One binary between the machines and the back office.
OpexFlow reads PLCs, CNCs and coding printers, talks to ERP, payment and data systems, and carries every record through one delivery path. Six areas, each linked to the docs page that states exactly what is and is not covered.
- shop floor
Read machines in their own protocols.
Controllers, CNCs and brokers are compiled in. There is no gateway product between the machine and the flow.
- Modbus TCP and RTU, EtherNet/IP to Allen-Bradley Logix, OPC-UA, Fanuc FOCAS, MTConnect, MQTT and NATS JetStream.
- Quality travels with every value: good, uncertain or bad. A source that goes silent produces an offline record, not a gap.
- Per-tag deadband and time aggregation at the edge cut what you push upstream.
- printers
Drive coding printers from a production order.
A business system posts an order, a flow turns it into printer jobs, and each printer loads the right message with batch, dates and weights.
- Markem-Imaje, Hitachi, Videojet CLARiTY, Domino Ax-Series, Zebra, TSC and SATO label printers, EOT-SUM lasers and any printer with a text-line input.
- Printers belong to production lines. A flow can target one printer, a whole line, or the jobs listed in the record.
- Flows use logical format and field names. Each printer maps them to its own message numbers, so one flow serves mixed brands, and a printer never prints with a layout it does not know.
- Every job lands in a job log, and the caller gets an answer per printer.
- business systems
Connect the systems around the plant.
Webhooks, schedules and REST calls are built-in nodes, not scripts bolted on.
- Signed webhook intake for DOKU, GlobalTix and any HMAC-SHA256 sender, with an optional IP allowlist. Secrets come from the environment and never enter the flow file.
- An HTTP node with bearer, basic, OAuth 2.0 client credentials, NetSuite token-based auth and NetSuite OAuth 2.0 M2M, DOKU request signing, plus a login-token scheme for APIs such as GlobalTix and ESB. A read-only or sandbox-only mode means a proof of concept cannot post to production.
- A business-event catalogue with a JSON Schema per event type, a validate node that quarantines bad records, lookup and cross-reference tables, and AsyncAPI export.
- Schedules that run a flow on a cron in your time zone, and Postgres and ClickHouse as sources and sinks.
- SOAP, SFTP, email, IMAP and SQL connectors for partners without a REST API, and mock services with fault injection for systems that are not ready yet.
- reliability
Failures are expected, so each one has an answer.
What happens to a record when a step fails is defined, visible and recoverable.
- Durable store-and-forward: a record is written to SQLite before the first send, delivered in order, retried with backoff and signed with HMAC.
- NATS input is acknowledged only after the record is durably handled downstream.
- The dedupe node counts a key as seen only after every sink accepted the record, so a sender that retries cannot post twice.
- Error branches route a failed record to your own handler. Compensation names the node that undoes a step, and undo steps run in reverse order.
- Dead letters keep the record as received and as the source sent it. You edit it, replay it into the source or the failing node, or discard it. Every action is audited.
- No-drop block mode makes a full queue push back on the sender instead of evicting the oldest record. An optional active-standby pair lets a second node take over after a crash.
- operations
Test before you deploy. Watch after.
Run it as a system someone is accountable for.
- Deploy is atomic and validated. A flow with an unwired port or an unknown sink is rejected, and the running flow stays as it was.
- Test a node against the last real record, or dry-run a whole source. Nothing is sent, and the side effects it would have caused are listed.
- A live debug stream and per-node counters for records in, out, errors and run time.
- Daily reconciliation: ledger nodes tally two sides, a reconcile node reports the exceptions, and finance downloads them as CSV.
- An SLA dashboard with p50, p95 and p99 per flow and per external system, a published OpenAPI document, SIEM export and a monthly service report.
- Alerts to email, Microsoft Teams, WhatsApp, Telegram or a webhook. A license check keeps working offline for a grace period you set.
- AI and MCP
Commission it with an agent in the loop.
The connector exposes what the editor does to an AI agent, with a switch to make that read-only.
- A built-in MCP server at /mcp, behind the same bearer token as the API. An agent inspects health, edits a draft flow, dry-runs every source, deploys, watches live data and checks printers, dead letters and reconciliation reports.
- read_only mode removes every tool that changes anything, for a client’s production connector.
- Describe a transform in plain language and an OpenAI-compatible endpoint that you configure writes the DSL or JavaScript. The server validates it before it lands.
Apps, line assurance and finance controls.
Three areas built on the same flows and the same delivery path. Each one links to the docs page that lists what it covers and what it leaves out.
- apps
Give operators and finance their own screens.
An app is a JSON document that the dashboard renders at /apps/{slug}. Publishing swaps it in at once: no build, no extra server.
- Forms, tables, charts, approval inboxes and live machine and printer tiles, reading what the connector already holds.
- A button or a form calls a flow, so one click can start a business process.
- A visual designer edits the same JSON on a live canvas and shows a diff before you publish.
- Each app has its own roles. Sign-in is the dashboard’s, SSO or token.
- line assurance
Know what was printed, and prove it.
Every printer job is recorded with what it was printed for. The printed code can be checked, shown on the line and reported per shift.
- Each job stores order, batch, lot, product and code. Recall a lot as JSON, CSV or HTML.
- Verify by scanner read-back or by the printer’s own confirmation. A failed check sends a record into a flow, where you can stop the line.
- A line board for a TV at /board shows each line’s printers, verification rate and unverified streak.
- A shift or day report gives jobs, failures, verification rate, downtime and availability per printer.
- finance controls
Put a person in front of the risky steps.
Three controls sit on top of reconciliation, dead letters and the posting mode of the http node.
- An exceptions workbench turns each reconciliation exception into a case with an owner, a status, comments and an age.
- The approve node parks a record until a named person approves or rejects it, with a timeout and an escalation alert.
- In a protected environment, switching a node to live posting needs a request from an editor and the approval of a second person. The sign-off is shown on the node.
Each system in its own protocol.
Machine adapters normalize to one canonical record, so a transform or a sink never needs to know which protocol produced it. Business systems exchange JSON events that you can check against a schema.
Controllers and CNCs5
- Modbus TCP + RTU
- Coils, discrete inputs, holding and input registers. 16, 32 and 64-bit integers, floats, strings and bit picks, with word and byte order per device. RTU runs over a serial port.
- EtherNet/IP
- Allen-Bradley Logix tags read by name, decoded by the type the PLC returns.
- OPC-UA
- Polled reads by NodeId, not monitored-item subscriptions. Signed and encrypted sessions; server certificates are verified unless you turn that off.
- Fanuc FOCAS
- Run state, axis positions, spindle data and alarms over FOCAS, straight from the control. Through your Fanuc library, or through the built-in client that needs none.The built-in client runs on every build, Raspberry Pi and macOS included, and is in beta: it has not yet been tried on a real controller. Fanuc’s own library works on the Windows and glibc Linux builds; you supply it.
- MTConnect
- Reads the agent’s /current JSON. Any OS, any vendor that exposes an agent.
Brokers and services3
- MQTT
- Source and sink. A wildcard topic becomes one machine per concrete topic. Messages are acknowledged to the broker on receipt.
- NATS JetStream
- Source and sink with durable consumers. A message is acked only after the record is durably handled downstream.
- HTTP / REST
- Poll any endpoint on an interval, with custom headers.
Databases and historians3
- PostgreSQL
- Query source with a persisted cursor, and a batched sink (TimescaleDB works). TLS through rustls, up to verify-full.
- ClickHouse
- Query source with a persisted cursor, and a batched sink.
- AVEVA PI
- Historian polling through the PI Web API.Opt-in build (the pi feature), not in the default binary.
Coding printers9
- Markem-Imaje
- 9020, 9030 and 9040 CIJ over the V24 protocol, on TCP or RS-232. Selects the library message and fills external variables.
- Hitachi
- RX, RX2 and UX CIJ over RS-232 or a serial device server. Recalls a message, prints items, sets the count block.
- Videojet CLARiTY
- TTO printers and the CLARiTY laser controller, on TCP or RS-232. Sets job fields by name.
- Domino Ax-Series
- Ax150i, Ax350i and Ax550i CIJ over Codenet 2, on TCP or RS-232.Other Domino families use a protocol Domino does not publish, and are not supported.
- Zebra ZPL (also Honeywell and Intermec in ZPL emulation)
- Label printers on TCP 9100 or serial. Recalls a stored format with its fields, or sends a ZPL template, with a head-open, paused and out-of-media check before each label.
- TSC TSPL
- Label printers on TCP 9100 or serial. Sends a TSPL template with text, barcodes and QR codes, and checks the printer status first.
- SATO SBPL
- Label printers on TCP 9100 or RS-232C. Sends an SBPL template or recalls a stored form, and checks the printer status first.
- EOT-SUM
- Videojet and Alltec lasers running an AllprintBasic script, over RS-232 with your own message templates.
- ASCII line input
- Any printer that takes text lines, such as the Scan and Print input of TIJ printers. TCP or RS-232, with optional ack and nak patterns.
Business systems4
- Signed webhooks
- Receive calls from a payment or shop platform. DOKU Non-SNAP, GlobalTix and generic HMAC-SHA256 signatures are checked, a bad signature is rejected and counted, and with a tolerance set a stale timestamp is refused. An optional IP allowlist turns other callers away before the body is read.
- Ingest API
- A production system posts a JSON object into a flow and gets the outcome back: done, failed, retry or pending.
- Schedule
- Runs a flow on a cron in an IANA time zone. Each tick carries the date and the previous date for daily jobs.
- HTTP node
- Calls an ERP or any REST API mid-flow. Bearer, basic, OAuth 2.0 client credentials, NetSuite token-based auth and NetSuite OAuth 2.0 M2M with a signed JWT, a login call that returns the token (GlobalTix, ESB) and DOKU request signing, with a read-only or sandbox-only posting mode.
Out the other side: signed webhook, NATS, MQTT, SQLite history, ClickHouse, Postgres.
Questions about what it connects.
Something missing? Write to marketing@opexcg.com.
Can I read Fanuc CNCs from a Raspberry Pi?
Yes, with the built-in FOCAS client, which needs no Fanuc library and runs on aarch64 and the static Linux builds. It is in beta: it has been tested against a simulator and against the published protocol samples, not yet against a real controller, so compare a few values with the control’s screen first. The MTConnect agent route works too.
If you have Fanuc’s own library, run it on a Windows or glibc Linux x86_64 edge PC instead; you supply it, OpexFlow does not redistribute it.
Can an AI agent set it up?
Yes. The connector serves an MCP endpoint at /mcp, behind the same token as the API. An agent can inspect health, edit a draft flow, dry-run every source, deploy, watch live data and check printers, dead letters and reconciliation reports. Tools that change things are labelled, and read_only mode removes them for a client’s production connector.
You can also describe a transform in plain language and have an OpenAI-compatible endpoint that you configure write it. The server validates the script before it lands.
From download to first record in minutes.
Run one binary, connect a PLC, a CNC or a webhook, and watch the records arrive in the editor.
- One binary
- Raspberry Pi to rack server
- Signed delivery with retries
Sizing questions or an air-gapped install? Email marketing@opexcg.com or read the quick start.