Industrial IoT was architected for hardware that no longer exists. Devices were dumb, networks were brittle, intelligence had to live elsewhere. Every constraint that justified the centralized hub has dissolved — but the architecture survived as inertia.
Five layers of abstraction. Vendor-locked gateways at $50,000 USD per site. Each integration is a custom project. Each agent is a fragile bridge to physical reality. The LLM never reaches the device — it negotiates with a translator that negotiates with another translator.
One layer. The device is the MCP Server. Devices form a mesh. Agents connect anywhere on the mesh and reach everything through semantic discovery. No translator. No vendor lock-in. No five-figure gateway. The LLM speaks directly to the physical world.
The standard defines exactly three tool patterns. Two for action. One for negotiation. Anything more is implementation. Anything less breaks the contract.
Retrieves a value from the physical world. Strongly typed. Semantically tagged. Each capability is a distinct MCP tool with its own schema, range, and unit.
Acts upon the physical world. Validated against ranges declared in the manifest. Enforced by local policy on the device itself. No central bypass possible.
Asks the mesh whether an intent is feasible. Returns candidates, blocked devices, current state, and side effects — in a single round trip. Routed semantically across the mesh.
The standard treats devices as first-class citizens. Each runs its own MCP Server, enforces its own policy, and participates in a semantically-organized gossip mesh. Coordination floats — any device can coordinate any query. There is no leader to lose.
Each node maintains 8–13 active peers categorized by physical proximity, capability affinity, and topological diversity. Queries route by semantic tags, not by exhaustive search.
A can_do query for "lower temperature in Zone 3" reaches 6–10 relevant devices in 2–3 hops — not 200 devices in flood broadcast. Diameter is O(log n). Latency stays sub-second at any deployment scale.
When an agent calls can_do, the receiving device assumes coordination duty for that single query. It dispatches, aggregates, and responds — then discards all state.
No leader election. No persistent role. If a coordinator dies mid-query, the agent retries against any other peer. The protocol is byzantine-tolerant because no node is essential.
Every property of the mesh layer was chosen assuming hardware capability is on a 10× / 5-year curve. Today, every constraint cited as a problem is solvable. Tomorrow, the constraints will not exist.
Membership and metadata propagation via the same proven protocol that runs Cassandra, Consul, and Redis Cluster. Convergence is O(log n) rounds. Tolerance to failure is built in.
Three peer slot categories — same_zone, same_capability, long_distance — produce graphs with logarithmic diameter and high clustering. Queries converge fast even in large meshes.
Critical actuators declare quorum requirements. During network splits, devices that cannot see enough peers refuse dangerous actions. Split-brain on safety-critical hardware is structurally prevented.
Suspected partitions trigger intensified scouting. Reconnection runs a deterministic merge protocol. No operator intervention required to recover from network splits.
The manifest maps semantic capabilities to physical interfaces. Each tool's name, type, range, unit, and binding lives in a single declarative YAML file. Implementation reads from the manifest. The LLM reads from the same source.
An HVAC controller exposing one read and one do, with full semantic tags, ranges, side effects, and policy hints.
The canonical response to any can_do. Every candidate, every blocked option, every relevant context — in a single round trip.
Each version targets a hardware tier that didn't exist when the previous version shipped. The protocol stays stable across versions. The capabilities deepen as the silicon catches up.
Three-tool vocabulary, semantic gossip, floating coordinator, manifest schema, policy schema, quorum protection, partition recovery.
Quantized embeddings on the device for local can_do matching. Multi-site mesh federation. Capability composition.
Small language models on-device for intent parsing. Multi-modal capabilities (vision in cameras, audio in microphones). Fully offline operation as default.
Frozen protocol surface. Backward compatibility guarantee. Certification program at scale. Multi-vendor interoperability tested across thousands of certified devices.
Adoption compounds. Hardware manufacturers implementing PhysMCP become universally consumable. Buyers requesting PhysMCP-certified gear pull the rest of the supply chain into the standard. The flywheel is the moat.
Fleet management, observability, compliance dashboards, multi-site analytics. Built on top of the standard, not into it.
Vertical-specific configurations: ISO/Quality, HVAC, Agriculture, HealthTech, Predictive Maintenance. Pre-bundled capabilities + policies.
Hardware vendors certify devices PhysMCP-compliant. Annual fee. Conformance test suite. Listing in the certified hardware directory.
PhysMCP Node and PhysMCP Aggregator — the canonical implementations. Open hardware, certified by definition.
Eleven hundred lines of protocol. Three verbs. One mesh. A complete blueprint for plugging artificial intelligence into the physical world — without permission, without intermediaries, without lock-in.