaos/reverse reverse connect, chaos/discovery the LDS, registration and mDNS, chaos/codec the JSON / XML codecs and the shared NodeSet values, chaos/certmgmt push certificate management, chaos/gdspull the Global Discovery Server and the pull client, chaos/pubsub PubSub over lossy UDP and in-memory networks, Ethernet, MQTT 3.1.1 / 5.0 and AMQP 1.0 broker faults, key rotation and the SKS, chunks, discovery, Actions and diagnostics, and many runtimes on shared brokers. Every randomized scenario logs its seed and the command that replays it; see chaos/doc.go.
• Fuzz tests: ua/fuzz_test.go, ua/codec_fuzz_test.go (JSON and XML decoders), uasc/fuzz_test.go, uacp/fuzz_test.go, the WebSocket framing and handshake (internal/websocket), HTTPS request bodies (server), the condition state machine and condition events (server, opcua), trust list updates and encodings (server, gds), certificates, signing requests, CRLs and PFX files (uapolicy), mDNS messages (internal/mdns); PubSub: the UADP, JSON, chunk, discovery and Action decoders (pubsub/uadp, pubsub/jsonmsg), the runtime receive path and connection validation (chaos/pubsub), the MQTT and AMQP clients (internal/mqtt, internal/amqp) and the Ethernet frame, URL and BPF parsers (pubsub/transport/eth).
• Conformance tests (part of go test ./...): the go-opcua client against an in-process go-opcua server over a loopback secure channel, in conformance/ and its packages addrspace, subscription, session, security, transport, history, alarms, certmgmt, discovery, pubsub and eccext (see conformance/doc.go); conformance/matrix_test.go fails when an exported client method or a client or server option is exercised by none of them.
• PubSub end to end: conformance/pubsub/pubsub_*_test.go run server-to-server PubSub configured by OPC UA clients through the PublishSubscribe methods, over UDP (plain, secured, chunked), MQTT 5.0, AMQP 1.0 and an in-memory Ethernet link, with discovery and diagnostics read through a client.
• Linting: make lint (staticcheck), make lint-ci (golangci-lint); full local gate is make check (fmt + lint + verify + coverage).

See CONTRIBUTING.md for development and PR workflow.

PubSub (Part 14) is implemented in the pubsub packages: UDP (opc.udp://, unicast and multicast), Ethernet (opc.eth://, UADP only), MQTT 3.1.1 and 5.0 (mqtt://, mqtts://) and AMQP 1.0 (amqp://, amqps://) transports with the UADP and JSON message mappings; the PubSub-Aes128-CTR / PubSub-Aes256-CTR policies secure UADP messages and are not secure-channel policies. See PubSub.

This project is licensed under the MIT License. See LICENSE.