Keycloak MCP Server
Keycloak user, realm, and group management via a standardized MCP interface.
Data last scanned today · Reviewed today
Overview
The Keycloak MCP Server facilitates interaction with your Keycloak instances, leveraging the official Keycloak Admin Client. It provides a structured set of tools to perform administrative tasks, such as listing realms, clients, and groups within a specific environment. Beyond basic retrieval, the server supports user management operations. You can programmatically create or delete users, add users to groups, and assign specific client roles through your AI agent, streamlining identity configuration workflows.
Our verdict
This server carries a high risk level with a security score of 32/100. Most critically, the implementation lacks a read-only mode, meaning every installation grants full write access to your Keycloak instance. Due to its status as a community-maintained project that has not undergone editorial review and has been inactive for over eight months, it is best suited for isolated testing environments rather than production identity infrastructure.
- Uses official Keycloak Admin Client for API interactions
- Small footprint with only five direct dependencies
- Open source project under the MIT license
- No read-only mode available for safer access
- Community-maintained with no official vendor support
- Inactivity evidenced by last commit over 243 days ago
Setup
{
"mcpServers": {
"keycloak-mcp": {
"args": [
"-y",
"keycloak-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| create-user | Creates a new user in a specified realm. | medium |
| delete-user | Deletes a user from a specified realm. | high |
| list-realms | Lists all available realms. | low |
| list-users | Lists all users in a specified realm. | low |
| list-clients | Lists all clients in a specified realm. | low |
| list-groups | Lists all groups in a specified realm. | low |
| list-client-roles | Lists all roles for a specific client in a realm. | low |
| assign-client-role-to-user | Assigns a client role to a specific user. | medium |
| add-user-to-group | Adds a user to a specific group. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the core prerequisites to run this MCP server?
You need a running Keycloak instance, Node.js, and npm installed on your machine.
›How can I configure the server connection details?
You can provide configuration via command-line arguments like --keycloak-url, --keycloak-admin, and --keycloak-admin-password, or by setting corresponding environment variables.
›Do command-line arguments take precedence over environment variables?
Yes, command-line arguments override any environment variables set for the server configuration.
›Can I install this server directly for Claude Desktop?
Yes, you can use the Smithery CLI command npx -y @smithery/cli install @HaithamOumerzoug/keycloak-mcp --client claude to automate the installation.
›Does this server use a specific library to interact with Keycloak?
Yes, it utilizes the official Keycloak Admin Client to perform operations and communicate with the Keycloak API.
Badge
Maintain this server? Add the live badge to your README.