micetromcp

Name: micetromcp
Author: bluecat.com

本地服务

@bluecat.com云与基础设施

关于 micetromcp

BlueCat Micetro MCP 服务

配置

本地服务的配置在各客户端中通用，复制后粘贴到客户端的 MCP 配置文件即可。

mcp.json · 通用配置

{
  "mcpServers": {
    "com-bluecat-micetromcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "MICETRO_BASE_URL",
        "-e",
        "MICETRO_USERNAME",
        "-e",
        "MICETRO_PASSWORD",
        "-e",
        "MICETRO_API_KEY",
        "-e",
        "MCP_AUTH_MODE",
        "-e",
        "MCP_API_KEY",
        "-e",
        "MCP_ED25519_PUBLIC_KEY",
        "-e",
        "MCP_SIGNED_KEY_AUDIENCE",
        "-e",
        "MCP_OAUTH_ISSUER",
        "-e",
        "MCP_OAUTH_JWKS_URI",
        "-e",
        "MCP_OAUTH_AUDIENCE",
        "-e",
        "ACCEPT_EULA",
        "quay.io/bluecat/micetromcp@sha256:6319226443364523115c31ad4e51b725ab5d9599af2be4ea7dc43be66f36be5d"
      ],
      "env": {
        "MICETRO_BASE_URL": "<MICETRO_BASE_URL>",
        "MICETRO_USERNAME": "<MICETRO_USERNAME>",
        "MICETRO_PASSWORD": "<MICETRO_PASSWORD>",
        "MICETRO_API_KEY": "<MICETRO_API_KEY>",
        "MCP_AUTH_MODE": "<MCP_AUTH_MODE>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_ED25519_PUBLIC_KEY": "<MCP_ED25519_PUBLIC_KEY>",
        "MCP_SIGNED_KEY_AUDIENCE": "<MCP_SIGNED_KEY_AUDIENCE>",
        "MCP_OAUTH_ISSUER": "<MCP_OAUTH_ISSUER>",
        "MCP_OAUTH_JWKS_URI": "<MCP_OAUTH_JWKS_URI>",
        "MCP_OAUTH_AUDIENCE": "<MCP_OAUTH_AUDIENCE>",
        "ACCEPT_EULA": "<ACCEPT_EULA>"
      }
    }
  }
}

启动命令

docker run -i --rm -e MICETRO_BASE_URL -e MICETRO_USERNAME -e MICETRO_PASSWORD -e MICETRO_API_KEY -e MCP_AUTH_MODE -e MCP_API_KEY -e MCP_ED25519_PUBLIC_KEY -e MCP_SIGNED_KEY_AUDIENCE -e MCP_OAUTH_ISSUER -e MCP_OAUTH_JWKS_URI -e MCP_OAUTH_AUDIENCE -e ACCEPT_EULA quay.io/bluecat/micetromcp@sha256:6319226443364523115c31ad4e51b725ab5d9599af2be4ea7dc43be66f36be5d

需要配置的环境变量

MICETRO_BASE_URLMicetro base URL (e.g., https://micetro.bluecat.com).

MICETRO_USERNAMEMicetro service-account username. Required in self-hosted mode (MCP_DEPLOYMENT_MODE unset or self-hosted) unless MICETRO_API_KEY is used instead — the server needs exactly one of the two credential options. Not used in horizon mode (accepted and ignored — an operator is free to leave it set).

MICETRO_PASSWORD密钥Micetro service-account password. Required alongside MICETRO_USERNAME, unless MICETRO_API_KEY is used instead.

MICETRO_API_KEY密钥Micetro API key (Micetro 26.1 and later). Alternative to MICETRO_USERNAME + MICETRO_PASSWORD; wins over the username/password pair when both are set. Every outbound request carries `authorization: Bearer <key>` and no session login is performed. Unlike MICETRO_USERNAME/MICETRO_PASSWORD, which are simply not used in horizon mode, MICETRO_API_KEY is rejected at startup there — cloud mode has no fixed backend identity for a key to authenticate.

MCP_AUTH_MODE密钥Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).

MCP_API_KEY密钥Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.

MCP_ED25519_PUBLIC_KEY密钥Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.

MCP_SIGNED_KEY_AUDIENCE密钥When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.

MCP_OAUTH_ISSUER密钥Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.

MCP_OAUTH_JWKS_URI密钥JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.

MCP_OAUTH_AUDIENCE密钥Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.

ACCEPT_EULASet to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.

本地服务需要在你的电脑上安装运行环境（如 Node.js 18+）。各客户端的配置文件位置不同，请参考客户端文档。

安装包

ociquay.io/bluecat/micetromcp@sha256:6319226443364523115c31ad4e51b725ab5d9599af2be4ea7dc43be66f36be5dStreamable HTTP