Manage Keycloak Programmatically

Keycloak MCP Server is an MCP server that gives an AI assistant or dev tool programmatic access to Keycloak's admin API - managing users, realms, clients, roles, and groups, and driving authentication-flow configuration - built on Quarkus with the official Keycloak Admin Client.

Use it when you want an AI assistant to manage a Keycloak identity server directly - create or inspect users, adjust realm or client settings, work with roles and groups - rather than through Keycloak's own admin console. Each caller authenticates with their own JWT token issued by Keycloak, so the server enforces the same permissions that token already carries rather than a shared service account; it's built for production deployment on OpenShift/Kubernetes with multi-architecture images and a GraalVM native image option. It is not a fit if you need something other than Keycloak identity administration - it's scoped entirely to that admin surface.

The server communicates over SSE transport for HTTP-based MCP clients, and covers the standard Keycloak admin operations: user, realm, client, role, and group management. Per-user JWT authentication means access is governed by Keycloak's own permission model rather than a broad admin credential shared across every caller, so an assistant acting on behalf of a limited-privilege user cannot silently do more than that user could do through the admin console itself.

docker run -d \
  --name keycloak-mcp-server \
  -p 8080:8080 \
  -e KC_URL=https://keycloak.example.com \
  -e KC_REALM=master \
  -e OIDC_CLIENT_ID=mcp-server \
  quay.io/sshaaf/keycloak-mcp-server:latest

Get a personal JWT with the bundled get-mcp-token.sh script, then point an MCP client at the server over SSE with that token as a Bearer header, for example in Cursor's ~/.cursor/mcp.json. It can also be built as a JAR (mvn clean package), a GraalVM native image (mvn clean package -Pnative), or a container image via Jib without a Docker daemon; pre-built multi-arch images are published to Quay.io on every commit to main and on releases. Documentation covers getting started, authentication, and OpenShift deployment, and the project tracks separate prompt/eval coverage notes alongside its standard mvn test suite. It is MIT-licensed, maintained by Shaaf Syed, and support runs through GitHub Issues and the Keycloak Discourse community rather than a dedicated channel.

Platform and identity teams running Keycloak who want an AI assistant to manage users, realms, and clients through the same Keycloak permission model each user already has, rather than a shared admin credential.