--- bezeichner: "com.bluecat/integritymcp" art: "mcp_server" slug: "com-bluecat-integritymcp" paketkoordinate: "oci:quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d" status: "aktiv" erhebungsstand: "2026-10-10T01:17:01.464Z" namensraum: "com.bluecat" registerseite: "https://tracevero.com/mcp/com-bluecat-integritymcp" abgerufen_am: "2026-10-10" zugangsdaten_erforderlich: false ausfuehrungsort: "entfernt" dateisystem_pfadargument: false quelloffen_einsehbar: false roh_beschreibung: "BlueCat Integrity MCP Server (formerly bammcp)" version: "26.1.0" roh_umgebungsvariablen: "BAM_BASE_URL, BAM_USERNAME, BAM_PASSWORD, BAM_SSO_USERNAME, BAM_SSO_PASSWORD, MCP_AUTH_MODE, MCP_API_KEY, MCP_REQUEST_STATE_KEY, MCP_REQUEST_STATE_KEY_PREVIOUS, MCP_ED25519_PUBLIC_KEY, MCP_SIGNED_KEY_AUDIENCE, MCP_OAUTH_ISSUER, MCP_OAUTH_JWKS_URI, MCP_OAUTH_AUDIENCE, ACCEPT_EULA" roh_geheime_pflichtvariablen: "" roh_transportarten: "streamable-http" roh_pfadargumente: "" roh_repository_url: "" roh_paketquellen: "oci" roh_geheime_pflichtkopfzeilen: "" roh_pfad_umgebungsvariablen: "" roh_remote_adressen: "" roh_remote_hosts: "" roh_statusmeldung: "" roh_veroeffentlicht_am: "2026-09-24" roh_aktualisiert_am: "2026-09-24" roh_schemafassung: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json" roh_bereitstellungsform: "paket" roh_repository_quelle: "" roh_repository_unterordner: "" roh_paketbezeichner: "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d" roh_paketversionen: "" roh_laufzeithinweise: "docker" roh_umgebungsformate: "" roh_umgebungsbeschreibungen: "ACCEPT_EULA=Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it. · BAM_BASE_URL=BAM base URL (e.g., https://bam.bluecat.com). · BAM_PASSWORD=BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead. · BAM_SSO_PASSWORD=BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair. · BAM_SSO_USERNAME=BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs. · BAM_USERNAME=BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs. · MCP_API_KEY=Static bearer token clients present as `Authorization: Bearer `. Required only when MCP_AUTH_MODE=static-key. · MCP_AUTH_MODE=Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default). · MCP_ED25519_PUBLIC_KEY=Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half. · MCP_OAUTH_AUDIENCE=Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely. · MCP_OAUTH_ISSUER=Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. · MCP_OAUTH_JWKS_URI=JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. · MCP_REQUEST_STATE_KEY=HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment. · MCP_REQUEST_STATE_KEY_PREVIOUS=Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted. · MCP_SIGNED_KEY_AUDIENCE=When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key." roh_symbolformate: "" roh_verbindungswege: "{\"packages\":[{\"registryType\":\"oci\",\"identifier\":\"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d\",\"runtimeHint\":\"docker\",\"transport\":\"streamable-http\",\"environment\":[{\"name\":\"BAM_BASE_URL\",\"description\":\"BAM base URL (e.g., https://bam.bluecat.com).\",\"required\":true,\"secret\":false},{\"name\":\"BAM_USERNAME\",\"description\":\"BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.\",\"required\":false,\"secret\":false},{\"name\":\"BAM_PASSWORD\",\"description\":\"BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.\",\"required\":false,\"secret\":true},{\"name\":\"BAM_SSO_USERNAME\",\"description\":\"BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.\",\"required\":false,\"secret\":false},{\"name\":\"BAM_SSO_PASSWORD\",\"description\":\"BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.\",\"required\":false,\"secret\":true},{\"name\":\"MCP_AUTH_MODE\",\"description\":\"Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).\",\"required\":true,\"secret\":false},{\"name\":\"MCP_API_KEY\",\"description\":\"Static bearer token clients present as `Authorization: Bearer `. Required only when MCP_AUTH_MODE=static-key.\",\"required\":false,\"secret\":true},{\"name\":\"MCP_REQUEST_STATE_KEY\",\"description\":\"HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.\",\"required\":false,\"secret\":true},{\"name\":\"MCP_REQUEST_STATE_KEY_PREVIOUS\",\"description\":\"Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.\",\"required\":false,\"secret\":true},{\"name\":\"MCP_ED25519_PUBLIC_KEY\",\"description\":\"Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SIGNED_KEY_AUDIENCE\",\"description\":\"When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_OAUTH_ISSUER\",\"description\":\"Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_OAUTH_JWKS_URI\",\"description\":\"JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_OAUTH_AUDIENCE\",\"description\":\"Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.\",\"required\":false,\"secret\":false},{\"name\":\"ACCEPT_EULA\",\"description\":\"Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.\",\"required\":true,\"secret\":false}],\"additional_arguments_declared\":true}],\"remotes\":[]}" --- # com.bluecat/integritymcp ## Measured values | Property | Value | Source | Collected on | Level of trust | Raw declaration | | --- | --- | --- | --- | --- | --- | | Required secrets declared | false | MCP-Register | 2026-09-25T01:17:01.872Z | abgeleitet | roh_geheime_pflichtvariablen: ; roh_geheime_pflichtkopfzeilen: | | Execution location | entfernt | MCP-Register | 2026-09-25T01:17:01.872Z | abgeleitet | roh_transportarten: streamable-http | | Path argument present | false | MCP-Register | 2026-09-25T01:17:01.872Z | abgeleitet | roh_pfadargumente: ; roh_pfad_umgebungsvariablen: | | Repository URL listed | false | MCP-Register | 2026-09-25T01:17:01.872Z | abgeleitet | roh_repository_url: | | Description (raw) | BlueCat Integrity MCP Server (formerly bammcp) | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Declared version | 26.1.0 | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Environment variables (raw) | BAM_BASE_URL, BAM_USERNAME, BAM_PASSWORD, BAM_SSO_USERNAME, BAM_SSO_PASSWORD, MCP_AUTH_MODE, MCP_API_KEY, MCP_REQUEST_STATE_KEY, MCP_REQUEST_STATE_KEY_PREVIOUS, MCP_ED25519_PUBLIC_KEY, MCP_SIGNED_KEY_AUDIENCE, MCP_OAUTH_ISSUER, MCP_OAUTH_JWKS_URI, MCP_OAUTH_AUDIENCE, ACCEPT_EULA | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Required secret variables (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Transports (raw) | streamable-http | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Path arguments (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Repository (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Package registries (raw) | oci | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Required secret headers (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Path environment variables (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Remote URLs (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Remote hosts (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Registry status message (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | First listed in the registry (raw) | 2026-09-24 | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Last changed in the registry (raw) | 2026-09-24 | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Schema version of the raw record (raw) | https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Delivery form (raw) | paket | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Repository platform (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Repository subfolder (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Package identifiers (raw) | quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Package versions (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Runtime hints (raw) | docker | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Environment variable formats (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Environment variable descriptions (raw) | ACCEPT_EULA=Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it. · BAM_BASE_URL=BAM base URL (e.g., https://bam.bluecat.com). · BAM_PASSWORD=BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead. · BAM_SSO_PASSWORD=BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair. · BAM_SSO_USERNAME=BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs. · BAM_USERNAME=BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs. · MCP_API_KEY=Static bearer token clients present as `Authorization: Bearer `. Required only when MCP_AUTH_MODE=static-key. · MCP_AUTH_MODE=Client authentication mode for the /mcp endpoint. One of: none \| static-key \| signed-key \| resource-server. Required at runtime — the server refuses to start without it (no default). · MCP_ED25519_PUBLIC_KEY=Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half. · MCP_OAUTH_AUDIENCE=Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely. · MCP_OAUTH_ISSUER=Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. · MCP_OAUTH_JWKS_URI=JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. · MCP_REQUEST_STATE_KEY=HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment. · MCP_REQUEST_STATE_KEY_PREVIOUS=Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted. · MCP_SIGNED_KEY_AUDIENCE=When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key. | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Icon formats (raw) | | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | | Connection paths (source structure) | {"packages":[{"registryType":"oci","identifier":"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d","runtimeHint":"docker","transport":"streamable-http","environment":[{"name":"BAM_BASE_URL","description":"BAM base URL (e.g., https://bam.bluecat.com).","required":true,"secret":false},{"name":"BAM_USERNAME","description":"BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.","required":false,"secret":false},{"name":"BAM_PASSWORD","description":"BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.","required":false,"secret":true},{"name":"BAM_SSO_USERNAME","description":"BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.","required":false,"secret":false},{"name":"BAM_SSO_PASSWORD","description":"BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.","required":false,"secret":true},{"name":"MCP_AUTH_MODE","description":"Client authentication mode for the /mcp endpoint. One of: none \| static-key \| signed-key \| resource-server. Required at runtime — the server refuses to start without it (no default).","required":true,"secret":false},{"name":"MCP_API_KEY","description":"Static bearer token clients present as `Authorization: Bearer `. Required only when MCP_AUTH_MODE=static-key.","required":false,"secret":true},{"name":"MCP_REQUEST_STATE_KEY","description":"HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.","required":false,"secret":true},{"name":"MCP_REQUEST_STATE_KEY_PREVIOUS","description":"Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.","required":false,"secret":true},{"name":"MCP_ED25519_PUBLIC_KEY","description":"Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.","required":false,"secret":false},{"name":"MCP_SIGNED_KEY_AUDIENCE","description":"When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.","required":false,"secret":false},{"name":"MCP_OAUTH_ISSUER","description":"Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.","required":false,"secret":false},{"name":"MCP_OAUTH_JWKS_URI","description":"JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.","required":false,"secret":false},{"name":"MCP_OAUTH_AUDIENCE","description":"Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.","required":false,"secret":false},{"name":"ACCEPT_EULA","description":"Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.","required":true,"secret":false}],"additional_arguments_declared":true}],"remotes":[]} | MCP-Register | 2026-09-25T01:17:01.872Z | selbstauskunft | | ## Links - Namespace: [[namensraum/com-bluecat|com.bluecat]] --- - Registry page: - Retrieved on: 2026-10-10