integrity MCP Setup & Guide

{
  "id": "com.bluecat/integritymcp",
  "type": "mcp-server",
  "version": "26.1.0",
  "displayName": "integritymcp",
  "description": "BlueCat Integrity MCP Server (formerly bammcp)",
  "distribution": {
    "packages": [
      {
        "registryType": "oci",
        "identifier": "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d",
        "runtimeHint": "docker",
        "transport": "streamable-http",
        "environmentVariables": [
          {
            "name": "BAM_BASE_URL",
            "description": "BAM base URL (e.g., https://bam.bluecat.com).",
            "isRequired": true
          },
          {
            "name": "BAM_USERNAME",
            "description": "BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs."
          },
          {
            "name": "BAM_PASSWORD",
            "description": "BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.",
            "isSecret": true
          },
          {
            "name": "BAM_SSO_USERNAME",
            "description": "BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs."
          },
          {
            "name": "BAM_SSO_PASSWORD",
            "description": "BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.",
            "isSecret": true
          },
          {
            "name": "MCP_AUTH_MODE",
            "description": "Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).",
            "isRequired": true
          },
          {
            "name": "MCP_API_KEY",
            "description": "Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.",
            "isSecret": true
          },
          {
            "name": "MCP_REQUEST_STATE_KEY",
            "description": "HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.",
            "isSecret": true
          },
          {
            "name": "MCP_REQUEST_STATE_KEY_PREVIOUS",
            "description": "Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.",
            "isSecret": true
          },
          {
            "name": "MCP_ED25519_PUBLIC_KEY",
            "description": "Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half."
          },
          {
            "name": "MCP_SIGNED_KEY_AUDIENCE",
            "description": "When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key."
          },
          {
            "name": "MCP_OAUTH_ISSUER",
            "description": "Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it."
          },
          {
            "name": "MCP_OAUTH_JWKS_URI",
            "description": "JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it."
          },
          {
            "name": "MCP_OAUTH_AUDIENCE",
            "description": "Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely."
          },
          {
            "name": "ACCEPT_EULA",
            "description": "Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.",
            "isRequired": true
          }
        ]
      }
    ],
    "remotes": []
  },
  "dependencies": [],
  "installTargets": [
    "claude-code",
    "claude-desktop",
    "cursor",
    "vscode",
    "trae",
    "cherry-studio",
    "lingma",
    "windsurf",
    "cline",
    "workbuddy"
  ],
  "keywords": [],
  "provenance": {
    "origin": "official-mcp-registry",
    "originalId": "com.bluecat/integritymcp",
    "originalUrl": "https://registry.modelcontextprotocol.io/v0.1/servers/com.bluecat%2Fintegritymcp/versions/latest",
    "isOfficial": true,
    "status": "active"
  }
}