list_realmsLABSCO SUMMARY
Complete coverage, which is exactly why the role you give it matters.
There is no partial surface here and no read-only mode: every admin endpoint is registered, so the only thing standing between an assistant and a deleted realm is the Keycloak role attached to the credential you configured. The author says this plainly and gives the specific roles to grant instead of admin. Treat the credential as the permission model, because it is.
What it is
An MCP server that exposes the complete Keycloak Admin REST API as typed tools. Each tool is self-describing with a full input schema, authentication is handled internally with automatic token refresh, and both stdio and SSE transports are supported.
What you get
- The README counts 299 tools covering every Keycloak Admin REST API endpoint, grouped by the API's own categories — Users (30), Clients (33), Roles (28), Scope Mappings (29), Authentication Management (38), Realms Admin (37), Identity Providers (15), Protocol Mappers (14), Organizations (13), Groups (11), Client Scopes (10), Client Role Mappings (10), Roles by ID (10), Client Certificates (6), Components (6), Attack Detection (3), Client Initial Access (3), Client Registration Policy (1) and Keys (2)
- Named operations rather than a generic REST caller, each with its own schema — the README names five of them:
list_realms,create_user,list_clients,get_user_role_mappingsandadd_group_realm_role_mappings - Two authentication flows with automatic token refresh: password, or client credentials via a service account
- Dual transport — stdio for Claude Code, or SSE on a port you choose for GitHub Copilot and other clients
Requirements
A Keycloak instance and an admin-capable credential. KEYCLOAK_URL is required. Then either password auth with KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD, or client credentials with KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET; KEYCLOAK_ADMIN_REALM (default master) and KEYCLOAK_VERIFY_SSL (default true) are optional. Python 3.11 or newer. Install it from the git URL with pip, or uv pip install -e . from a clone. The author's own security warning applies: all 299 tools are registered, including sensitive writes like creating and deleting users, resetting passwords and managing realms, so do not point it at master-realm super-admin credentials in production. Use a service account, scope KEYCLOAK_ADMIN_REALM to the exact realm the assistant should manage, grant only the minimum roles — view-users, view-clients or view-realm for read-only work, manage-users for user management — and keep SSL verification on. MIT licensed.
Setup effort
Follow the published steps — pip install git+https://github.com/paoloamato2/keycloak-mcp-server.git
USE CASES
01
Answering identity questions without opening the admin console
List realms and clients, and read a user's role mappings, using named tools rather than hand-built REST calls.
02
Onboarding a user into the right groups
Create the user, then attach the realm roles to the group they belong to.
03
Giving an assistant read-only identity access
Use a service account whose Keycloak roles are limited to the view permissions, since the tool surface itself is not restrictable.
04
Connecting from a client without stdio
Start it with SSE transport on a port and point GitHub Copilot or another SSE client at the endpoint.
5 tools
Listed in project docs. Your client may show a different list.
create_userlist_clientsget_user_role_mappingsadd_group_realm_role_mappingsBEFORE YOU INSTALL
What to know first
Tools you get
The project says 299; its docs name 5.
Requires
- python on PATH
- Python 3.11 or newer
- KEYCLOAK_URL in your environment
- KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD, or KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET, in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
pip install git+https://github.com/paoloamato2/keycloak-mcp-server.gitMCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"keycloak": {
"command": "python",
"args": [
"-m",
"keycloak_mcp_server"
],
"env": {
"KEYCLOAK_URL": "http://localhost:8080",
"KEYCLOAK_ADMIN_USERNAME": "admin",
"KEYCLOAK_ADMIN_PASSWORD": "admin"
}
}
}
}The configuration on this page does not set KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET; the project's instructions set them with an export line. An app opened from its icon or dock does not see variables exported in a terminal, so to supply them, use the block's "env" section.
Claude Code — uv
Clone the project and install it
CLAUDE CODE — UV · TERMINAL
git clone https://github.com/paoloamato2/keycloak-mcp-server.git
cd keycloak-mcp-server
uv pip install -e .Add this to your Claude Code MCP configuration
<YOUR_PATH_TO_KEYCLOAK_MCP_SERVER> is the folder the clone created.
CLAUDE CODE — UV · JSON
{
"mcpServers": {
"keycloak": {
"command": "uv",
"args": [
"run",
"--directory",
"<YOUR_PATH_TO_KEYCLOAK_MCP_SERVER>",
"python",
"-m",
"keycloak_mcp_server"
],
"env": {
"KEYCLOAK_URL": "http://localhost:8080",
"KEYCLOAK_ADMIN_USERNAME": "admin",
"KEYCLOAK_ADMIN_PASSWORD": "admin"
}
}
}
}The configuration on this page does not set KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET; the project's instructions set them with an export line. An app opened from its icon or dock does not see variables exported in a terminal, so to supply them, use the block's "env" section.
