mcpField
I

integritymcp

Local
@bluecat.comCloud & Infra

About integritymcp

BlueCat Integrity MCP Server (formerly bammcp)

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "com-bluecat-integritymcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BAM_BASE_URL",
        "-e",
        "BAM_USERNAME",
        "-e",
        "BAM_PASSWORD",
        "-e",
        "BAM_SSO_USERNAME",
        "-e",
        "BAM_SSO_PASSWORD",
        "-e",
        "MCP_AUTH_MODE",
        "-e",
        "MCP_API_KEY",
        "-e",
        "MCP_REQUEST_STATE_KEY",
        "-e",
        "MCP_REQUEST_STATE_KEY_PREVIOUS",
        "-e",
        "MCP_ED25519_PUBLIC_KEY",
        "-e",
        "MCP_SIGNED_KEY_AUDIENCE",
        "-e",
        "MCP_OAUTH_ISSUER",
        "-e",
        "MCP_OAUTH_JWKS_URI",
        "-e",
        "MCP_OAUTH_AUDIENCE",
        "-e",
        "ACCEPT_EULA",
        "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
      ],
      "env": {
        "BAM_BASE_URL": "<BAM_BASE_URL>",
        "BAM_USERNAME": "<BAM_USERNAME>",
        "BAM_PASSWORD": "<BAM_PASSWORD>",
        "BAM_SSO_USERNAME": "<BAM_SSO_USERNAME>",
        "BAM_SSO_PASSWORD": "<BAM_SSO_PASSWORD>",
        "MCP_AUTH_MODE": "<MCP_AUTH_MODE>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_REQUEST_STATE_KEY": "<MCP_REQUEST_STATE_KEY>",
        "MCP_REQUEST_STATE_KEY_PREVIOUS": "<MCP_REQUEST_STATE_KEY_PREVIOUS>",
        "MCP_ED25519_PUBLIC_KEY": "<MCP_ED25519_PUBLIC_KEY>",
        "MCP_SIGNED_KEY_AUDIENCE": "<MCP_SIGNED_KEY_AUDIENCE>",
        "MCP_OAUTH_ISSUER": "<MCP_OAUTH_ISSUER>",
        "MCP_OAUTH_JWKS_URI": "<MCP_OAUTH_JWKS_URI>",
        "MCP_OAUTH_AUDIENCE": "<MCP_OAUTH_AUDIENCE>",
        "ACCEPT_EULA": "<ACCEPT_EULA>"
      }
    }
  }
}
Run commanddocker run -i --rm -e BAM_BASE_URL -e BAM_USERNAME -e BAM_PASSWORD -e BAM_SSO_USERNAME -e BAM_SSO_PASSWORD -e MCP_AUTH_MODE -e MCP_API_KEY -e MCP_REQUEST_STATE_KEY -e MCP_REQUEST_STATE_KEY_PREVIOUS -e MCP_ED25519_PUBLIC_KEY -e MCP_SIGNED_KEY_AUDIENCE -e MCP_OAUTH_ISSUER -e MCP_OAUTH_JWKS_URI -e MCP_OAUTH_AUDIENCE -e ACCEPT_EULA quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
Environment variables to set
BAM_BASE_URLBAM base URL (e.g., https://bam.bluecat.com).
BAM_USERNAMEBAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.
BAM_PASSWORDSecretBAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.
BAM_SSO_USERNAMEBAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.
BAM_SSO_PASSWORDSecretBAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.
MCP_AUTH_MODESecretClient authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).
MCP_API_KEYSecretStatic bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.
MCP_REQUEST_STATE_KEYSecretHMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.
MCP_REQUEST_STATE_KEY_PREVIOUSSecretSecond requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.
MCP_ED25519_PUBLIC_KEYSecretEd25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.
MCP_SIGNED_KEY_AUDIENCESecretWhen set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.
MCP_OAUTH_ISSUERSecretToken issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
MCP_OAUTH_JWKS_URISecretJWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
MCP_OAUTH_AUDIENCESecretExpected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.
ACCEPT_EULASet to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ociquay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

The maintainer has not added details yet. Check the README in the repository.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.