delete-realm sits in the same surface as list-users, and there is no scoped service account in the configuration to sit behind instead. What you get for that is unusual completeness: protocol mappers exist separately for clients and for client scopes, composite roles can be built and taken apart, groups nest through create-child-group, and identity providers arrive with their own mapper CRUD plus a tool that lists the mapper types a given provider actually supports. Roles are addressed by two names that do not overlap — by name through create-role and update-role, and by id through get-role-by-id, update-role-by-id and delete-role-by-id — so a script written against one will not find the other.
A Keycloak admin client covering 85 tools across realms, clients, users, groups, roles, client scopes, protocol mappers, organizations, identity providers and the session and event log.
- Realm-level work: list-realms, create-realm, update-realm, delete-realm and get-realm-settings.
- Users end to end — create-user, get-user, update-user, delete-user, list-users, search-users filtered by username, email and name, reset-user-password with a temporary flag, and logout-user to end every session a user holds.
- Roles at realm or client level plus hierarchies: create-composite-role, get-composite-roles and delete-composite-roles, find-users-with-role in the other direction, and assign-role-to-group / remove-role-from-group for group-level grants.
- Groups with structure and metadata: create-child-group, list-sub-groups, list-group-members, manage-user-groups for adding and removing users, and set-group-attributes / get-group-attributes.
- Clients and the token surface around them: create-client with redirectUris and a publicClient flag, client scopes through create-client-scope, get-client-scope and list-client-scopes, and protocol mappers on both clients and client scopes, each with create, list, update and delete.
- set-user-attributes, and get-user-attributes, which returns unmanaged attributes as well.
- Organizations inside a realm — create-organization, list-organizations with search and paging, get-organization, add-organization-member, remove-organization-member and list-organization-members.
- SSO federation: create-identity-provider with firstBrokerLoginFlowAlias, trustEmail and storeToken, import-identity-provider-from-url, list-identity-provider-mapper-types to discover what a provider supports, and create, update, list and delete for identity provider mappers.
- Sessions and audit: list-sessions for a realm or a client, get-user-sessions, list-events for authentication and admin events filtered by type, and clear-events.
KEYCLOAK_URL for the instance, plus KEYCLOAK_ADMIN and KEYCLOAK_ADMIN_PASSWORD — an administrator account rather than a scoped service credential. realm is a parameter throughout, so the instance is addressed one realm at a time.
One command plus a key — npx keycloak-mcp-server, then supply credentials