Integritymcp

ค่าที่ต้องใส่เอง

• BAM_BASE_URL จำเป็น env
  BAM base URL (e.g., https://bam.bluecat.com).
• BAM_USERNAME จำเป็น env
  BAM service-account username. Required unless the SSO pair (BAM_SSO_USERNAME + BAM_SSO_PASSWORD) is used instead — the server needs exactly one of the two pairs.
• BAM_PASSWORD ความลับ จำเป็น env
  BAM service-account password. Required alongside BAM_USERNAME, unless the SSO pair is used instead.
• BAM_SSO_USERNAME env
  BAM SSO username. Alternative to BAM_USERNAME + BAM_PASSWORD; the server needs exactly one of the two pairs.
• BAM_SSO_PASSWORD ความลับ จำเป็น env
  BAM SSO password. Required alongside BAM_SSO_USERNAME when using the SSO pair.
• MCP_AUTH_MODE ความลับ จำเป็น env
  Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).
• MCP_API_KEY ความลับ จำเป็น env
  Static bearer token clients present as `Authorization: Bearer `. Required only when MCP_AUTH_MODE=static-key.
• MCP_REQUEST_STATE_KEY ความลับ env
  HMAC key (at least 32 bytes) sealing the approval-gated write tools' requestState on MCP 2026-07-28 connections (#1031). Optional: unset uses a random per-process key, which is fine for a single repl…
• MCP_REQUEST_STATE_KEY_PREVIOUS ความลับ env
  Second requestState HMAC key, accepted for opening a sealed plan but never for sealing one: two-key rotation of MCP_REQUEST_STATE_KEY (#1032). Optional, and only valid together with MCP_REQUEST_STATE…
• MCP_ED25519_PUBLIC_KEY ความลับ env
  Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-…
• MCP_SIGNED_KEY_AUDIENCE ความลับ env
  When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset m…
• MCP_OAUTH_ISSUER จำเป็น env
  Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
• MCP_OAUTH_JWKS_URI จำเป็น env
  JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
• MCP_OAUTH_AUDIENCE env
  Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.
• ACCEPT_EULA จำเป็น env
  Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.

คำอธิบายยังเป็นภาษาอังกฤษตามต้นฉบับ

ค่าตั้งนี้สร้างจากข้อมูลใน registry ของผู้ทำ ถ้าไม่ตรงกับ README ให้เชื่อ README