Unofficial: one tool per Keycloak admin operation on a realm, read-only unless writes are enabled
Connect Runs on your machine
claude mcp add keycloak-api-mcp -e KEYCLOAK_URL=<KEYCLOAK_URL> -e KEYCLOAK_REALM=<KEYCLOAK_REALM> -e KEYCLOAK_TOKEN=<KEYCLOAK_TOKEN> -e KEYCLOAK_CLIENT_ID=<KEYCLOAK_CLIENT_ID> -e KEYCLOAK_CLIENT_SECRET=<KEYCLOAK_CLIENT_SECRET> -e KEYCLOAK_TOKEN_REALM=<KEYCLOAK_TOKEN_REALM> -e KEYCLOAK_MCP_ALLOW_WRITES=<KEYCLOAK_MCP_ALLOW_WRITES> -e KEYCLOAK_MCP_RESOURCES=<KEYCLOAK_MCP_RESOURCES> -- npx -y [email protected]{
"mcpServers": {
"keycloak-api-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"KEYCLOAK_URL": "<KEYCLOAK_URL>",
"KEYCLOAK_REALM": "<KEYCLOAK_REALM>",
"KEYCLOAK_TOKEN": "<KEYCLOAK_TOKEN>",
"KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
"KEYCLOAK_CLIENT_SECRET": "<KEYCLOAK_CLIENT_SECRET>",
"KEYCLOAK_TOKEN_REALM": "<KEYCLOAK_TOKEN_REALM>",
"KEYCLOAK_MCP_ALLOW_WRITES": "<KEYCLOAK_MCP_ALLOW_WRITES>",
"KEYCLOAK_MCP_RESOURCES": "<KEYCLOAK_MCP_RESOURCES>"
}
}
}
}{
"mcpServers": {
"keycloak-api-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"KEYCLOAK_URL": "<KEYCLOAK_URL>",
"KEYCLOAK_REALM": "<KEYCLOAK_REALM>",
"KEYCLOAK_TOKEN": "<KEYCLOAK_TOKEN>",
"KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
"KEYCLOAK_CLIENT_SECRET": "<KEYCLOAK_CLIENT_SECRET>",
"KEYCLOAK_TOKEN_REALM": "<KEYCLOAK_TOKEN_REALM>",
"KEYCLOAK_MCP_ALLOW_WRITES": "<KEYCLOAK_MCP_ALLOW_WRITES>",
"KEYCLOAK_MCP_RESOURCES": "<KEYCLOAK_MCP_RESOURCES>"
}
}
}
}{
"servers": {
"keycloak-api-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"KEYCLOAK_URL": "<KEYCLOAK_URL>",
"KEYCLOAK_REALM": "<KEYCLOAK_REALM>",
"KEYCLOAK_TOKEN": "<KEYCLOAK_TOKEN>",
"KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
"KEYCLOAK_CLIENT_SECRET": "<KEYCLOAK_CLIENT_SECRET>",
"KEYCLOAK_TOKEN_REALM": "<KEYCLOAK_TOKEN_REALM>",
"KEYCLOAK_MCP_ALLOW_WRITES": "<KEYCLOAK_MCP_ALLOW_WRITES>",
"KEYCLOAK_MCP_RESOURCES": "<KEYCLOAK_MCP_RESOURCES>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
KEYCLOAK_URLRequired | Base URL of the server, such as https://keycloak.example.com |
KEYCLOAK_REALMRequired | Realm the tools act on |
KEYCLOAK_TOKENOptional, secret | A fixed access token; otherwise set KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET |
KEYCLOAK_CLIENT_IDOptional | A confidential client with a service account, for the client credentials grant |
KEYCLOAK_CLIENT_SECRETOptional, secret | Secret of that client |
KEYCLOAK_TOKEN_REALMOptional | Realm of that client, if not KEYCLOAK_REALM (for example master) |
KEYCLOAK_MCP_ALLOW_WRITESOptional | 1 to list the tools that change data |
KEYCLOAK_MCP_RESOURCESOptional | Comma separated resources to list tools for, such as users,groups,roles |
Details
| Package | [email protected] (NPM, stdio) |
| First published | 6 Nov 2026 |
| Last updated | 6 Nov 2026 |
| Registry name | io.github.sferarc/keycloak-api-mcp |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.