This server gives agent tools programmatic access to Keycloak through MCP. It supports user management, realm settings, client administration, roles, groups, identity providers, and authentication workflows, with JWT-based access and SSE transport.
Builders who want their agent to talk to Keycloak for identity and access management tasks.
You can manage Keycloak from your agent instead of switching to the admin console for routine identity tasks.
Provides programmatic access to users, realms, clients, roles, groups, identity providers, and authentication flows.
Uses each user’s Keycloak JWT token for access to the MCP server.
Serves MCP over HTTP using SSE transport for MCP clients.
Includes OpenShift and Docker Compose deployment assets for running the server in real environments.
Supports GraalVM native builds and multi-architecture container images.
docker run -d \ --name keycloak-mcp-server \ -p 8080:8080 \ -e KC_URL=https://keycloak.example.com \ -e KC_REALM=master \ -e OIDC_CLIENT_ID=mcp-server \ quay.io/sshaaf/keycloak-mcp-server:latest
# Get your token ./scripts/get-mcp-token.sh \ --keycloak-url https://keycloak.example.com \ --username your-username \ --password your-password
A Model Context Protocol (MCP) server that provides programmatic access to Keycloak administration functionality.
The Keycloak MCP Server enables AI assistants and development tools to interact with Keycloak through the Model Context Protocol. It supports comprehensive Keycloak operations including user management, realm configuration, client administration, and authentication flow management.
docker run -d \
--name keycloak-mcp-server \
-p 8080:8080 \
-e KC_URL=https://keycloak.example.com \
-e KC_REALM=master \
-e OIDC_CLIENT_ID=mcp-server \
quay.io/sshaaf/keycloak-mcp-server:latest
Users authenticate with their own JWT tokens from Keycloak:
# Get your token
./scripts/get-mcp-token.sh \
--keycloak-url https://keycloak.example.com \
--username your-username \
--password your-password
Configure in your MCP client (~/.cursor/mcp.json):
{
"mcpServers": {
"keycloak": {
"transport": "sse",
"url": "https://mcp-server.example.com/mcp/sse",
"headers": {
"Authorization": "Bearer <your-jwt-token>"
}
}
}
}
Complete documentation is available in the docs directory:
This project uses MkDocs for documentation. To build and serve locally:
pip install mkdocs-material
mkdocs serve
Visit http://localhost:8000 to view the documentation.
Pre-built images are available on Quay.io:
docker pull quay.io/sshaaf/keycloak-mcp-server:latest
Images are automatically built and pushed on commits to main and on releases.
mvn clean package
java -jar target/quarkus-app/quarkus-run.jar
mvn clean package -Pnative
./target/keycloak-mcp-server-runner
mvn clean package -Dquarkus.container-image.build=true
mvn testMIT License - see LICENSE file for details.
Contributions are welcome. See Contributors Guide for details.
Maintainer: Shaaf Syed
Repository: https://github.com/sshaaf/keycloak-mcp-server
Container Registry: https://quay.io/repository/sshaaf/keycloak-mcp-server
Sign in to join the discussion.
No comments yet. Be the first to say what this is good for.
High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 158 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.
Universal provider proxy for OpenAI Codex & Claude Code — use any LLM (Claude, Gemini, Grok, DeepSeek, Ollama…) with Codex CLI, App, SDK, and Claude Code
Git-native persistent memory for AI coding agents. Implements Google OKF v0.2 with sub-300µs in-memory BM25 search, embedded MCP server, and progressive disclosure. Slashes token bloat by 80% with zero external databases or dependencies. Built in pure Go.
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
20 MB lightweight cross-platform database client for 90+ databases, including MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, and Dameng. Built-in AI, MCP Server, CLI, desktop and Docker. | 轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 90+ 数据库，提供桌面端、Docker、CLI、内置 AI 助手和 MCP Server。