Manage Keycloak Programmatically

Gives AI assistants and development tools programmatic access to Keycloak administration through the Model Context Protocol, covering user management, realm configuration, client administration, and authentication flow management. Users authenticate with their own JWT tokens obtained directly from Keycloak, via a bundled token-fetch script, rather than a shared service credential, and the server communicates over SSE transport for HTTP-based access. It ships as a production-ready OpenShift/Kubernetes deployment with multi-architecture container images and GraalVM native-image support, built on Quarkus with the official Keycloak Admin Client as its Java-side integration, and Jib for containerization without a Docker daemon.

Use it when an AI assistant or tool needs to manage Keycloak realms, users, clients, roles, or groups programmatically rather than through Keycloak's own admin console. Running it is a single Docker invocation:

docker run -d \
  --name keycloak-mcp-server \
  -p 8080:8080 \
  -e KC_URL=https://keycloak.example.com \
  -e KC_REALM=master \
  -e OIDC_CLIENT_ID=mcp-server \
  quay.io/sshaaf/keycloak-mcp-server:latest

and MCP clients like Cursor connect over SSE with a per-user bearer token in the Authorization header, rather than a static server-wide secret. Beyond the container, the project also builds as a plain JAR or a native image via Maven profiles for environments that need one of those forms instead.

Covers the full range of Keycloak admin operations - users, realms, clients, roles, groups - exposed as MCP tools, plus SSE-based HTTP transport so a remote MCP client can connect without a local process.

Pull the pre-built image from Quay.io and run it with the required Keycloak URL, realm, and OIDC client ID environment variables, or build it directly from source with Maven as a JAR, a GraalVM native binary, or a container image. Full documentation - a getting-started guide, an authentication guide, an OpenShift deployment guide, and a developers guide - lives in the project's own docs directory, built with MkDocs Material and served locally at http://localhost:8000 for anyone contributing to the docs themselves rather than just consuming the pre-built images.

Teams that want an AI assistant to perform Keycloak administration tasks - creating users, configuring realms, managing clients and roles - through natural-language requests instead of the Keycloak admin console or raw REST calls. The project is MIT-licensed, maintained by Shaaf Syed, with pre-built container images published to Quay.io and updated automatically on every commit to main and every release, and community support available through the project's GitHub issues and the Keycloak Discourse forum.