Integritymcp

com.bluecat/integritymcp · v26.1.0

BlueCat Integrity MCP Server (formerly bammcp)

Set it up

Connect Runs on your machine

Terminal

claude mcp add integritymcp -e BAM_BASE_URL=<BAM_BASE_URL> -e BAM_USERNAME=<BAM_USERNAME> -e BAM_PASSWORD=<BAM_PASSWORD> -e BAM_SSO_USERNAME=<BAM_SSO_USERNAME> -e BAM_SSO_PASSWORD=<BAM_SSO_PASSWORD> -e MCP_AUTH_MODE=<MCP_AUTH_MODE> -e MCP_API_KEY=<MCP_API_KEY> -e MCP_REQUEST_STATE_KEY=<MCP_REQUEST_STATE_KEY> -e MCP_REQUEST_STATE_KEY_PREVIOUS=<MCP_REQUEST_STATE_KEY_PREVIOUS> -e MCP_ED25519_PUBLIC_KEY=<MCP_ED25519_PUBLIC_KEY> -e MCP_SIGNED_KEY_AUDIENCE=<MCP_SIGNED_KEY_AUDIENCE> -e MCP_OAUTH_ISSUER=<MCP_OAUTH_ISSUER> -e MCP_OAUTH_JWKS_URI=<MCP_OAUTH_JWKS_URI> -e MCP_OAUTH_AUDIENCE=<MCP_OAUTH_AUDIENCE> -e ACCEPT_EULA=<ACCEPT_EULA> -- docker run -i --rm quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d

claude_desktop_config.json

{
  "mcpServers": {
    "integritymcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
      ],
      "env": {
        "BAM_BASE_URL": "<BAM_BASE_URL>",
        "BAM_USERNAME": "<BAM_USERNAME>",
        "BAM_PASSWORD": "<BAM_PASSWORD>",
        "BAM_SSO_USERNAME": "<BAM_SSO_USERNAME>",
        "BAM_SSO_PASSWORD": "<BAM_SSO_PASSWORD>",
        "MCP_AUTH_MODE": "<MCP_AUTH_MODE>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_REQUEST_STATE_KEY": "<MCP_REQUEST_STATE_KEY>",
        "MCP_REQUEST_STATE_KEY_PREVIOUS": "<MCP_REQUEST_STATE_KEY_PREVIOUS>",
        "MCP_ED25519_PUBLIC_KEY": "<MCP_ED25519_PUBLIC_KEY>",
        "MCP_SIGNED_KEY_AUDIENCE": "<MCP_SIGNED_KEY_AUDIENCE>",
        "MCP_OAUTH_ISSUER": "<MCP_OAUTH_ISSUER>",
        "MCP_OAUTH_JWKS_URI": "<MCP_OAUTH_JWKS_URI>",
        "MCP_OAUTH_AUDIENCE": "<MCP_OAUTH_AUDIENCE>",
        "ACCEPT_EULA": "<ACCEPT_EULA>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "integritymcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
      ],
      "env": {
        "BAM_BASE_URL": "<BAM_BASE_URL>",
        "BAM_USERNAME": "<BAM_USERNAME>",
        "BAM_PASSWORD": "<BAM_PASSWORD>",
        "BAM_SSO_USERNAME": "<BAM_SSO_USERNAME>",
        "BAM_SSO_PASSWORD": "<BAM_SSO_PASSWORD>",
        "MCP_AUTH_MODE": "<MCP_AUTH_MODE>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_REQUEST_STATE_KEY": "<MCP_REQUEST_STATE_KEY>",
        "MCP_REQUEST_STATE_KEY_PREVIOUS": "<MCP_REQUEST_STATE_KEY_PREVIOUS>",
        "MCP_ED25519_PUBLIC_KEY": "<MCP_ED25519_PUBLIC_KEY>",
        "MCP_SIGNED_KEY_AUDIENCE": "<MCP_SIGNED_KEY_AUDIENCE>",
        "MCP_OAUTH_ISSUER": "<MCP_OAUTH_ISSUER>",
        "MCP_OAUTH_JWKS_URI": "<MCP_OAUTH_JWKS_URI>",
        "MCP_OAUTH_AUDIENCE": "<MCP_OAUTH_AUDIENCE>",
        "ACCEPT_EULA": "<ACCEPT_EULA>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "integritymcp": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
      ],
      "env": {
        "BAM_BASE_URL": "<BAM_BASE_URL>",
        "BAM_USERNAME": "<BAM_USERNAME>",
        "BAM_PASSWORD": "<BAM_PASSWORD>",
        "BAM_SSO_USERNAME": "<BAM_SSO_USERNAME>",
        "BAM_SSO_PASSWORD": "<BAM_SSO_PASSWORD>",
        "MCP_AUTH_MODE": "<MCP_AUTH_MODE>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_REQUEST_STATE_KEY": "<MCP_REQUEST_STATE_KEY>",
        "MCP_REQUEST_STATE_KEY_PREVIOUS": "<MCP_REQUEST_STATE_KEY_PREVIOUS>",
        "MCP_ED25519_PUBLIC_KEY": "<MCP_ED25519_PUBLIC_KEY>",
        "MCP_SIGNED_KEY_AUDIENCE": "<MCP_SIGNED_KEY_AUDIENCE>",
        "MCP_OAUTH_ISSUER": "<MCP_OAUTH_ISSUER>",
        "MCP_OAUTH_JWKS_URI": "<MCP_OAUTH_JWKS_URI>",
        "MCP_OAUTH_AUDIENCE": "<MCP_OAUTH_AUDIENCE>",
        "ACCEPT_EULA": "<ACCEPT_EULA>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`BAM_BASE_URL` Required	BAM base URL (e.g., https://bam.bluecat.com).
`BAM_USERNAME` Optional	BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.
`BAM_PASSWORD` Optional, secret	BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.
`BAM_SSO_USERNAME` Optional	BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.
`BAM_SSO_PASSWORD` Optional, secret	BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.
`MCP_AUTH_MODE` Required	Client authentication mode for the /mcp endpoint. One of: none \| static-key \| signed-key \| resource-server. Required at runtime — the server refuses to start without it (no default).
`MCP_API_KEY` Optional, secret	Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.
`MCP_REQUEST_STATE_KEY` Optional, secret	HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.
`MCP_REQUEST_STATE_KEY_PREVIOUS` Optional, secret	Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after…
`MCP_ED25519_PUBLIC_KEY` Optional	Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deploy…
`MCP_SIGNED_KEY_AUDIENCE` Optional	When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.
`MCP_OAUTH_ISSUER` Optional	Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
`MCP_OAUTH_JWKS_URI` Optional	JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
`MCP_OAUTH_AUDIENCE` Optional	Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.
`ACCEPT_EULA` Required	Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.

Details

Package	`quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d` (OCI, streamable-http)
First published	24 Sep 2026
Last updated	24 Sep 2026
Registry name	`com.bluecat/integritymcp`

More other servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Integritymcp often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/com-bluecat-integritymcp/badge.svg)](https://nestdaddy.com/mcp/servers/com-bluecat-integritymcp)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.