Integritymcp MCP Server

Integritymcp is an MCP integration. BlueCat Integrity MCP Server (formerly bammcp).

Packages and local setup

The published oci package is quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d. Its declared MCP transport is streamable-http.

The package declares BAM_BASE_URL (required): BAM base URL (e.g., https://bam.bluecat.com).; BAM_USERNAME: BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.; BAM_PASSWORD: BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.; BAM_SSO_USERNAME: BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.; BAM_SSO_PASSWORD: BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.; MCP_AUTH_MODE (required): Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).; MCP_API_KEY: Static bearer token clients present as Authorization: Bearer . Required only when MCP_AUTH_MODE=static-key.; MCP_REQUEST_STATE_KEY: HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.; MCP_REQUEST_STATE_KEY_PREVIOUS: Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.; MCP_ED25519_PUBLIC_KEY: Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.; MCP_SIGNED_KEY_AUDIENCE: When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.; MCP_OAUTH_ISSUER: Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.; MCP_OAUTH_JWKS_URI: JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.; MCP_OAUTH_AUDIENCE: Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.; ACCEPT_EULA (required): Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it..

This package has launch arguments in its registry record. Use the maintainer’s configuration for those arguments rather than launching it with only the package name.

Before connecting

Check the maintainer’s instructions for account access, authentication and the supported client configuration. Once connected, inspect the tools your client receives and try a small task that matches the server’s stated purpose. The registry description does not include a verified, complete tool list.

Project and source

View the publisher’s registry entry. This profile uses version 26.1.0 from the registry. Registration identifies the publisher namespace; it does not establish that this is a first-party integration for every service it connects.

Browse related other integrations MCP servers for tools that cover the same kind of work.