Overview

The Keycloak MCP (Model Context Protocol) Server is a developer-focused management layer for Keycloak that exposes more than 40 discrete tools to automate and operate identity and access resources. It centralizes common administrative tasks—realms, users, clients, roles, groups, identity providers and authentication flows—so teams can script, integrate, or run them from CI/CD pipelines instead of using the web admin console interactively.

It is particularly useful when you need repeatable provisioning, bulk operations, or programmatic control of Keycloak in multi-tenant or automated environments. The server can be run as a JVM application, via Docker, or built as a native binary for lower startup time and memory usage. This makes it suitable both for local automation tasks and for integration into production automation tooling.

Features

40+ focused management tools for Keycloak resources (users, realms, clients, roles, groups, etc.)
REST API to run structured operations and scripts against Keycloak
Commandable operations for automation and CI/CD
Support for native builds for faster startup and lower memory footprint
Docker-friendly packaging for containerized environments
Extensible: add or compose tools to build higher-level automation
Designed for scripted bulk changes and safe repeatable actions

Installation / Configuration

Clone the repository and build locally, run from a packaged JAR, or use Docker. Native builds are supported if you want a GraalVM/Quarkus native executable (see repository for build profiles).

Clone and build (example with Maven):

git clone https://github.com/sshaaf/keycloak-mcp-server.git
cd keycloak-mcp-server

# If the project uses Maven
mvn clean package

# Run the packaged jar
java -jar target/keycloak-mcp-server-*.jar

Run with Docker (example):

# Build image locally (if a Dockerfile is included)
docker build -t keycloak-mcp-server .

# Run container
docker run -d -p 8080:8080 \
  -e KEYCLOAK_BASE_URL=http://keycloak:8080 \
  -e KEYCLOAK_ADMIN=username \
  -e KEYCLOAK_ADMIN_PASSWORD=secret \
  keycloak-mcp-server

Native build (GraalVM / Quarkus profile — repository must include native profile):

# Example Maven native profile
mvn -Pnative -Dnative-image.docker-build=true package

# Run produced native binary
./target/keycloak-mcp-server-*-runner

Typical configuration values you will provide (environment variables or application config):

KEYCLOAK_BASE_URL: URL of the Keycloak administration API
KEYCLOAK_ADMIN / KEYCLOAK_ADMIN_PASSWORD: credentials for an administrative account
SERVER_PORT: local port for MCP server to listen on
TLS_CERT / TLS_KEY: optional TLS if you want HTTPS on the MCP endpoint

Refer to the repository README or config files for exact property names and additional configuration options.

Available Tools

The server groups its functionality into many focused tools you can invoke individually or compose into scripts. Common categories include:

Category	Examples
Realms	create, update, import, export, delete
Users	create, update, disable, bulk-import, password-reset
Clients	create, configure mappers, rotate secrets
Roles	create realm/client roles, assign/remove roles
Groups	create groups, manage memberships
Identity Providers (IDPs)	configure OIDC/SAML IDPs, mappers
Authentication	flows, bindings, executions
Tokens & Sessions	revoke, introspect, session cleanup
Events & Auditing	query events, export logs
Utilities	backup/restore, importers, exporters

The project exposes these tools via the MCP server API so you can call them with HTTP requests, or incorporate them into your automation.

Use Cases

Provisioning new tenants: In a multi-tenant setup you can script realm creation, client provisioning, and standard role/group templates to onboard a tenant in one automated job.
- Example: CI job calls MCP endpoints to create the realm, add a standard admin user, register clients, and seed roles.
Bulk user operations: Perform CSV-driven user creation, password resets, or attribute updates across multiple realms in a single run rather than manual admin-console steps.
- Example: A scheduled job reads an HR CSV and calls the users tool to create or update employees.
Client secret rotation: Automate client credential rotation for many clients, update deployments, and enforce policy across a fleet of clients.
- Example: Script rotates secrets for all clients matching a tag and updates related configuration in downstream systems.
Environment promotion and configuration-as-code: Export a realm configuration from staging and import it into production with deterministic, repeatable operations.
- Example: Export/import tool sequence in a pipeline to synchronize realm clients and mappers.
Integrations and CI/CD: Integrate Keycloak provisioning steps into application delivery pipelines so environments are ready when deployments occur.
- Example: Application build pipeline triggers MCP operations to ensure required OAuth clients exist before deployment.

Getting Help

Check the repository README and configuration examples for exact environment variable names and API contract.
Open issues or pull requests on the project GitHub for bug reports, feature requests, or questions: https://github.com/sshaaf/keycloak-mcp-server

This server is intended as an automation and tooling layer on top of Keycloak—use it to make admin operations repeatable, scriptable, and safe in automated workflows.

Keycloak MCP Server Identity Access Management