How do I install Integritymcp?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Integritymcp need an API key?

The publisher lists these environment variables: BAM_BASE_URL, BAM_USERNAME, BAM_PASSWORD, BAM_SSO_USERNAME, BAM_SSO_PASSWORD, MCP_AUTH_MODE, MCP_API_KEY, MCP_REQUEST_STATE_KEY, MCP_REQUEST_STATE_KEY_PREVIOUS, MCP_ED25519_PUBLIC_KEY, MCP_SIGNED_KEY_AUDIENCE, MCP_OAUTH_ISSUER, MCP_OAUTH_JWKS_URI, MCP_OAUTH_AUDIENCE, ACCEPT_EULA.

What transport does Integritymcp use?

Integritymcp runs locally over stdio.

When was Integritymcp last checked?

Last checked 2026-10-16. BlueCat Integrity MCP Server (formerly bammcp)

Integritymcp

by com.bluecat

BlueCat Integrity MCP Server (formerly bammcp)

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Local command

docker run -i --rm quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d

Credentials from the publisher

BAM_BASE_URL — BAM base URL (e.g., https://bam.bluecat.com).
BAM_USERNAME — BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.
BAM_PASSWORD — BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.
BAM_SSO_USERNAME — BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.
BAM_SSO_PASSWORD — BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.
MCP_AUTH_MODE — Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).
MCP_API_KEY — Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.
MCP_REQUEST_STATE_KEY — HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single replica; set the same value on every replica of a multi-replica deployment.
MCP_REQUEST_STATE_KEY_PREVIOUS — Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE_KEY. When rolling the key across replicas set this to the old key, and remove it two minutes after the last replica restarted.
MCP_ED25519_PUBLIC_KEY — Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.
MCP_SIGNED_KEY_AUDIENCE — When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.
MCP_OAUTH_ISSUER — Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
MCP_OAUTH_JWKS_URI — JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
MCP_OAUTH_AUDIENCE — Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.
ACCEPT_EULA — Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.

Provider

Claude Code

BAM_BASE_URL=<value> BAM_USERNAME=<value> BAM_PASSWORD=<secret> BAM_SSO_USERNAME=<value> BAM_SSO_PASSWORD=<secret> MCP_AUTH_MODE=<value> MCP_API_KEY=<secret> MCP_REQUEST_STATE_KEY=<secret> MCP_REQUEST_STATE_KEY_PREVIOUS=<secret> MCP_ED25519_PUBLIC_KEY=<value> MCP_SIGNED_KEY_AUDIENCE=<value> MCP_OAUTH_ISSUER=<value> MCP_OAUTH_JWKS_URI=<value> MCP_OAUTH_AUDIENCE=<value> ACCEPT_EULA=<value> claude mcp add com.bluecat-integritymcp -- docker run -i --rm quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d

Run in a terminal.

Claude Desktop

{
  "mcpServers": {
    "com.bluecat-integritymcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "quay.io/bluecat/integritymcp@sha256:1b38c5fc9321ced181e414b82873a705a46b80c28209227e39fea4578e7a3a0d"
      ],
      "env": {
        "BAM_BASE_URL": "<value>",
        "BAM_USERNAME": "<value>",
        "BAM_PASSWORD": "<secret>",
        "BAM_SSO_USERNAME": "<value>",
        "BAM_SSO_PASSWORD": "<secret>",
        "MCP_AUTH_MODE": "<value>",
        "MCP_API_KEY": "<secret>",
        "MCP_REQUEST_STATE_KEY": "<secret>",
        "MCP_REQUEST_STATE_KEY_PREVIOUS": "<secret>",
        "MCP_ED25519_PUBLIC_KEY": "<value>",
        "MCP_SIGNED_KEY_AUDIENCE": "<value>",
        "MCP_OAUTH_ISSUER": "<value>",
        "MCP_OAUTH_JWKS_URI": "<value>",
        "MCP_OAUTH_AUDIENCE": "<value>",
        "ACCEPT_EULA": "<value>"
      }
    }
  }
}

claude_desktop_config.json

Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

Related skills

View all