Skip to content

Raw values for com.bluecat/integritymcp

com.bluecat/integritymcp · Registry status: active

What the source declared verbatim, unchanged and uninterpreted. The derived values on the overview page are computed from these.

Evidence for this page · Source: MCP-Register · collected on 2026-09-25

Every value below comes from it. Where one differs, its origin is stated on its row.

Raw values
Description (raw)BlueCat Integrity MCP Server (formerly bammcp)
1 of 42,239 carry this value
Environment variables (raw)BAM_BASE_URL, BAM_USERNAME, BAM_PASSWORD, BAM_SSO_USERNAME, BAM_SSO_PASSWORD, MCP_AUTH_MODE, MCP_API_KEY, MCP_REQUEST_STATE_KEY, MCP_REQUEST_STATE_KEY_PREVIOUS, MCP_ED25519_PUBLIC_KEY, MCP_SIGNED_KEY_AUDIENCE, MCP_OAUTH_ISSUER, MCP_OAUTH_JWKS_URI, MCP_OAUTH_AUDIENCE, ACCEPT_EULA
1 of 42,239 carry this value
Required secret variables (raw)confirmed absent
Transports (raw)streamable-http
23,859 of 42,239 carry this value
Path arguments (raw)confirmed absent
Repository (raw)confirmed absent
Package registries (raw)oci
706 of 42,239 carry this value
Required secret headers (raw)confirmed absent
Path environment variables (raw)confirmed absent
Remote URLs (raw)confirmed absent
Remote hosts (raw)confirmed absent
Registry status message (raw)confirmed absent
First listed in the registry (raw)2026-09-24
497 of 42,239 carry this value
Last changed in the registry (raw)2026-09-24
490 of 42,239 carry this value
Schema version of the raw record (raw)https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
39,194 of 42,239 carry this value
Delivery form (raw)package
14,812 of 42,239 carry this value
Repository platform (raw)confirmed absent
Repository subfolder (raw)confirmed absent
Package identifiers (raw)quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
1 of 42,239 carry this value
Package versions (raw)confirmed absent
Runtime hints (raw)docker
182 of 42,239 carry this value
Environment variable formats (raw)confirmed absent
Environment variable descriptions (raw)ACCEPT_EULA=Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it. · BAM_BASE_URL=BAM base URL (e.g., https://bam.bluecat.com). · BAM_PASSWORD=BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead. · BAM_SSO_PASSWORD=BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair. · BAM_SSO_USERNAME=BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs. · BAM_USERNAME=BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs. · MCP_API_KEY=Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key. · MCP_AUTH_MODE=Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default). · MCP_ED25519_PUBLIC_KEY=Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half. · MCP_OAUTH_AUDIENCE=Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely. · MCP_OAUTH_ISSUER=Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. · MCP_OAUTH_JWKS_URI=JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. · MCP_REQUEST_STATE_KEY=HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment. · MCP_REQUEST_STATE_KEY_PREVIOUS=Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted. · MCP_SIGNED_KEY_AUDIENCE=When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.
1 of 42,239 carry this value
Icon formats (raw)confirmed absent
Connection paths (source structure){"packages":[{"registryType":"oci","identifier":"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d","runtimeHint":"docker","transport":"streamable-http","environment":[{"name":"BAM_BASE_URL","description":"BAM base URL (e.g., https://bam.bluecat.com).","required":true,"secret":false},{"name":"BAM_USERNAME","description":"BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.","required":false,"secret":false},{"name":"BAM_PASSWORD","description":"BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.","required":false,"secret":true},{"name":"BAM_SSO_USERNAME","description":"BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.","required":false,"secret":false},{"name":"BAM_SSO_PASSWORD","description":"BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.","required":false,"secret":true},{"name":"MCP_AUTH_MODE","description":"Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).","required":true,"secret":false},{"name":"MCP_API_KEY","description":"Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.","required":false,"secret":true},{"name":"MCP_REQUEST_STATE_KEY","description":"HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.","required":false,"secret":true},{"name":"MCP_REQUEST_STATE_KEY_PREVIOUS","description":"Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.","required":false,"secret":true},{"name":"MCP_ED25519_PUBLIC_KEY","description":"Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.","required":false,"secret":false},{"name":"MCP_SIGNED_KEY_AUDIENCE","description":"When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.","required":false,"secret":false},{"name":"MCP_OAUTH_ISSUER","description":"Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.","required":false,"secret":false},{"name":"MCP_OAUTH_JWKS_URI","description":"JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.","required":false,"secret":false},{"name":"MCP_OAUTH_AUDIENCE","description":"Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.","required":false,"secret":false},{"name":"ACCEPT_EULA","description":"Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.","required":true,"secret":false}],"additional_arguments_declared":true}],"remotes":[]}
1 of 42,239 carry this value

Position within the directory

How many of the 42,239 published entries carry the same measured value. A reference figure, not an assessment.

All 4 values together are carried by 9,886 of 42,239 entries.

tracevero · https://tracevero.com/mcp/com-bluecat-integritymcp/rohangaben