keycloak-mcp
Operate managed Keycloak from your AI client.
Community: Submitted by a user or imported; check the owner before granting accessOnlineNo sign-inGlobalFreeCan modify data
What it can do
- Skycloak Add Cluster Captcha Domain: Register a hostname for CAPTCHA protection on a cluster.
- Skycloak Add Realm User To Group: Add a user to a realm group.
- Skycloak Assign Application Role: Grant a role to an application's service account. Provide role_client_id for a client role, or omit it for a realm role.
What data it sees
Do you need an account
No: the server works without sign-in
Operate managed Keycloak from your AI client. Provision and scale clusters, create realms and applications, wire up SSO and identity providers (Google, GitHub, SAML, LDAP), manage users, roles and groups, set custom domains and branding, configure WAF and geo-blocking, and stream audit events to your SIEM. Signs you in through the browser with OAuth, so there is no API key to paste, and what you can change is bounded by your workspace role.
How to connect
How to connect keycloak-mcp to Claude
The server address to paste into Claude settings:
https://keycloak-mcp--skycloak.run.tools
- Open Claude (claude.ai or the desktop app).
- Go to Settings → Connectors.
- Click Add custom connector.
- Paste the server address copied below into Remote MCP server URL and click Add.
- In a chat, click + → Connectors and switch the new connector on.
Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.
Authorization
After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.
How to connect keycloak-mcp to ChatGPT
The server address to paste into ChatGPT settings:
https://keycloak-mcp--skycloak.run.tools
- Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
- Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
- Open Settings → Connectors and click Create.
- Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
- Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
- In a new chat open + → Apps/Connectors and enable the connector.
OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.
Authorization
On first use ChatGPT opens the service's sign-in window. Sign in and approve access.
How to connect keycloak-mcp to Cursor
The server address to paste into Cursor settings:
https://keycloak-mcp--skycloak.run.tools
Fastest: click Open in Cursor below and confirm the prompt.
Manually:
- In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
- Paste the JSON copied below into
~/.cursor/mcp.json(per project:.cursor/mcp.jsonin the repo root). - Save the file. The server appears in the MCP list; authorize it there if asked.
Authorization
If the service needs sign-in, an authorize button appears next to the server in the MCP list.
Server tool list (60)
Raw names from tools/list. Only developers need these.
| skycloak_add_cluster_captcha_domain | Register a hostname for CAPTCHA protection on a cluster. |
| skycloak_add_realm_user_to_group | Add a user to a realm group. |
| skycloak_assign_application_role | Grant a role to an application's service account. Provide role_client_id for a client role, or omit it for a realm role. |
| skycloak_assign_realm_user_role | Assign a realm role to a user. |
| skycloak_cancel_cluster_upgrade | Cancel an in-progress cluster version upgrade. Set confirm=true to proceed. |
| skycloak_create_application | Create an OIDC/SAML client (application) in a realm. Returns the client secret for confidential clients (store it; it is not retrievable later). |
| skycloak_create_cluster | Provision a new Keycloak cluster. Asynchronous: the returned cluster starts in a provisioning state — poll skycloak_get_cluster until its status is 'available'. Requires --allow-writes. |
| skycloak_create_domain | Add a custom domain to a cluster. Returns the DNS records the customer must create to verify and route the domain. |
| skycloak_create_domain_route | Add a realm route to a custom domain. |
| skycloak_create_export | Start a database export for a cluster. Asynchronous: poll skycloak_get_export until the status is 'completed' to obtain the download URL. Including credentials requires an encryption_password. |
| skycloak_create_identity_provider | Create an OIDC identity provider (SSO connection) in a realm. |
| skycloak_create_realm | Create a new Keycloak realm in a cluster. Requires the server to be started with --allow-writes and a write-scoped API key. |
| skycloak_create_realm_export | Export a Keycloak realm to an encrypted archive. Asynchronous: poll skycloak_get_realm_export until status is 'completed'. The archive is always encrypted, so encryption_password is required, and the same password is needed to import it again. This is a realm export (one realm's configuration); skycloak_create_export is the separate whole-cluster database export. |
| skycloak_create_realm_group | Create a realm group, optionally nested under a parent group. |
| skycloak_create_realm_import | Import a Keycloak realm into a cluster from an uploaded archive or an existing realm export. Asynchronous: poll skycloak_get_realm_import. Creates a new realm: preflight refuses a name collision rather than overwriting, so an existing realm of the same name fails with 409. It does import users and their credentials, so set confirm=true to proceed. |
| skycloak_create_realm_import_upload_url | Get a presigned URL to upload a realm archive to. PUT the archive to upload_url, then pass the returned s3_key to skycloak_create_realm_import as upload_s3_key. Not needed when importing an existing export: pass that export's ID as source_export_id instead. |
| skycloak_create_realm_role | Create a realm-scoped role. |
| skycloak_create_realm_user | Create a realm user with an initial temporary password. |
| skycloak_create_siem_destination | Create a SIEM destination. Credentials are write-only and are not returned. |
| skycloak_create_webhook_subscription | Create a webhook subscription. Signing secrets and authorization headers are write-only. |
| skycloak_delete_application | Delete an application (OIDC/SAML client) from a realm. Set confirm=true to proceed. |
| skycloak_delete_cluster | Permanently delete a Keycloak cluster and all of its realms and data. Irreversible. Set confirm=true to proceed. |
| skycloak_delete_cluster_maintenance_window | Delete a cluster-specific maintenance window so the cluster follows the workspace default. Set confirm=true to proceed. |
| skycloak_delete_domain | Remove a custom domain from a cluster. Set confirm=true to proceed. |
| skycloak_delete_domain_route | Remove a realm route from a custom domain. Set confirm=true to proceed. |
| skycloak_delete_email_branding | Revert email branding to defaults. Set confirm=true to proceed. |
| skycloak_delete_export | Delete a database export archive. Set confirm=true to proceed. |
| skycloak_delete_extension | Delete a custom extension from the workspace catalog. Set confirm=true to proceed. |
| skycloak_delete_identity_provider | Delete an identity provider from a realm. Set confirm=true to proceed. |
| skycloak_delete_login_branding | Revert login branding to defaults. Set confirm=true to proceed. |
| skycloak_delete_realm | Permanently delete a realm and all of its users, clients and configuration. This is irreversible. Set confirm=true to proceed. |
| skycloak_delete_realm_group | Delete a realm group. Set confirm=true to proceed. |
| skycloak_delete_realm_role | Delete a realm role. Set confirm=true to proceed. |
| skycloak_delete_realm_user | Delete a realm user. Set confirm=true to proceed. |
| skycloak_delete_siem_destination | Delete a SIEM destination. Set confirm=true to proceed. |
| skycloak_delete_smtp | Remove a realm's SMTP configuration. Set confirm=true to proceed. |
| skycloak_delete_theme | Delete a custom theme. Set confirm=true to proceed. |
| skycloak_delete_webhook_subscription | Delete a webhook subscription. Set confirm=true to proceed. |
| skycloak_discover_oidc | Resolve an OIDC issuer's discovery document to obtain its authorization, token, and userinfo endpoints. Use the result when creating an identity provider. |
| skycloak_download_theme_content | Download a custom theme's content archive. Returns size and SHA-256 always, and the archive itself only when it is small enough to inline. |
| skycloak_export_cluster_events | Export a cluster's events as a document and return its contents. |
| skycloak_get_application | Get an application (OIDC/SAML client) by client ID. |
| skycloak_get_client_theme_assignment | Get a client's login-theme override (empty means the realm default). |
| skycloak_get_cluster | Get full details for a single Keycloak cluster by its ID. |
| skycloak_get_cluster_insights | Get cluster analytics as a JSON document. type is one of: overview, authentication, events, performance, security. |
| skycloak_get_cluster_maintenance_window | Get a cluster-specific maintenance window. A 404 means the cluster follows the workspace default. |
| skycloak_get_cluster_security | Get a cluster's edge-security configuration: IP allow-listing, rate limiting, WAF, geo-blocking, and bot management. |
| skycloak_get_cluster_upgrade_path | Get the recommended version-upgrade path for a cluster. |
| skycloak_get_domain | Get a custom domain by ID, including its DNS records and verification/SSL status. |
| skycloak_get_domain_route | Get a single realm route on a custom domain. |
| skycloak_get_email_branding | Get the email-template branding (colors, logo, footer) for a realm. |
| skycloak_get_export | Get a database export job by ID, including its status, progress, and (once completed) the time-limited download URL. |
| skycloak_get_identity_provider | Get an identity provider by provider ID. |
| skycloak_get_login_branding | Get the login-page branding (colors, logo, toggles) for a realm. |
| skycloak_get_logs | Read recent Keycloak server logs for a cluster, optionally filtered by level and a search string. |
| skycloak_get_realm | Get a realm by name. |
| skycloak_get_realm_export | Get a realm export job by ID. Poll this after skycloak_create_realm_export until status is 'completed'; the download URL only appears then and expires 24 hours later. |
| skycloak_get_realm_group | Get a realm group by ID. |
| skycloak_get_realm_import | Get a realm import job by ID. Poll this after skycloak_create_realm_import until status is 'completed' or 'failed'. |
| skycloak_get_realm_role | Get a realm role by name. |