Keycloak Model Context Protocol

io.github.ChristophEnglisch/keycloak-model-context-protocol · v1.1.0

Manage Keycloak users, groups, roles and realms through the Keycloak Admin REST API.

Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add keycloak-model-context-protocol -e KEYCLOAK_URL=<KEYCLOAK_URL> -e KEYCLOAK_AUTH_REALM=<KEYCLOAK_AUTH_REALM> -e KEYCLOAK_CLIENT_ID=<KEYCLOAK_CLIENT_ID> -e KEYCLOAK_CLIENT_SECRET=<KEYCLOAK_CLIENT_SECRET> -e KEYCLOAK_USERNAME=<KEYCLOAK_USERNAME> -e KEYCLOAK_PASSWORD=<KEYCLOAK_PASSWORD> -e KEYCLOAK_GRANT_TYPE=<KEYCLOAK_GRANT_TYPE> -e KEYCLOAK_MCP_READ_ONLY=<KEYCLOAK_MCP_READ_ONLY> -e KEYCLOAK_MCP_REALMS=<KEYCLOAK_MCP_REALMS> -e KEYCLOAK_MCP_ALLOW_MASTER_WRITE=<KEYCLOAK_MCP_ALLOW_MASTER_WRITE> -e KEYCLOAK_MCP_TOOLSETS=<KEYCLOAK_MCP_TOOLSETS> -e KEYCLOAK_MCP_REQUIRE_CONFIRMATION=<KEYCLOAK_MCP_REQUIRE_CONFIRMATION> -e KEYCLOAK_MCP_TIMEOUT_MS=<KEYCLOAK_MCP_TIMEOUT_MS> -e KEYCLOAK_MCP_LOG_LEVEL=<KEYCLOAK_MCP_LOG_LEVEL> -- npx -y [email protected]

claude_desktop_config.json

{
  "mcpServers": {
    "keycloak-model-context-protocol": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "KEYCLOAK_URL": "<KEYCLOAK_URL>",
        "KEYCLOAK_AUTH_REALM": "<KEYCLOAK_AUTH_REALM>",
        "KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
        "KEYCLOAK_CLIENT_SECRET": "<KEYCLOAK_CLIENT_SECRET>",
        "KEYCLOAK_USERNAME": "<KEYCLOAK_USERNAME>",
        "KEYCLOAK_PASSWORD": "<KEYCLOAK_PASSWORD>",
        "KEYCLOAK_GRANT_TYPE": "<KEYCLOAK_GRANT_TYPE>",
        "KEYCLOAK_MCP_READ_ONLY": "<KEYCLOAK_MCP_READ_ONLY>",
        "KEYCLOAK_MCP_REALMS": "<KEYCLOAK_MCP_REALMS>",
        "KEYCLOAK_MCP_ALLOW_MASTER_WRITE": "<KEYCLOAK_MCP_ALLOW_MASTER_WRITE>",
        "KEYCLOAK_MCP_TOOLSETS": "<KEYCLOAK_MCP_TOOLSETS>",
        "KEYCLOAK_MCP_REQUIRE_CONFIRMATION": "<KEYCLOAK_MCP_REQUIRE_CONFIRMATION>",
        "KEYCLOAK_MCP_TIMEOUT_MS": "<KEYCLOAK_MCP_TIMEOUT_MS>",
        "KEYCLOAK_MCP_LOG_LEVEL": "<KEYCLOAK_MCP_LOG_LEVEL>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "keycloak-model-context-protocol": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "KEYCLOAK_URL": "<KEYCLOAK_URL>",
        "KEYCLOAK_AUTH_REALM": "<KEYCLOAK_AUTH_REALM>",
        "KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
        "KEYCLOAK_CLIENT_SECRET": "<KEYCLOAK_CLIENT_SECRET>",
        "KEYCLOAK_USERNAME": "<KEYCLOAK_USERNAME>",
        "KEYCLOAK_PASSWORD": "<KEYCLOAK_PASSWORD>",
        "KEYCLOAK_GRANT_TYPE": "<KEYCLOAK_GRANT_TYPE>",
        "KEYCLOAK_MCP_READ_ONLY": "<KEYCLOAK_MCP_READ_ONLY>",
        "KEYCLOAK_MCP_REALMS": "<KEYCLOAK_MCP_REALMS>",
        "KEYCLOAK_MCP_ALLOW_MASTER_WRITE": "<KEYCLOAK_MCP_ALLOW_MASTER_WRITE>",
        "KEYCLOAK_MCP_TOOLSETS": "<KEYCLOAK_MCP_TOOLSETS>",
        "KEYCLOAK_MCP_REQUIRE_CONFIRMATION": "<KEYCLOAK_MCP_REQUIRE_CONFIRMATION>",
        "KEYCLOAK_MCP_TIMEOUT_MS": "<KEYCLOAK_MCP_TIMEOUT_MS>",
        "KEYCLOAK_MCP_LOG_LEVEL": "<KEYCLOAK_MCP_LOG_LEVEL>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "keycloak-model-context-protocol": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "KEYCLOAK_URL": "<KEYCLOAK_URL>",
        "KEYCLOAK_AUTH_REALM": "<KEYCLOAK_AUTH_REALM>",
        "KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
        "KEYCLOAK_CLIENT_SECRET": "<KEYCLOAK_CLIENT_SECRET>",
        "KEYCLOAK_USERNAME": "<KEYCLOAK_USERNAME>",
        "KEYCLOAK_PASSWORD": "<KEYCLOAK_PASSWORD>",
        "KEYCLOAK_GRANT_TYPE": "<KEYCLOAK_GRANT_TYPE>",
        "KEYCLOAK_MCP_READ_ONLY": "<KEYCLOAK_MCP_READ_ONLY>",
        "KEYCLOAK_MCP_REALMS": "<KEYCLOAK_MCP_REALMS>",
        "KEYCLOAK_MCP_ALLOW_MASTER_WRITE": "<KEYCLOAK_MCP_ALLOW_MASTER_WRITE>",
        "KEYCLOAK_MCP_TOOLSETS": "<KEYCLOAK_MCP_TOOLSETS>",
        "KEYCLOAK_MCP_REQUIRE_CONFIRMATION": "<KEYCLOAK_MCP_REQUIRE_CONFIRMATION>",
        "KEYCLOAK_MCP_TIMEOUT_MS": "<KEYCLOAK_MCP_TIMEOUT_MS>",
        "KEYCLOAK_MCP_LOG_LEVEL": "<KEYCLOAK_MCP_LOG_LEVEL>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`KEYCLOAK_URL` Required	Base URL of the Keycloak server, e.g. https://keycloak.example.com
`KEYCLOAK_AUTH_REALM` Optional	Realm used to obtain the admin token
`KEYCLOAK_CLIENT_ID` Optional	Client ID used for login (default admin-cli for the password grant, required for client_credentials)
`KEYCLOAK_CLIENT_SECRET` Optional, secret	Client secret for the client_credentials grant (recommended: a dedicated service account)
`KEYCLOAK_USERNAME` Optional	Username for the password grant (alternative to client credentials)
`KEYCLOAK_PASSWORD` Optional, secret	Password for the password grant
`KEYCLOAK_GRANT_TYPE` Optional	Grant type; auto-detected if unset (client_credentials when a secret is set, else password)
`KEYCLOAK_MCP_READ_ONLY` Optional	If true, only read-only tools are registered
`KEYCLOAK_MCP_REALMS` Optional	Comma-separated allowlist of target realms; empty means all realms
`KEYCLOAK_MCP_ALLOW_MASTER_WRITE` Optional	If true, write tools may modify the master realm
`KEYCLOAK_MCP_TOOLSETS` Optional	Comma-separated enabled toolsets (core, groups, roles, clients, sessions, events, security) or all
`KEYCLOAK_MCP_REQUIRE_CONFIRMATION` Optional	If true, destructive tools require confirm=true
`KEYCLOAK_MCP_TIMEOUT_MS` Optional	HTTP timeout for Keycloak requests in milliseconds
`KEYCLOAK_MCP_LOG_LEVEL` Optional	Log level written to stderr

Details

Package	`[email protected]` (NPM, stdio)
First published	26 Oct 2026
Last updated	26 Oct 2026
Registry name	`io.github.ChristophEnglisch/keycloak-model-context-protocol`

More ai and media servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Keycloak Model Context Protocol often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-christophenglisch-keycloak-model-context-protocol/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-christophenglisch-keycloak-model-context-protocol)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.