MCP Server

Keycloak Admin MCP Server

Name: Keycloak Admin MCP Server
Author: io.github.mrz1880

io.github.mrz1880/mcp-keycloak-admin

Repository Registry

What is the Keycloak Admin MCP server?

Administer Keycloak via its Admin REST API: users, roles, clients, groups, IdP, events.

How to install Keycloak Admin

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

KEYCLOAK_BASE_URL
required
Base URL of the Keycloak server (no trailing slash).
KEYCLOAK_REALM
required
Realm the server operates on.
AUTH_MODE
required
Authentication mode: service_account or password.
KC_CLIENT_ID
Confidential client id (service_account mode).
KC_CLIENT_SECRET
secret
Client secret (service_account mode).
KC_ADMIN_USERNAME
Admin username (password mode).
KC_ADMIN_PASSWORD
secret
Admin password (password mode).
KC_ADMIN_REALM
Realm holding the admin user (password mode; default master).
READ_ONLY
When true, write and destructive tools are not registered.
ALLOWED_REALMS
Comma-separated allow-list of realms the server may operate on.

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-keycloak-admin": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-keycloak-admin"
      ],
      "env": {
        "KEYCLOAK_BASE_URL": "<YOUR_KEYCLOAK_BASE_URL>",
        "KEYCLOAK_REALM": "<YOUR_KEYCLOAK_REALM>",
        "AUTH_MODE": "<YOUR_AUTH_MODE>",
        "KC_CLIENT_ID": "<YOUR_KC_CLIENT_ID>",
        "KC_CLIENT_SECRET": "<YOUR_KC_CLIENT_SECRET>",
        "KC_ADMIN_USERNAME": "<YOUR_KC_ADMIN_USERNAME>",
        "KC_ADMIN_PASSWORD": "<YOUR_KC_ADMIN_PASSWORD>",
        "KC_ADMIN_REALM": "<YOUR_KC_ADMIN_REALM>",
        "READ_ONLY": "<YOUR_READ_ONLY>",
        "ALLOWED_REALMS": "<YOUR_ALLOWED_REALMS>"
      }
    }
  }
}

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-keycloak-admin": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-keycloak-admin"
      ],
      "env": {
        "KEYCLOAK_BASE_URL": "<YOUR_KEYCLOAK_BASE_URL>",
        "KEYCLOAK_REALM": "<YOUR_KEYCLOAK_REALM>",
        "AUTH_MODE": "<YOUR_AUTH_MODE>",
        "KC_CLIENT_ID": "<YOUR_KC_CLIENT_ID>",
        "KC_CLIENT_SECRET": "<YOUR_KC_CLIENT_SECRET>",
        "KC_ADMIN_USERNAME": "<YOUR_KC_ADMIN_USERNAME>",
        "KC_ADMIN_PASSWORD": "<YOUR_KC_ADMIN_PASSWORD>",
        "KC_ADMIN_REALM": "<YOUR_KC_ADMIN_REALM>",
        "READ_ONLY": "<YOUR_READ_ONLY>",
        "ALLOWED_REALMS": "<YOUR_ALLOWED_REALMS>"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "mcp-keycloak-admin": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-keycloak-admin"
      ],
      "env": {
        "KEYCLOAK_BASE_URL": "<YOUR_KEYCLOAK_BASE_URL>",
        "KEYCLOAK_REALM": "<YOUR_KEYCLOAK_REALM>",
        "AUTH_MODE": "<YOUR_AUTH_MODE>",
        "KC_CLIENT_ID": "<YOUR_KC_CLIENT_ID>",
        "KC_CLIENT_SECRET": "<YOUR_KC_CLIENT_SECRET>",
        "KC_ADMIN_USERNAME": "<YOUR_KC_ADMIN_USERNAME>",
        "KC_ADMIN_PASSWORD": "<YOUR_KC_ADMIN_PASSWORD>",
        "KC_ADMIN_REALM": "<YOUR_KC_ADMIN_REALM>",
        "READ_ONLY": "<YOUR_READ_ONLY>",
        "ALLOWED_REALMS": "<YOUR_ALLOWED_REALMS>"
      }
    }
  }
}

VS Code

.vscode/mcp.json

{
  "servers": {
    "mcp-keycloak-admin": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "mcp-keycloak-admin"
      ],
      "env": {
        "KEYCLOAK_BASE_URL": "<YOUR_KEYCLOAK_BASE_URL>",
        "KEYCLOAK_REALM": "<YOUR_KEYCLOAK_REALM>",
        "AUTH_MODE": "<YOUR_AUTH_MODE>",
        "KC_CLIENT_ID": "<YOUR_KC_CLIENT_ID>",
        "KC_CLIENT_SECRET": "<YOUR_KC_CLIENT_SECRET>",
        "KC_ADMIN_USERNAME": "<YOUR_KC_ADMIN_USERNAME>",
        "KC_ADMIN_PASSWORD": "<YOUR_KC_ADMIN_PASSWORD>",
        "KC_ADMIN_REALM": "<YOUR_KC_ADMIN_REALM>",
        "READ_ONLY": "<YOUR_READ_ONLY>",
        "ALLOWED_REALMS": "<YOUR_ALLOWED_REALMS>"
      }
    }
  }
}

Claude Code

claude mcp add mcp-keycloak-admin --env KEYCLOAK_BASE_URL=<YOUR_KEYCLOAK_BASE_URL> --env KEYCLOAK_REALM=<YOUR_KEYCLOAK_REALM> --env AUTH_MODE=<YOUR_AUTH_MODE> --env KC_CLIENT_ID=<YOUR_KC_CLIENT_ID> --env KC_CLIENT_SECRET=<YOUR_KC_CLIENT_SECRET> --env KC_ADMIN_USERNAME=<YOUR_KC_ADMIN_USERNAME> --env KC_ADMIN_PASSWORD=<YOUR_KC_ADMIN_PASSWORD> --env KC_ADMIN_REALM=<YOUR_KC_ADMIN_REALM> --env READ_ONLY=<YOUR_READ_ONLY> --env ALLOWED_REALMS=<YOUR_ALLOWED_REALMS> -- npx -y mcp-keycloak-admin