add-organization-member
Add a user to an organization
LABSCO SUMMARY
The credential is an administrator username and password, so the tool list is the only thing narrowing what a session can reach.
delete-realm sits in the same surface as list-users, and there is no scoped service account in the configuration to sit behind instead. What you get for that is unusual completeness: protocol mappers exist separately for clients and for client scopes, composite roles can be built and taken apart, groups nest through create-child-group, and identity providers arrive with their own mapper CRUD plus a tool that lists the mapper types a given provider actually supports. Roles are addressed by two names that do not overlap — by name through create-role and update-role, and by id through get-role-by-id, update-role-by-id and delete-role-by-id — so a script written against one will not find the other.
What it is
A Keycloak admin client covering 85 tools across realms, clients, users, groups, roles, client scopes, protocol mappers, organizations, identity providers and the session and event log.
What you get
- Realm-level work: list-realms, create-realm, update-realm, delete-realm and get-realm-settings.
- Users end to end — create-user, get-user, update-user, delete-user, list-users, search-users filtered by username, email and name, reset-user-password with a temporary flag, and logout-user to end every session a user holds.
- Roles at realm or client level plus hierarchies: create-composite-role, get-composite-roles and delete-composite-roles, find-users-with-role in the other direction, and assign-role-to-group / remove-role-from-group for group-level grants.
- Groups with structure and metadata: create-child-group, list-sub-groups, list-group-members, manage-user-groups for adding and removing users, and set-group-attributes / get-group-attributes.
- Clients and the token surface around them: create-client with redirectUris and a publicClient flag, client scopes through create-client-scope, get-client-scope and list-client-scopes, and protocol mappers on both clients and client scopes, each with create, list, update and delete.
- set-user-attributes, and get-user-attributes, which returns unmanaged attributes as well.
- Organizations inside a realm — create-organization, list-organizations with search and paging, get-organization, add-organization-member, remove-organization-member and list-organization-members.
- SSO federation: create-identity-provider with firstBrokerLoginFlowAlias, trustEmail and storeToken, import-identity-provider-from-url, list-identity-provider-mapper-types to discover what a provider supports, and create, update, list and delete for identity provider mappers.
- Sessions and audit: list-sessions for a realm or a client, get-user-sessions, list-events for authentication and admin events filtered by type, and clear-events.
Requirements
KEYCLOAK_URL for the instance, plus KEYCLOAK_ADMIN and KEYCLOAK_ADMIN_PASSWORD — an administrator account rather than a scoped service credential. realm is a parameter throughout, so the instance is addressed one realm at a time.
Setup effort
One command plus credentials — npx keycloak-mcp-server, then supply credentials
USE CASES
01
Onboarding a person into the groups and roles they need
The account, its first password, its group memberships and its role grants are separate calls, and the temporary flag on the password reset decides whether the user has to change it at first login.
02
Registering an application and shaping the tokens it receives
The client is created with its redirect URIs and whether it is public, then the claims it gets are decided by client scopes and protocol mappers rather than by the client record itself.
03
Wiring up sign-in through an external provider
The provider can be configured field by field or imported from a discovery URL, and the mapper types it supports can be listed before any mapping is written, so external claims are mapped to what actually exists.
04
Auditing who actually holds a privileged role
A role's membership can be read directly, and composite roles mean a user can hold it without ever having been granted it by name — so the hierarchy has to be read too, along with the group grants.
05
Chasing down a login that is failing
Authentication and admin events are readable by type, active sessions can be listed for a realm, a client or a single user, and a user's sessions can be ended outright once the cause is found.
06
Carving a realm's users into organizations
Organizations live inside a realm with their own membership and attributes, and user attributes carry the per-person metadata that the organization record does not.
85 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
assign-role-to-group
Assign a role to a group
assign-role-to-user
Assign a role to a user in a specific realm
clear-events
Clear event logs
create-child-group
Create a child group (subgroup)
create-client
Register a new client/application in a realm
create-client-scope
Create a new client scope (CRITICAL for managing token scopes)
create-client-scope-protocol-mapper
Create a protocol mapper for a client scope
create-composite-role
Create composite roles (role hierarchies)
create-group
Create user groups
create-identity-provider
Create a new identity provider for SSO integration
create-identity-provider-mapper
Create a mapper for identity provider (external user mapping)
create-organization
Create a new organization (CRITICAL for organization management)
create-protocol-mapper
Create a protocol mapper for a client (CRITICAL for JWT organization claims)
create-realm
Create a new realm with configurable settings
create-role
Create roles at realm or client level
create-user
Create a new user in a specific realm
delete-client
Remove a client from a realm
delete-client-scope
Delete a client scope
delete-client-scope-protocol-mapper
Delete a protocol mapper from a client scope
delete-composite-roles
Delete composite roles from a role
delete-group
Delete groups
delete-identity-provider
Delete an identity provider
delete-identity-provider-mapper
Delete an identity provider mapper
delete-organization
Delete an organization
delete-protocol-mapper
Delete a protocol mapper from a client
delete-realm
Delete an existing realm
delete-role
Delete roles
delete-role-by-id
Delete role by ID
delete-user
Delete a user from a specific realm
find-users-with-role
Find users with a specific role
get-client-scope
Get details of a specific client scope
get-composite-roles
Get composite roles for a role
get-group-attributes
Get group attributes
get-group-roles
Get roles assigned to a group
get-identity-provider
Get details of a specific identity provider
get-identity-provider-mapper
Get details of a specific identity provider mapper
get-organization
Get details of a specific organization
get-realm-settings
Retrieve detailed settings of a realm
get-role-by-id
Get role details by ID
get-user
Get user details by ID from a specific realm
get-user-attributes
Get user attributes including unmanaged attributes
get-user-roles
Get all roles assigned to a user in a specific realm
get-user-sessions
List active sessions for a user
import-identity-provider-from-url
Import identity provider configuration from URL
list-available-group-roles
List available roles for a group
list-client-scope-protocol-mappers
List protocol mappers for a client scope
list-client-scopes
List all client scopes in a realm
list-clients
List all clients in a realm
list-composite-group-roles
List composite roles for a group
list-events
Retrieve authentication and admin events
list-group-members
List members of a group
list-groups
List all groups in a realm
list-identity-provider-mapper-types
List available mapper types for an identity provider
list-identity-provider-mappers
List all mappers for an identity provider
list-identity-providers
List all identity providers in a realm
list-organization-members
List all members of an organization
list-organizations
List all organizations in a realm
list-protocol-mappers
List protocol mappers for a client
list-realms
List all available realms
list-roles
List all roles in a specific realm
list-sessions
List all active sessions in a realm
list-sub-groups
List subgroups of a parent group
list-users
List users in a specific realm
logout-user
Logout all sessions for a specific user
manage-user-groups
Add or remove users from groups
remove-organization-member
Remove a user from an organization
remove-role-from-group
Remove a role from a group
remove-role-from-user
Remove a role from a user in a specific realm
reset-user-password
Reset a user's password in a specific realm
search-users
Search users in a specific realm with filters
set-group-attributes
Set group attributes (organization metadata)
set-user-attributes
Set user attributes (CRITICAL for storing organization data)
update-client
Update client settings (redirect URIs, protocol mappers, etc.)
update-client-scope
Update an existing client scope
update-client-scope-protocol-mapper
Update a protocol mapper for a client scope
update-group
Update group attributes
update-identity-provider
Update an existing identity provider
update-identity-provider-mapper
Update an identity provider mapper
update-organization
Update an existing organization
update-protocol-mapper
Update a protocol mapper for a client
update-realm
Update realm settings and configurations
update-role
Modify role attributes
update-role-by-id
Update role by ID
update-user
Update user information in a specific realm
BEFORE YOU INSTALL
What to know first
Tools you get
85 tools when we connected. The documentation names 80; the five identity-provider mapper tools, such as get-identity-provider-mapper and import-identity-provider-from-url, are undocumented.
Requires
- Node.js 18 or higher
- A running Keycloak instance (local or remote): KEYCLOAK_URL
- Keycloak admin credentials with appropriate permissions: KEYCLOAK_ADMIN and KEYCLOAK_ADMIN_PASSWORD
Where it runs
Both documented clients run the server on your machine.
CONTEXT COST
Moderate Standing cost
Rated by the size of the 85 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx keycloak-mcp-serverMCP Clients
Cursor, Claude Desktop
JSON
{
"mcpServers": {
"keycloak": {
"command": "npx",
"args": [
"keycloak-mcp-server"
],
"env": {
"KEYCLOAK_URL": "<YOUR_KEYCLOAK_URL>",
"KEYCLOAK_ADMIN": "<YOUR_KEYCLOAK_ADMIN>",
"KEYCLOAK_ADMIN_PASSWORD": "<YOUR_KEYCLOAK_ADMIN_PASSWORD>"
}
}
}
}
