mcpField
K
Keycloak MCP Server

Keycloak MCP Server

Local
shaaf.devSecurity48Updated 10w ago
RepositoryVisit website

About Keycloak MCP Server

Keycloak MCP Server is an MCP server that gives programmatic access to Keycloak administration for identity and access management. It is intended for teams that want AI assistants or development tools to work with Keycloak. The server authenticates users with their own JWT tokens and offers native image builds.

Key features

  1. 01User JWT token authentication
  2. 02Management of users, realms, clients, roles and groups
  3. 03SSE transport for HTTP-based communication
  4. 04Pre-built container images on Quay.io
  5. 05GraalVM native image support

Use cases

  1. 01Managing Keycloak users and roles from an AI assistant
  2. 02Deploying the management service on OpenShift or Kubernetes
  3. 03Configuring Keycloak administration from development tools

MCP support

This project is an MCP server that exposes Keycloak administration to MCP clients, which connect over SSE with a Bearer token in the request headers.

#java#keycloak#quarkus#mcp-server

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "keycloak": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "\\"
      ]
    }
  }
}
Run commanddocker run -i --rm '\'

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
oci\

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Project Logo

An MCP Server for Keycloak

Keycloak MCP Server

A Model Context Protocol (MCP) server that provides programmatic access to Keycloak administration functionality.

Overview

The Keycloak MCP Server enables AI assistants and development tools to interact with Keycloak through the Model Context Protocol. It supports comprehensive Keycloak operations including user management, realm configuration, client administration, and authentication flow management.

Key Features

  • User JWT Token Authentication
  • Comprehensive Keycloak Operations (users, realms, clients, roles, groups, etc.)
  • SSE Transport for HTTP-based communication
  • Production-ready OpenShift/Kubernetes deployment
  • Multi-architecture container images
  • GraalVM native image support

Quick Start

Using Docker
docker run -d \
  --name keycloak-mcp-server \
  -p 8080:8080 \
  -e KC_URL=https://keycloak.example.com \
  -e KC_REALM=master \
  -e OIDC_CLIENT_ID=mcp-server \
  quay.io/sshaaf/keycloak-mcp-server:latest
Authentication

Users authenticate with their own JWT tokens from Keycloak:

# Get your token
./scripts/get-mcp-token.sh \
  --keycloak-url https://keycloak.example.com \
  --username your-username \
  --password your-password

Configure in your MCP client (~/.cursor/mcp.json):

{
  "mcpServers": {
    "keycloak": {
      "transport": "sse",
      "url": "https://mcp-server.example.com/mcp/sse",
      "headers": {
        "Authorization": "Bearer <your-jwt-token>"
      }
    }
  }
}

Documentation

Complete documentation is available in the docs directory:

Building Documentation

This project uses MkDocs for documentation. To build and serve locally:

pip install mkdocs-material
mkdocs serve

Visit http://localhost:8000 to view the documentation.

Container Images

Pre-built images are available on Quay.io:

docker pull quay.io/sshaaf/keycloak-mcp-server:latest

Images are automatically built and pushed on commits to main and on releases.

Building

JAR
mvn clean package
java -jar target/quarkus-app/quarkus-run.jar
Native Image
mvn clean package -Pnative
./target/keycloak-mcp-server-runner
Container Image
mvn clean package -Dquarkus.container-image.build=true
Tests
  • Default unit and integration tests: mvn test
  • Prompt / eval coverage notes: evals/README.md

Technology Stack

  • Quarkus - Cloud-native Java framework
  • Keycloak Admin Client - Official Keycloak Java client
  • MCP Protocol - Model Context Protocol for AI integration
  • Jib - Containerization without Docker daemon
  • GraalVM - Native image compilation support

License

MIT License - see LICENSE file for details.

Contributing

Contributions are welcome. See Contributors Guide for details.

Support

Maintainer: Shaaf Syed
Repository: https://github.com/sshaaf/keycloak-mcp-server
Container Registry: https://quay.io/repository/sshaaf/keycloak-mcp-server

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.