MCP server for KeyCloak Admin REST API via Service Account
{
"mcpServers": {
"keycloak-mcp": {
"env": {
"KEYCLOAK_URL": "https://sso.example.com",
"KEYCLOAK_CLIENT_ID": "keycloak-mcp",
"KEYCLOAK_CLIENT_SECRET": ""
},
"type": "stdio",
"command": "keycloak-mcp"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
MCP (Model Context Protocol) server for KeyCloak Admin REST API.
Is it safe?
No known CVEs for keycloak-mcp.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 0 days ago.
Will it work with my client?
Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
Context cost
21 tools. Consider loading selectively.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'keycloak-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
No known vulnerabilities.
count_usersGet total user count in the realm
search_usersSearch users by username, email, or name
get_userGet detailed user information by username
reset_passwordReset a user's password
reset_passwords_batchReset passwords for multiple users from CSV
get_user_sessionsGet active sessions for a user (local time)
logout_userForce logout a user by removing all sessions
list_user_groupsList groups a user belongs to
list_users_by_groupList all members of a group
get_brute_force_statusCheck if a user is locked by brute force detection
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
An open-source AI agent that brings the power of Gemini directly into your terminal.
XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
The full-stack TypeScript framework to build, test, and deploy production-ready MCP servers and AI-native apps.
Open-source persistent memory for AI agent pipelines (LangGraph, CrewAI, AutoGen) and Claude. REST API + knowledge graph + autonomous consolidation.
MCP Security Weekly
Get CVE alerts and security updates for io.github.shigechika/keycloak-mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
English | 日本語
MCP (Model Context Protocol) server for KeyCloak Admin REST API.
Uses Client Credentials Grant (Service Account) — no user password or TOTP required. Infinispan-safe: does not create user sessions or use the userinfo endpoint.
| Tool | Description |
|---|---|
count_users | Get total user count in the realm |
search_users | Search users by username, email, or name |
get_user | Get detailed user information by username |
reset_password | Reset a user's password |
reset_passwords_batch | Reset passwords for multiple users from CSV |
get_user_sessions | Get active sessions for a user (local time) |
logout_user | Force logout a user by removing all sessions |
| Tool | Description |
|---|---|
list_user_groups | List groups a user belongs to |
list_users_by_group | List all members of a group |
| Tool | Description |
|---|---|
get_brute_force_status | Check if a user is locked by brute force detection |
get_login_failures_by_ip | Login failure statistics by source IP (with site labels) |
detect_login_loops | Detect users with rapid repeated logins (redirect loop detection) |
| Tool | Description |
|---|---|
get_events | Get events with filters (type, username, client, IP, date). Resolves username to user ID automatically |
get_login_stats | Login success/failure statistics with full pagination |
get_login_stats_by_hour | Login statistics by hour (local time) |
get_login_stats_by_client | Login statistics by client (SP) |
get_password_update_events | Password update event history |
| Tool | Description |
|---|---|
get_session_stats | Active session count per client |
get_client_sessions | Active sessions for a specific client |
list_clients | List all SAML/OIDC clients |
get_realm_roles | List all realm-level roles |
# uv
uv pip install keycloak-mcp
# pip
pip install keycloak-mcp
Or from source:
git clone https://github.com/shigechika/keycloak-mcp.git
cd keycloak-mcp
# uv
uv sync
# pip
pip install -e .
Set the following environment variables:
| Variable | Description | Default |
|---|---|---|
KEYCLOAK_URL | KeyCloak base URL (e.g., https://sso.example.com) | required |
KEYCLOAK_REALM | Realm name | master |
KEYCLOAK_CLIENT_ID | Service Account client ID | required |
KEYCLOAK_CLIENT_SECRET | Client secret | required |
KEYCLOAK_SITES_INI | Path to INI file for IP-to-site classification (optional) | — |
view-users, view-events, view-clients, manage-users (for password reset)Add to .mcp.json:
{
"mcpServers": {
"keycloak-mcp": {
"type": "stdio",
"command": "keycloak-mcp",
"env": {
"KEYCLOAK_URL": "https://sso.example.com",
"KEYCLOAK_CLIENT_ID": "keycloak-mcp",
"KEYCLOAK_CLIENT_SECRET": ""
}
}
}
}
Add to claude_desktop_config.json:
{
"mcpServers": {
"keycloak-mcp": {
"command": "keycloak-mcp",
"env": {
"KEYCLOAK_URL": "https://sso.example.com",
"KEYCLOAK_CLIENT_ID": "keycloak-mcp",
"KEYCLOAK_CLIENT_SECRET": ""
}
}
}
}
export KEYCLOAK_URL=https://sso.example.com
export KEYCLOAK_CLIENT_ID=keycloak-mcp
export KEYCLOAK_CLIENT_SECRET=your-secret
keycloak-mcp
git clone https://github.com/shigechika/keycloak-mcp.git
cd keycloak-mcp
#
... [View full README on GitHub](https://github.com/shigechika/keycloak-mcp#readme)