keycloak-mcp
Operate managed Keycloak from your AI client.
От сообщества: Добавлен пользователем или импортирован; проверьте владельца перед подключениемРаботаетБез входаГлобальныйБесплатноМожет изменять данные
Что умеет
- Skycloak Add Cluster Captcha Domain: Register a hostname for CAPTCHA protection on a cluster.
- Skycloak Add Realm User To Group: Add a user to a realm group.
- Skycloak Assign Application Role: Grant a role to an application's service account. Provide role_client_id for a client role, or omit it for a realm role.
Какие данные видит
Нужен ли аккаунт
Не нужен: сервер работает без входа
Operate managed Keycloak from your AI client. Provision and scale clusters, create realms and applications, wire up SSO and identity providers (Google, GitHub, SAML, LDAP), manage users, roles and groups, set custom domains and branding, configure WAF and geo-blocking, and stream audit events to your SIEM. Signs you in through the browser with OAuth, so there is no API key to paste, and what you can change is bounded by your workspace role.
Список инструментов сервера (60)
Технические названия из tools/list. Нужны только разработчикам.
| skycloak_add_cluster_captcha_domain | Register a hostname for CAPTCHA protection on a cluster. |
| skycloak_add_realm_user_to_group | Add a user to a realm group. |
| skycloak_assign_application_role | Grant a role to an application's service account. Provide role_client_id for a client role, or omit it for a realm role. |
| skycloak_assign_realm_user_role | Assign a realm role to a user. |
| skycloak_cancel_cluster_upgrade | Cancel an in-progress cluster version upgrade. Set confirm=true to proceed. |
| skycloak_create_application | Create an OIDC/SAML client (application) in a realm. Returns the client secret for confidential clients (store it; it is not retrievable later). |
| skycloak_create_cluster | Provision a new Keycloak cluster. Asynchronous: the returned cluster starts in a provisioning state — poll skycloak_get_cluster until its status is 'available'. Requires --allow-writes. |
| skycloak_create_domain | Add a custom domain to a cluster. Returns the DNS records the customer must create to verify and route the domain. |
| skycloak_create_domain_route | Add a realm route to a custom domain. |
| skycloak_create_export | Start a database export for a cluster. Asynchronous: poll skycloak_get_export until the status is 'completed' to obtain the download URL. Including credentials requires an encryption_password. |
| skycloak_create_identity_provider | Create an OIDC identity provider (SSO connection) in a realm. |
| skycloak_create_realm | Create a new Keycloak realm in a cluster. Requires the server to be started with --allow-writes and a write-scoped API key. |
| skycloak_create_realm_export | Export a Keycloak realm to an encrypted archive. Asynchronous: poll skycloak_get_realm_export until status is 'completed'. The archive is always encrypted, so encryption_password is required, and the same password is needed to import it again. This is a realm export (one realm's configuration); skycloak_create_export is the separate whole-cluster database export. |
| skycloak_create_realm_group | Create a realm group, optionally nested under a parent group. |
| skycloak_create_realm_import | Import a Keycloak realm into a cluster from an uploaded archive or an existing realm export. Asynchronous: poll skycloak_get_realm_import. Creates a new realm: preflight refuses a name collision rather than overwriting, so an existing realm of the same name fails with 409. It does import users and their credentials, so set confirm=true to proceed. |
| skycloak_create_realm_import_upload_url | Get a presigned URL to upload a realm archive to. PUT the archive to upload_url, then pass the returned s3_key to skycloak_create_realm_import as upload_s3_key. Not needed when importing an existing export: pass that export's ID as source_export_id instead. |
| skycloak_create_realm_role | Create a realm-scoped role. |
| skycloak_create_realm_user | Create a realm user with an initial temporary password. |
| skycloak_create_siem_destination | Create a SIEM destination. Credentials are write-only and are not returned. |
| skycloak_create_webhook_subscription | Create a webhook subscription. Signing secrets and authorization headers are write-only. |
| skycloak_delete_application | Delete an application (OIDC/SAML client) from a realm. Set confirm=true to proceed. |
| skycloak_delete_cluster | Permanently delete a Keycloak cluster and all of its realms and data. Irreversible. Set confirm=true to proceed. |
| skycloak_delete_cluster_maintenance_window | Delete a cluster-specific maintenance window so the cluster follows the workspace default. Set confirm=true to proceed. |
| skycloak_delete_domain | Remove a custom domain from a cluster. Set confirm=true to proceed. |
| skycloak_delete_domain_route | Remove a realm route from a custom domain. Set confirm=true to proceed. |
| skycloak_delete_email_branding | Revert email branding to defaults. Set confirm=true to proceed. |
| skycloak_delete_export | Delete a database export archive. Set confirm=true to proceed. |
| skycloak_delete_extension | Delete a custom extension from the workspace catalog. Set confirm=true to proceed. |
| skycloak_delete_identity_provider | Delete an identity provider from a realm. Set confirm=true to proceed. |
| skycloak_delete_login_branding | Revert login branding to defaults. Set confirm=true to proceed. |
| skycloak_delete_realm | Permanently delete a realm and all of its users, clients and configuration. This is irreversible. Set confirm=true to proceed. |
| skycloak_delete_realm_group | Delete a realm group. Set confirm=true to proceed. |
| skycloak_delete_realm_role | Delete a realm role. Set confirm=true to proceed. |
| skycloak_delete_realm_user | Delete a realm user. Set confirm=true to proceed. |
| skycloak_delete_siem_destination | Delete a SIEM destination. Set confirm=true to proceed. |
| skycloak_delete_smtp | Remove a realm's SMTP configuration. Set confirm=true to proceed. |
| skycloak_delete_theme | Delete a custom theme. Set confirm=true to proceed. |
| skycloak_delete_webhook_subscription | Delete a webhook subscription. Set confirm=true to proceed. |
| skycloak_discover_oidc | Resolve an OIDC issuer's discovery document to obtain its authorization, token, and userinfo endpoints. Use the result when creating an identity provider. |
| skycloak_download_theme_content | Download a custom theme's content archive. Returns size and SHA-256 always, and the archive itself only when it is small enough to inline. |
| skycloak_export_cluster_events | Export a cluster's events as a document and return its contents. |
| skycloak_get_application | Get an application (OIDC/SAML client) by client ID. |
| skycloak_get_client_theme_assignment | Get a client's login-theme override (empty means the realm default). |
| skycloak_get_cluster | Get full details for a single Keycloak cluster by its ID. |
| skycloak_get_cluster_insights | Get cluster analytics as a JSON document. type is one of: overview, authentication, events, performance, security. |
| skycloak_get_cluster_maintenance_window | Get a cluster-specific maintenance window. A 404 means the cluster follows the workspace default. |
| skycloak_get_cluster_security | Get a cluster's edge-security configuration: IP allow-listing, rate limiting, WAF, geo-blocking, and bot management. |
| skycloak_get_cluster_upgrade_path | Get the recommended version-upgrade path for a cluster. |
| skycloak_get_domain | Get a custom domain by ID, including its DNS records and verification/SSL status. |
| skycloak_get_domain_route | Get a single realm route on a custom domain. |
| skycloak_get_email_branding | Get the email-template branding (colors, logo, footer) for a realm. |
| skycloak_get_export | Get a database export job by ID, including its status, progress, and (once completed) the time-limited download URL. |
| skycloak_get_identity_provider | Get an identity provider by provider ID. |
| skycloak_get_login_branding | Get the login-page branding (colors, logo, toggles) for a realm. |
| skycloak_get_logs | Read recent Keycloak server logs for a cluster, optionally filtered by level and a search string. |
| skycloak_get_realm | Get a realm by name. |
| skycloak_get_realm_export | Get a realm export job by ID. Poll this after skycloak_create_realm_export until status is 'completed'; the download URL only appears then and expires 24 hours later. |
| skycloak_get_realm_group | Get a realm group by ID. |
| skycloak_get_realm_import | Get a realm import job by ID. Poll this after skycloak_create_realm_import until status is 'completed' or 'failed'. |
| skycloak_get_realm_role | Get a realm role by name. |