Micetromcp

Host a copy with our keys and logs.

• MICETRO_BASE_URL — Micetro base URL (e.g., https://micetro.bluecat.com).
• MICETRO_USERNAME — Micetro service-account username. Required unless MICETRO_API_KEY is set — supply one of the two credential options.
• MICETRO_PASSWORD — Micetro service-account password. Required alongside MICETRO_USERNAME, unless MICETRO_API_KEY is used instead.
• MICETRO_API_KEY — Micetro API key (Micetro 26.1 and later). Alternative to MICETRO_USERNAME + MICETRO_PASSWORD; wins over the username/password pair when both are set. Every outbound request carries `authorization: Bearer <key>` and no session login is performed.
• MCP_AUTH_MODE — Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).
• MCP_API_KEY — Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.
• MCP_ED25519_PUBLIC_KEY — Ed25519 public key that MCP_AUTH_MODE=signed-key verifies license tokens against: the one BlueCat supplies with your license tokens, as the raw 32-byte public key, base64url-encoded without padding (43 characters). Required when MCP_AUTH_MODE=signed-key — the server refuses to start in that mode without it.
• MCP_SIGNED_KEY_AUDIENCE — When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.
• MCP_OAUTH_ISSUER — Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
• MCP_OAUTH_JWKS_URI — JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
• MCP_OAUTH_AUDIENCE — Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.
• ACCEPT_EULA — Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.