integritymcp
mcpother no repocom.bluecat/integritymcp · v26.1.0
BlueCat Integrity MCP Server (formerly bammcp)
run it
on your own machines, one way per deploy methodgenerated from the record, not tested yet
CHANGE_ME: check the image's README for its transport and port; this assumes streamable HTTP at :8000/mcp. If it speaks stdio only, use it from clients/mcp.json as a `docker run -i` command instead.
#!/usr/bin/env bash
# integritymcp (com.bluecat/integritymcp), recipe docker (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-integritymcp.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec docker run --rm --name mcp-my-agent-integritymcp -p 127.0.0.1:${PORT}:8000 --env-file /etc/mcp/my-agent.env quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
[Unit]
Description=MCP server integritymcp (toolset my-agent), generated by Hub
After=network-online.target docker.service
Wants=network-online.target
[Service]
Type=simple
User=mcp
Group=mcp
SupplementaryGroups=docker
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/integritymcp
WorkingDirectory=/var/lib/mcp/integritymcp
ExecStart=/opt/mcp/my-agent/bin/integritymcp.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/integritymcp
[Install]
WantedBy=multi-user.target
generated from the record, not tested yet
CHANGE_ME: check the image's README for its transport and port; this assumes streamable HTTP at :8000/mcp. If it speaks stdio only, use it from clients/mcp.json as a `docker run -i` command instead.
docker run --rm -p 127.0.0.1:8101:8000 -e BAM_BASE_URL -e BAM_USERNAME -e BAM_PASSWORD -e BAM_SSO_USERNAME -e BAM_SSO_PASSWORD -e MCP_AUTH_MODE -e MCP_API_KEY -e MCP_REQUEST_STATE_KEY -e MCP_REQUEST_STATE_KEY_PREVIOUS -e MCP_ED25519_PUBLIC_KEY -e MCP_SIGNED_KEY_AUDIENCE -e MCP_OAUTH_ISSUER -e MCP_OAUTH_JWKS_URI -e MCP_OAUTH_AUDIENCE -e ACCEPT_EULA quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
generated from the record, not tested yet
CHANGE_ME: check the image's README for its transport and port; this assumes streamable HTTP at :8000/mcp. If it speaks stdio only, use it from clients/mcp.json as a `docker run -i` command instead.
# Generated by Hub for toolset "my-agent" (2026-10-18T08:24:13+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
# cp .env.example .env # fill the ${VAR}s
# docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
integritymcp:
image: quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
ports:
- 127.0.0.1:8101:8000
restart: unless-stopped
x-note: 'CHANGE_ME: check the image''s README for its transport and port; this assumes streamable
HTTP at :8000/mcp. If it speaks stdio only, use it from clients/mcp.json as a `docker run -i` command
instead.'
environment:
BAM_BASE_URL: ${BAM_BASE_URL}
BAM_USERNAME: ${BAM_USERNAME}
BAM_PASSWORD: ${BAM_PASSWORD}
BAM_SSO_USERNAME: ${BAM_SSO_USERNAME}
BAM_SSO_PASSWORD: ${BAM_SSO_PASSWORD}
MCP_AUTH_MODE: ${MCP_AUTH_MODE}
MCP_API_KEY: ${MCP_API_KEY}
MCP_REQUEST_STATE_KEY: ${MCP_REQUEST_STATE_KEY}
MCP_REQUEST_STATE_KEY_PREVIOUS: ${MCP_REQUEST_STATE_KEY_PREVIOUS}
MCP_ED25519_PUBLIC_KEY: ${MCP_ED25519_PUBLIC_KEY}
MCP_SIGNED_KEY_AUDIENCE: ${MCP_SIGNED_KEY_AUDIENCE}
MCP_OAUTH_ISSUER: ${MCP_OAUTH_ISSUER}
MCP_OAUTH_JWKS_URI: ${MCP_OAUTH_JWKS_URI}
MCP_OAUTH_AUDIENCE: ${MCP_OAUTH_AUDIENCE}
ACCEPT_EULA: ${ACCEPT_EULA}
volumes:
npm-cache: {}
uv-cache: {}
generated from the record, not tested yet
CHANGE_ME: check the image's README for its transport and port; this assumes streamable HTTP at :8000/mcp. If it speaks stdio only, use it from clients/mcp.json as a `docker run -i` command instead.
# Generated by Hub for toolset "my-agent" (2026-10-18T08:24:13+00:00).
# kubectl create namespace mcp
# kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
# kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: integritymcp
namespace: mcp
labels: &id001
app: integritymcp
spec:
replicas: 1
selector:
matchLabels: *id001
template:
metadata:
labels: *id001
spec:
containers:
- name: integritymcp
image: quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
ports:
- containerPort: 8000
name: http
env:
- name: BAM_BASE_URL
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_BASE_URL
- name: BAM_USERNAME
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_USERNAME
- name: BAM_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_PASSWORD
- name: BAM_SSO_USERNAME
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_SSO_USERNAME
- name: BAM_SSO_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_SSO_PASSWORD
- name: MCP_AUTH_MODE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_AUTH_MODE
- name: MCP_API_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_API_KEY
- name: MCP_REQUEST_STATE_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_REQUEST_STATE_KEY
- name: MCP_REQUEST_STATE_KEY_PREVIOUS
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_REQUEST_STATE_KEY_PREVIOUS
- name: MCP_ED25519_PUBLIC_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_ED25519_PUBLIC_KEY
- name: MCP_SIGNED_KEY_AUDIENCE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_SIGNED_KEY_AUDIENCE
- name: MCP_OAUTH_ISSUER
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_OAUTH_ISSUER
- name: MCP_OAUTH_JWKS_URI
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_OAUTH_JWKS_URI
- name: MCP_OAUTH_AUDIENCE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_OAUTH_AUDIENCE
- name: ACCEPT_EULA
valueFrom:
secretKeyRef:
name: mcp-credentials
key: ACCEPT_EULA
---
apiVersion: v1
kind: Service
metadata:
name: integritymcp
namespace: mcp
spec:
selector:
app: integritymcp
ports:
- port: 8000
targetPort: http
name: http
generated from the record, not tested yet
CHANGE_ME: check the image's README for its transport and port; this assumes streamable HTTP at :8000/mcp. If it speaks stdio only, use it from clients/mcp.json as a `docker run -i` command instead.
# Generated by Hub for toolset "my-agent" (2026-10-18T08:24:13+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
integritymcp:
enabled: true
replicas: 1
port: 8000
path: /mcp
container:
name: integritymcp
image: quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
ports:
- containerPort: 8000
name: http
env:
- name: BAM_BASE_URL
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_BASE_URL
- name: BAM_USERNAME
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_USERNAME
- name: BAM_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_PASSWORD
- name: BAM_SSO_USERNAME
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_SSO_USERNAME
- name: BAM_SSO_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: BAM_SSO_PASSWORD
- name: MCP_AUTH_MODE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_AUTH_MODE
- name: MCP_API_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_API_KEY
- name: MCP_REQUEST_STATE_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_REQUEST_STATE_KEY
- name: MCP_REQUEST_STATE_KEY_PREVIOUS
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_REQUEST_STATE_KEY_PREVIOUS
- name: MCP_ED25519_PUBLIC_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_ED25519_PUBLIC_KEY
- name: MCP_SIGNED_KEY_AUDIENCE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_SIGNED_KEY_AUDIENCE
- name: MCP_OAUTH_ISSUER
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_OAUTH_ISSUER
- name: MCP_OAUTH_JWKS_URI
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_OAUTH_JWKS_URI
- name: MCP_OAUTH_AUDIENCE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: MCP_OAUTH_AUDIENCE
- name: ACCEPT_EULA
valueFrom:
secretKeyRef:
name: mcp-credentials
key: ACCEPT_EULA
# helm install my-agent helm/my-agent -n mcp
in the cloud
one click: the provider's deploy form opens filled in, in your own account- koyeb
-
The form opens with CHANGE_ME for each value you supply: BAM_BASE_URL, BAM_USERNAME, BAM_PASSWORD, BAM_SSO_USERNAME, BAM_SSO_PASSWORD, MCP_AUTH_MODE, MCP_API_KEY, MCP_REQUEST_STATE_KEY, MCP_REQUEST_STATE_KEY_PREVIOUS, MCP_ED25519_PUBLIC_KEY, MCP_SIGNED_KEY_AUDIENCE, MCP_OAUTH_ISSUER, MCP_OAUTH_JWKS_URI, MCP_OAUTH_AUDIENCE, ACCEPT_EULA. Fill them in before you deploy.
Clients connect to the service's https://…koyeb.app address plus /mcp.
- azure
-
A Container Apps environment with one app per server, each with HTTPS ingress and one replica. The portal asks for each value you supply as a secure parameter; the deployment's outputs list the endpoints.
connect to it
copy what your client needsdocker run -i --rm -e BAM_BASE_URL -e BAM_USERNAME -e BAM_PASSWORD -e BAM_SSO_USERNAME -e BAM_SSO_PASSWORD -e MCP_AUTH_MODE -e MCP_API_KEY -e MCP_REQUEST_STATE_KEY -e MCP_REQUEST_STATE_KEY_PREVIOUS -e MCP_ED25519_PUBLIC_KEY -e MCP_SIGNED_KEY_AUDIENCE -e MCP_OAUTH_ISSUER -e MCP_OAUTH_JWKS_URI -e MCP_OAUTH_AUDIENCE -e ACCEPT_EULA quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
{
"mcpServers": {
"integritymcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_USERNAME",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_USERNAME",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"MCP_ED25519_PUBLIC_KEY",
"-e",
"MCP_SIGNED_KEY_AUDIENCE",
"-e",
"MCP_OAUTH_ISSUER",
"-e",
"MCP_OAUTH_JWKS_URI",
"-e",
"MCP_OAUTH_AUDIENCE",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_USERNAME": "${BAM_USERNAME}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_USERNAME": "${BAM_SSO_USERNAME}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"MCP_ED25519_PUBLIC_KEY": "${MCP_ED25519_PUBLIC_KEY}",
"MCP_SIGNED_KEY_AUDIENCE": "${MCP_SIGNED_KEY_AUDIENCE}",
"MCP_OAUTH_ISSUER": "${MCP_OAUTH_ISSUER}",
"MCP_OAUTH_JWKS_URI": "${MCP_OAUTH_JWKS_URI}",
"MCP_OAUTH_AUDIENCE": "${MCP_OAUTH_AUDIENCE}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
}
}
#!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add integritymcp -e "BAM_BASE_URL=${BAM_BASE_URL}" -e "BAM_USERNAME=${BAM_USERNAME}" -e "BAM_PASSWORD=${BAM_PASSWORD}" -e "BAM_SSO_USERNAME=${BAM_SSO_USERNAME}" -e "BAM_SSO_PASSWORD=${BAM_SSO_PASSWORD}" -e "MCP_AUTH_MODE=${MCP_AUTH_MODE}" -e "MCP_API_KEY=${MCP_API_KEY}" -e "MCP_REQUEST_STATE_KEY=${MCP_REQUEST_STATE_KEY}" -e "MCP_REQUEST_STATE_KEY_PREVIOUS=${MCP_REQUEST_STATE_KEY_PREVIOUS}" -e "MCP_ED25519_PUBLIC_KEY=${MCP_ED25519_PUBLIC_KEY}" -e "MCP_SIGNED_KEY_AUDIENCE=${MCP_SIGNED_KEY_AUDIENCE}" -e "MCP_OAUTH_ISSUER=${MCP_OAUTH_ISSUER}" -e "MCP_OAUTH_JWKS_URI=${MCP_OAUTH_JWKS_URI}" -e "MCP_OAUTH_AUDIENCE=${MCP_OAUTH_AUDIENCE}" -e "ACCEPT_EULA=${ACCEPT_EULA}" -- docker run -i --rm -e BAM_BASE_URL -e BAM_USERNAME -e BAM_PASSWORD -e BAM_SSO_USERNAME -e BAM_SSO_PASSWORD -e MCP_AUTH_MODE -e MCP_API_KEY -e MCP_REQUEST_STATE_KEY -e MCP_REQUEST_STATE_KEY_PREVIOUS -e MCP_ED25519_PUBLIC_KEY -e MCP_SIGNED_KEY_AUDIENCE -e MCP_OAUTH_ISSUER -e MCP_OAUTH_JWKS_URI -e MCP_OAUTH_AUDIENCE -e ACCEPT_EULA quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d
{
"mcpServers": {
"integritymcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_USERNAME",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_USERNAME",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"MCP_ED25519_PUBLIC_KEY",
"-e",
"MCP_SIGNED_KEY_AUDIENCE",
"-e",
"MCP_OAUTH_ISSUER",
"-e",
"MCP_OAUTH_JWKS_URI",
"-e",
"MCP_OAUTH_AUDIENCE",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_USERNAME": "${BAM_USERNAME}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_USERNAME": "${BAM_SSO_USERNAME}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"MCP_ED25519_PUBLIC_KEY": "${MCP_ED25519_PUBLIC_KEY}",
"MCP_SIGNED_KEY_AUDIENCE": "${MCP_SIGNED_KEY_AUDIENCE}",
"MCP_OAUTH_ISSUER": "${MCP_OAUTH_ISSUER}",
"MCP_OAUTH_JWKS_URI": "${MCP_OAUTH_JWKS_URI}",
"MCP_OAUTH_AUDIENCE": "${MCP_OAUTH_AUDIENCE}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
}
}
{
"servers": {
"integritymcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"BAM_BASE_URL",
"-e",
"BAM_USERNAME",
"-e",
"BAM_PASSWORD",
"-e",
"BAM_SSO_USERNAME",
"-e",
"BAM_SSO_PASSWORD",
"-e",
"MCP_AUTH_MODE",
"-e",
"MCP_API_KEY",
"-e",
"MCP_REQUEST_STATE_KEY",
"-e",
"MCP_REQUEST_STATE_KEY_PREVIOUS",
"-e",
"MCP_ED25519_PUBLIC_KEY",
"-e",
"MCP_SIGNED_KEY_AUDIENCE",
"-e",
"MCP_OAUTH_ISSUER",
"-e",
"MCP_OAUTH_JWKS_URI",
"-e",
"MCP_OAUTH_AUDIENCE",
"-e",
"ACCEPT_EULA",
"quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
],
"env": {
"BAM_BASE_URL": "${BAM_BASE_URL}",
"BAM_USERNAME": "${BAM_USERNAME}",
"BAM_PASSWORD": "${BAM_PASSWORD}",
"BAM_SSO_USERNAME": "${BAM_SSO_USERNAME}",
"BAM_SSO_PASSWORD": "${BAM_SSO_PASSWORD}",
"MCP_AUTH_MODE": "${MCP_AUTH_MODE}",
"MCP_API_KEY": "${MCP_API_KEY}",
"MCP_REQUEST_STATE_KEY": "${MCP_REQUEST_STATE_KEY}",
"MCP_REQUEST_STATE_KEY_PREVIOUS": "${MCP_REQUEST_STATE_KEY_PREVIOUS}",
"MCP_ED25519_PUBLIC_KEY": "${MCP_ED25519_PUBLIC_KEY}",
"MCP_SIGNED_KEY_AUDIENCE": "${MCP_SIGNED_KEY_AUDIENCE}",
"MCP_OAUTH_ISSUER": "${MCP_OAUTH_ISSUER}",
"MCP_OAUTH_JWKS_URI": "${MCP_OAUTH_JWKS_URI}",
"MCP_OAUTH_AUDIENCE": "${MCP_OAUTH_AUDIENCE}",
"ACCEPT_EULA": "${ACCEPT_EULA}"
}
}
}
}
name: my-agent target: local servers: - hub: com.bluecat/integritymcp
- trust flag: no_repo
- not probed yet: tools unpinned, ingest lists them
tools
Not probed yetThe tools appear once the hub or its worker has listed this entry. Running it still works: your client lists them on first start.