This MCP server provides an interface for managing users, groups, and security monitoring for KeyCloak's Admin REST API using Client Credentials Grant without requiring user passwords.
From the registry: MCP server for KeyCloak Admin REST API via Service Account
$ pip install keycloak-mcpPlease install the `keycloak-mcp` MCP server into my current AI client (that's you).
Required prerequisites (do these first if not already done):
- **Install package** — Install the keycloak-mcp Python package Run: `pip install keycloak-mcp`
- **KeyCloak client setup** — Create a client in KeyCloak Admin Console with Client Authentication and Service Account Roles enabled; assign realm roles view-users, view-events, view-clients, manage-users
Canonical MCP server config (stdio transport):
- command: `keycloak-mcp`
- args: []
- required environment variables:
- `KEYCLOAK_URL`: KeyCloak base URL (example: `https://sso.example.com`)
- `KEYCLOAK_CLIENT_ID`: Service Account client ID (example: `keycloak-mcp`)
- `KEYCLOAK_CLIENT_SECRET`: Client secret (example: `<your-api-key>`)
- optional environment variables:
- `KEYCLOAK_REALM`: Realm name (example: `master`)
- `KEYCLOAK_SITES_INI`: Path to INI file for IP-to-site classification
Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.KEYCLOAK_URLrequiredKeyCloak base URL (e.g., `https://sso.example.com`)KEYCLOAK_CLIENT_IDrequiredService Account client IDKEYCLOAK_CLIENT_SECRETrequiredClient secretDead code, security, secrets detection and code quality for Python, TypeScript, Go.