Mcpkeycloakspi MCP Server
Keycloak identity event synchronization for Maritime Connectivity Platform identity brokers.
Data last scanned today · Reviewed today
Overview
This MCP server provides a specialized Keycloak Event Listener SPI designed to synchronize user data within the Maritime Connectivity Platform (MCP) Identity Registry. By capturing login events, the server facilitates communication between the identity broker and the registry API to ensure consistent user information across the identity ecosystem. Installation requires placing the JAR file directly into the Keycloak providers directory and configuring environment variables. These settings include paths for keystores and truststores used to secure REST communication between the identity provider and the API.
Our verdict
This server carries a high risk level with a security score of 38/100. It is a community-maintained project rather than an official vendor release and currently lacks OAuth support. Due to the requirement of handling sensitive keystore credentials and direct API integration, this tool is best suited for experienced developers working within trusted maritime infrastructure environments who can verify the implementation independently.
- Zero direct dependencies minimize the supply-chain attack surface.
- Utilizes Apache-2.0 open source licensing.
- Actively maintained repository with recent commits.
- Lacks OAuth support for authorization management.
- Community-maintained status implies absence of official vendor support.
- High risk profile due to custom keystore credential handling.
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›How do I install the MCP Keycloak SPI?
You must place the mcp-identityregistry-keycloak-spi-latest-jar-with-dependencies.jar file directly into the providers/ folder of your Keycloak installation.
›How is the Event Listener enabled after installation?
After placing the JAR file, you must navigate to the Keycloak admin console, select Events from the side menu, go to the Config tab, and add mcp-event-listener to the Event Listeners list before saving.
›What is the function of the truststore configuration?
The truststore configuration is used to hold the trusted certificate of the Identity Registry API and is primarily intended for test environments using self-signed certificates.
›Can I prevent specific identity providers from synchronizing?
Yes, you can configure the KC_SPI_EVENTS_LISTENER_MCP_EVENT_LISTENER_IDP_NOT_TO_SYNC environment variable with a comma-separated list of providers to exclude from synchronization.
›How is the X.509 certificate authenticator configured?
You must set up an authentication flow in Keycloak with a single step, setting the type to Certificates and the requirement to Required.
›What is the default HTTP header for client certificates?
The default HTTP header used by the reverse proxy to pass the client certificate is X-Client-Certificate, which can be modified via the KC_SPI_AUTHENTICATOR_CERTIFICATE_CLIENT_CERT_HEADER variable.
Badge
Maintain this server? Add the live badge to your README.