Keycloak Admin Tool

v1.0.0Securitystable

An MCP server for Keycloak, designed to work with Keycloak for identity and access management, covering, Users, Realms, Clients, Roles, Groups, IDPs, Authentication. Searching keycloak discourse, Native builds available.

javakeycloakmcp-serverquarkus
Share:
42
Stars
0
Downloads
0
Weekly
0/5

What is Keycloak Admin Tool?

Keycloak Admin Tool is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to mcp server for keycloak, designed to work with keycloak for identity and access management, covering, users, realms, clients, roles, groups, idps, authentication. searching keycloak discourse, native ...

An MCP server for Keycloak, designed to work with Keycloak for identity and access management, covering, Users, Realms, Clients, Roles, Groups, IDPs, Authentication. Searching keycloak discourse, Native builds available.

This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.

Features

  • create-user
  • delete-user
  • list-realms
  • list-users
  • assign-client-role-to-user

Use Cases

Identity and access management
User role and group administration
sshaaf

Maintainer

LicenseMIT
Languagejava
Versionv1.0.0
UpdatedMay 16, 2026
Statushealthy
Maintenanceactive

Works with

ClaudeOpenAIwindowsmacoslinux

Installation

NPM

npx -y keycloak-mcp

Manual Installation

npx -y keycloak-mcp

Configuration

Configuration Details

Config File

claude_desktop_config.json

Performance

Response Metrics

Response Time< 200ms
ThroughputMedium

Resource Usage

Memory UsageLow
CPU UsageLow

How to Set Up and Use Keycloak Admin Tool

The Keycloak MCP server gives AI assistants programmatic access to Keycloak's identity and access management platform, exposing tools for managing users, realms, clients, roles, groups, and authentication flows through natural language. Instead of navigating the Keycloak Admin Console manually, you can ask Claude to create users, assign roles, list realm configurations, and inspect OpenID Connect clients. The server communicates over SSE (Server-Sent Events) and requires authentication via a JWT Bearer token obtained from your Keycloak instance.

Prerequisites

  • A running Keycloak instance (self-hosted or cloud) with Admin API access
  • An OIDC client configured in Keycloak with permissions to call the Admin REST API
  • Docker installed (for the recommended containerized server deployment)
  • A valid JWT token from Keycloak for MCP client authentication
  • Claude Desktop, Cursor, or another MCP client that supports SSE transport
1

Run the Keycloak MCP server with Docker

Start the server container, passing your Keycloak URL, realm, and OIDC client ID as environment variables. The server listens on port 8080 by default.

docker run -d \
  --name keycloak-mcp-server \
  -p 8080:8080 \
  -e KC_URL=https://keycloak.example.com \
  -e KC_REALM=master \
  -e OIDC_CLIENT_ID=mcp-server \
  quay.io/sshaaf/keycloak-mcp-server:latest
2

Obtain a JWT token for MCP authentication

Use the provided helper script to authenticate against Keycloak and retrieve a Bearer token. You will pass this token in the MCP client Authorization header.

./scripts/get-mcp-token.sh \
  --keycloak-url https://keycloak.example.com \
  --username your-admin-username \
  --password your-admin-password
3

Configure your MCP client with the SSE endpoint

Add the Keycloak MCP server to your Cursor or Claude Desktop MCP configuration, using the SSE transport and the JWT token obtained in the previous step.

4

Verify the connection by listing realms

Open your MCP client and ask Claude to list the available Keycloak realms. A successful response confirms that the server, token, and transport are all working correctly.

Keycloak Admin Tool Examples

Client configuration

Add this block to your ~/.cursor/mcp.json (or claude_desktop_config.json) to connect to the running Keycloak MCP server over SSE with Bearer token authentication.

{
  "mcpServers": {
    "keycloak": {
      "transport": "sse",
      "url": "http://localhost:8080/mcp/sse",
      "headers": {
        "Authorization": "Bearer <your-jwt-token>"
      }
    }
  }
}

Prompts to try

Use these prompts in Claude Desktop or Cursor after the server is connected to manage your Keycloak instance conversationally.

- "List all realms in my Keycloak instance."
- "Create a new user with username john.doe and email [email protected] in the master realm."
- "List all users in the production realm."
- "Assign the admin client role to user john.doe."
- "Delete the user with username test.user from the staging realm."
- "List all clients configured in the master realm."

Troubleshooting Keycloak Admin Tool

401 Unauthorized when the MCP client tries to connect

The JWT token has likely expired. Keycloak tokens are short-lived. Re-run the get-mcp-token.sh script to obtain a fresh token, then update the Authorization header in your MCP client configuration.

Docker container starts but tools return connection refused errors

Verify that KC_URL points to a reachable Keycloak instance from inside the Docker container. If Keycloak is running on your local machine, use host.docker.internal instead of localhost as the hostname in KC_URL.

OIDC_CLIENT_ID errors or client not found

The OIDC client specified in OIDC_CLIENT_ID must exist in the realm specified by KC_REALM and must have Service Accounts enabled in Keycloak. Verify the client configuration in the Keycloak Admin Console under Clients.

Frequently Asked Questions about Keycloak Admin Tool

What is Keycloak Admin Tool?

Keycloak Admin Tool is a Model Context Protocol (MCP) server that mcp server for keycloak, designed to work with keycloak for identity and access management, covering, users, realms, clients, roles, groups, idps, authentication. searching keycloak discourse, native builds available. It connects AI assistants to external tools and data sources through a standardized interface.

How do I install Keycloak Admin Tool?

Install via npm with the command: npx -y keycloak-mcp. Then add the server configuration to your AI client's JSON config file (e.g., claude_desktop_config.json or .cursor/mcp.json).

Which AI clients work with Keycloak Admin Tool?

Keycloak Admin Tool works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.

Is Keycloak Admin Tool free to use?

Yes, Keycloak Admin Tool is open source and available under the MIT license. You can use it freely in both personal and commercial projects.

Keycloak Admin Tool Alternatives — Similar Security Servers

Looking for alternatives to Keycloak Admin Tool? Here are other popular security servers you can use with Claude, Cursor, and VS Code.

Casdoor

13.6k

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

ghidraMCP

9.0k

An Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through

HexStrike AI

8.9k

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b

IDA Pro MCP

8.7k

Enables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.

Anthropic Cybersecurity Skills

6.6k

754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform

Hooker

5.1k

🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u

Browse More Security MCP Servers

Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.

Quick Config Preview

{ "mcpServers": { "keycloak": { "command": "npx", "args": ["-y", "keycloak-mcp"] } } }

Add this to your claude_desktop_config.json or .cursor/mcp.json

Read the full setup guide →

Ready to use Keycloak Admin Tool?

Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.

33,000+ ServersFree & Open SourceStep-by-Step Guides