com.bluecat/livenxmcp

claude mcp add livenxmcp -e 'LIVENXMCP_URL=<LIVENXMCP_URL>' -e 'LIVENXMCP_TOKEN=<your livenxmcp_token>' -e 'MCP_AUTH_MODE=<MCP_AUTH_MODE>' -e 'MCP_API_KEY=<your mcp_api_key>' -e 'MCP_ED25519_PUBLIC_KEY=<MCP_ED25519_PUBLIC_KEY>' -e 'MCP_SIGNED_KEY_AUDIENCE=<MCP_SIGNED_KEY_AUDIENCE>' -e 'MCP_OAUTH_ISSUER=<MCP_OAUTH_ISSUER>' -e 'MCP_OAUTH_JWKS_URI=<MCP_OAUTH_JWKS_URI>' -e 'MCP_OAUTH_AUDIENCE=<MCP_OAUTH_AUDIENCE>' -e 'ACCEPT_EULA=<ACCEPT_EULA>' -- docker run -i --rm quay.io/bluecat/livenxmcp@sha256:c8c17c3428b274be20a5f8f159cc636535018dfff87bd27a72d25cdd8f0a61c3

{
    "mcpServers": {
        "livenxmcp": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "quay.io/bluecat/livenxmcp@sha256:c8c17c3428b274be20a5f8f159cc636535018dfff87bd27a72d25cdd8f0a61c3"
            ],
            "env": {
                "LIVENXMCP_URL": "<LIVENXMCP_URL>",
                "LIVENXMCP_TOKEN": "<your livenxmcp_token>",
                "MCP_AUTH_MODE": "<MCP_AUTH_MODE>",
                "MCP_API_KEY": "<your mcp_api_key>",
                "MCP_ED25519_PUBLIC_KEY": "<MCP_ED25519_PUBLIC_KEY>",
                "MCP_SIGNED_KEY_AUDIENCE": "<MCP_SIGNED_KEY_AUDIENCE>",
                "MCP_OAUTH_ISSUER": "<MCP_OAUTH_ISSUER>",
                "MCP_OAUTH_JWKS_URI": "<MCP_OAUTH_JWKS_URI>",
                "MCP_OAUTH_AUDIENCE": "<MCP_OAUTH_AUDIENCE>",
                "ACCEPT_EULA": "<ACCEPT_EULA>"
            }
        }
    }
}

Environment variables

• LIVENXMCP_URL required LiveNX base URL (e.g., https://nxapi.example.com).
• LIVENXMCP_TOKEN required secret LiveNX API Bearer token.
• MCP_AUTH_MODE required Client authentication mode for the /mcp endpoint. One of: none | static-key | signed-key | resource-server. Required at runtime — the server refuses to start without it (no default).
• MCP_API_KEY secret Static bearer token clients present as `Authorization: Bearer <key>`. Required only when MCP_AUTH_MODE=static-key.
• MCP_ED25519_PUBLIC_KEY Ed25519 public key (base64url) that MCP_AUTH_MODE=signed-key verifies license tokens against. DEFAULTS TO A SHARED DEMO KEY, which authenticates a token holder rather than a customer — every BlueCat-issued token for this server verifies against it. For anything beyond a trial, generate a per-deployment key pair (license-keygen --gen-key) and set this to its public half.
• MCP_SIGNED_KEY_AUDIENCE When set, a license token must carry exactly this audience or it is rejected — a declarative scope check on top of the key, so a token minted for another deployment fails even if it verifies. Unset means the aud claim is not checked. Only meaningful with MCP_AUTH_MODE=signed-key.
• MCP_OAUTH_ISSUER Token issuer URL, matched against the iss claim of incoming JWTs. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
• MCP_OAUTH_JWKS_URI JWKS endpoint whose public keys verify the signature on every incoming Bearer JWT. Required when MCP_AUTH_MODE=resource-server — the server refuses to start in that mode without it.
• MCP_OAUTH_AUDIENCE Expected JWT aud claim for MCP_AUTH_MODE=resource-server. A token carrying a different audience, or no aud claim at all, is rejected. Unset skips audience validation entirely.
• ACCEPT_EULA required Set to Y (or Yes/YES, any casing) to accept the BlueCat End User License Agreement. The container refuses to start without it.