| MICETRO_BASE_URL | Yes | Micetro base URL (e.g., https://micetro.bluecat.com). |
| MICETRO_USERNAME | No | Micetro service-account username. Required in self-hosted mode (MCP_DEPLOYMENT_MODE unset or self-hosted) unless MICETRO_API_KEY is used instead — the server needs exactly one of the two credential options. Not used in horizon mode (accepted and ignored — an operator is free to leave it set). |
| MICETRO_PASSWORD | No | Micetro service-account password. Required alongside MICETRO_USERNAME, unless MICETRO_API_KEY is used instead. Secret. |
| MICETRO_API_KEY | No | Micetro API key (Micetro 26.1 and later). Alternative to MICETRO_USERNAME + MICETRO_PASSWORD; wins over the username/password pair when both are set. Every outbound request carries `authorization: Bearer <key>` and no session login is performed. Unlike MICETRO_USERNAME/MICETRO_PASSWORD, which are simply not used in horizon mode, MICETRO_API_KEY is rejected at startup there — cloud mode has no fixed backend identity for a key to authenticate. Secret. |
| MCP_AUTH_MODE | Yes | Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default). |
| MCP_API_KEY | No | Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key. Secret. |
| MCP_ED25519_PUBLIC_KEY | No | Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half. |
| MCP_SIGNED_KEY_AUDIENCE | No | When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key. |
| MCP_OAUTH_ISSUER | No | Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. |
| MCP_OAUTH_JWKS_URI | No | JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it. |
| MCP_OAUTH_AUDIENCE | No | Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely. |
| ACCEPT_EULA | Yes | Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it. |