Search / com.bluecat/integritymcp
protogridL0· runs locallyBlueCat Integrity MCP Server (formerly bammcp)
v26.1.0 · active · descriptor JSON · versions
{
"mcpServers": {
"integritymcp": {
"command": "docker",
"args": [
"-p",
"9998:9998",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
}
}claude mcp add integritymcp -e "BAM_BASE_URL=${BAM_BASE_URL}" -e "BAM_PASSWORD=${BAM_PASSWORD}" -e "BAM_SSO_PASSWORD=${BAM_SSO_PASSWORD}" -e "MCP_AUTH_MODE=${MCP_AUTH_MODE}" -e "MCP_API_KEY=${MCP_API_KEY}" -e "MCP_REQUEST_STATE_KEY=${MCP_REQUEST_STATE_KEY}" -e "MCP_REQUEST_STATE_KEY_PREVIOUS=${MCP_REQUEST_STATE_KEY_PREVIOUS}" -e "ACCEPT_EULA=${ACCEPT_EULA}" -- docker -p 9998:9998 -e BAM_BASE_URL -e BAM_PASSWORD -e BAM_SSO_PASSWORD -e MCP_AUTH_MODE -e MCP_API_KEY -e MCP_REQUEST_STATE_KEY -e MCP_REQUEST_STATE_KEY_PREVIOUS -e ACCEPT_EULA quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d[mcp_servers.integritymcp]
command = "docker"
args = ["-p", "9998:9998", "-e", "BAM_BASE_URL", "-e", "BAM_PASSWORD", "-e", "BAM_SSO_PASSWORD", "-e", "MCP_AUTH_MODE", "-e", "MCP_API_KEY", "-e", "MCP_REQUEST_STATE_KEY", "-e", "MCP_REQUEST_STATE_KEY_PREVIOUS", "-e", "ACCEPT_EULA", "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"]
env = { "BAM_BASE_URL" = "${BAM_BASE_URL}", "BAM_PASSWORD" = "${BAM_PASSWORD}", "BAM_SSO_PASSWORD" = "${BAM_SSO_PASSWORD}", "MCP_AUTH_MODE" = "${MCP_AUTH_MODE}", "MCP_API_KEY" = "${MCP_API_KEY}", "MCP_REQUEST_STATE_KEY" = "${MCP_REQUEST_STATE_KEY}", "MCP_REQUEST_STATE_KEY_PREVIOUS" = "${MCP_REQUEST_STATE_KEY_PREVIOUS}", "ACCEPT_EULA" = "${ACCEPT_EULA}" }
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"integritymcp": {
"type": "local",
"command": [
"docker",
"-p",
"9998:9998",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"enabled": true,
"environment": {
"BAM_BASE_URL": "{env:BAM_BASE_URL}",
"BAM_PASSWORD": "{env:BAM_PASSWORD}",
"BAM_SSO_PASSWORD": "{env:BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "{env:MCP_AUTH_MODE}",
"MCP_API_KEY": "{env:MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "{env:MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "{env:MCP_REQUEST_STATE_KEY_PREVIOUS}",
"ACCEPT_EULA": "{env:ACCEPT_EULA}"
}
}
}
}{
"mcpServers": {
"integritymcp": {
"command": "docker",
"args": [
"-p",
"9998:9998",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=integritymcp&config=eyJjb21tYW5kIjoiZG9ja2VyIiwiYXJncyI6WyItcCIsIjk5OTg6OTk5OCIsIi1lIiwiQkFNX0JBU0VfVVJMIiwiLWUiLCJCQU1fUEFTU1dPUkQiLCItZSIsIkJBTV9TU09fUEFTU1dPUkQiLCItZSIsIk1DUF9BVVRIX01PREUiLCItZSIsIk1DUF9BUElfS0VZIiwiLWUiLCJNQ1BfUkVRVUVTVF9TVEFURV9LRVkiLCItZSIsIk1DUF9SRVFVRVNUX1NUQVRFX0tFWV9QUkVWSU9VUyIsIi1lIiwiQUNDRVBUX0VVTEEiLCJxdWF5LmlvL2JsdWVjYXQvaW50ZWdyaXR5bWNwQHNoYTI1NjoxYjM4YzVmYzkzMjFjZWQxODFlNDE0YjgyODczYTcwNWE0NmI4MGMyODIwOTIyN2UzOWZlYTQ1NzhlN2EzYTBkIl0sImVudiI6eyJCQU1fQkFTRV9VUkwiOiIke0JBTV9CQVNFX1VSTH0iLCJCQU1fUEFTU1dPUkQiOiIke0JBTV9QQVNTV09SRH0iLCJCQU1fU1NPX1BBU1NXT1JEIjoiJHtCQU1fU1NPX1BBU1NXT1JEfSIsIk1DUF9BVVRIX01PREUiOiIke01DUF9BVVRIX01PREV9IiwiTUNQX0FQSV9LRVkiOiIke01DUF9BUElfS0VZfSIsIk1DUF9SRVFVRVNUX1NUQVRFX0tFWSI6IiR7TUNQX1JFUVVFU1RfU1RBVEVfS0VZfSIsIk1DUF9SRVFVRVNUX1NUQVRFX0tFWV9QUkVWSU9VUyI6IiR7TUNQX1JFUVVFU1RfU1RBVEVfS0VZX1BSRVZJT1VTfSIsIkFDQ0VQVF9FVUxBIjoiJHtBQ0NFUFRfRVVMQX0ifX0%3D"
}{
"servers": {
"integritymcp": {
"type": "stdio",
"command": "docker",
"args": [
"-p",
"9998:9998",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
}
}{
"mcpServers": {
"integritymcp": {
"command": "docker",
"args": [
"-p",
"9998:9998",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
}
}extensions:
"integritymcp":
enabled: true
name: "integritymcp"
type: stdio
cmd: "docker"
args:
- "-p"
- "9998:9998"
- "-e"
- "BAM_BASE_URL"
- "-e"
- "BAM_PASSWORD"
- "-e"
- "BAM_SSO_PASSWORD"
- "-e"
- "MCP_AUTH_MODE"
- "-e"
- "MCP_API_KEY"
- "-e"
- "MCP_REQUEST_STATE_KEY"
- "-e"
- "MCP_REQUEST_STATE_KEY_PREVIOUS"
- "-e"
- "ACCEPT_EULA"
- "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
envs:
"BAM_BASE_URL": "${BAM_BASE_URL}"
"BAM_PASSWORD": "${BAM_PASSWORD}"
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}"
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}"
"MCP_API_KEY": "${MCP_API_KEY}"
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}"
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}"
"ACCEPT_EULA": "${ACCEPT_EULA}"
timeout: 300
Placeholders to fill from your own secret store: ${BAM_PASSWORD}, ${BAM_SSO_PASSWORD}, ${MCP_API_KEY}, ${MCP_REQUEST_STATE_KEY}, ${MCP_REQUEST_STATE_KEY_PREVIOUS}. The registry never accepts secret values.
This is a local package: the command runs on your machine.
Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.
protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)auth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)stability.changes, stability.rug_pulltool list unknowndeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace ~liveness-unmeasured +updated-26d-ago -no-repository -unpinned-packages(1)
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| package | registry | version | runtime | secrets |
|---|---|---|---|---|
quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d | oci | unpinned | docker | BAM_PASSWORD, BAM_SSO_PASSWORD, MCP_API_KEY, MCP_REQUEST_STATE_KEY, MCP_REQUEST_STATE_KEY_PREVIOUS |
No tools observed. Local packages are never executed by the registry.
Schemas: list_tools.
{
"name": "com.bluecat/integritymcp",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "26.1.0",
"packages": [
{
"transport": {
"url": "http://localhost:9998/mcp",
"type": "streamable-http"
},
"identifier": "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d",
"runtimeHint": "docker",
"registryType": "oci",
"runtimeArguments": [
{
"name": "-p",
"type": "named",
"value": "9998:9998",
"isRequired": true
}
],
"environmentVariables": [
{
"name": "BAM_BASE_URL",
"isRequired": true,
"description": "BAM base URL (e.g., https://bam.bluecat.com)."
},
{
"name": "BAM_USERNAME",
"description": "BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs."
},
{
"name": "BAM_PASSWORD",
"isSecret": true,
"description": "BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead."
},
{
"name": "BAM_SSO_USERNAME",
"description": "BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs."
},
{
"name": "BAM_SSO_PASSWORD",
"isSecret": true,
"description": "BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair."
},
{
"name": "MCP_AUTH_MODE",
"isRequired": true,
"description": "Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default)."
},
{
"name": "MCP_API_KEY",
"isSecret": true,
"description": "Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key."
},
{
"name": "MCP_REQUEST_STATE_KEY",
"isSecret": true,
"description": "HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment."
},
{
"name": "MCP_REQUEST_STATE_KEY_PREVIOUS",
"isSecret": true,
"description": "Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted."
},
{
"name": "MCP_ED25519_PUBLIC_KEY",
"description": "Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half."
},
{
"name": "MCP_SIGNED_KEY_AUDIENCE",
"description": "When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key."
},
{
"name": "MCP_OAUTH_ISSUER",
"description": "Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it."
},
{
"name": "MCP_OAUTH_JWKS_URI",
"description": "JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it."
},
{
"name": "MCP_OAUTH_AUDIENCE",
"description": "Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely."
},
{
"name": "ACCEPT_EULA",
"isRequired": true,
"description": "Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it."
}
]
}
],
"description": "BlueCat Integrity MCP Server (formerly bammcp)"
}