Keycloak Admin API

Local install

io.github.sferarc/keycloak-api-mcpv3.7.1 GitHub verified

Unofficial: one tool per Keycloak admin operation on a realm, read-only unless writes are enabled

Security

Watch Source Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-06T03:52:38.619785Z",
      "publishedAt": "2026-11-06T03:52:38.619785Z",
      "statusChangedAt": "2026-11-06T03:52:38.619785Z"
    }
  },
  "server": {
    "name": "io.github.sferarc/keycloak-api-mcp",
    "title": "Keycloak Admin API",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "3.7.1",
    "packages": [
      {
        "version": "3.7.1",
        "transport": {
          "type": "stdio"
        },
        "identifier": "keycloak-api",
        "runtimeHint": "npx",
        "registryType": "npm",
        "registryBaseUrl": "https://registry.npmjs.org",
        "environmentVariables": [
          {
            "name": "KEYCLOAK_URL",
            "isRequired": true,
            "description": "Base URL of the server, such as https://keycloak.example.com"
          },
          {
            "name": "KEYCLOAK_REALM",
            "isRequired": true,
            "description": "Realm the tools act on"
          },
          {
            "name": "KEYCLOAK_TOKEN",
            "isSecret": true,
            "description": "A fixed access token; otherwise set KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET"
          },
          {
            "name": "KEYCLOAK_CLIENT_ID",
            "description": "A confidential client with a service account, for the client credentials grant"
          },
          {
            "name": "KEYCLOAK_CLIENT_SECRET",
            "isSecret": true,
            "description": "Secret of that client"
          },
          {
            "name": "KEYCLOAK_TOKEN_REALM",
            "description": "Realm of that client, if not KEYCLOAK_REALM (for example master)"
          },
          {
            "name": "KEYCLOAK_MCP_ALLOW_WRITES",
            "description": "1 to list the tools that change data"
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/sferarc/openapi",
      "source": "github",
      "subfolder": "packages/keycloak-api"
    },
    "websiteUrl": "https://openapi.sferadev.com/keycloak-api",
    "description": "Unofficial: one tool per Keycloak admin operation on a realm, read-only unless writes are enabled"
  }
}

Maintain this server? Claim it

Try it

This server only runs locally, from a package. Install it with the instructions on this page to try it.

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM StudioThen replace the YOUR_ values and {placeholders} with your own.

Run in a terminal

claude mcp add keycloak-api-mcp \
  -e KEYCLOAK_URL=YOUR_KEYCLOAK_URL \
  -e KEYCLOAK_REALM=YOUR_KEYCLOAK_REALM \
  -- npx -y [email protected]

Environment

KEYCLOAK_URL (required): Base URL of the server, such as https://keycloak.example.com
KEYCLOAK_REALM (required): Realm the tools act on
KEYCLOAK_TOKEN (optional, not in the config above): A fixed access token; otherwise set KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET
KEYCLOAK_CLIENT_ID (optional, not in the config above): A confidential client with a service account, for the client credentials grant
KEYCLOAK_CLIENT_SECRET (optional, not in the config above): Secret of that client
KEYCLOAK_TOKEN_REALM (optional, not in the config above): Realm of that client, if not KEYCLOAK_REALM (for example master)
KEYCLOAK_MCP_ALLOW_WRITES (optional, not in the config above): 1 to list the tools that change data

Tools

We don't run packages, so we can't list this server's tools.