Keycloak Admin MCP Server

A Model Context Protocol (MCP) server to administer a Keycloak instance through its Admin REST API. Safe by default, configurable, and built with a clean, test-driven architecture. Its 40 documented tools cover keycloak, user, client, group. It runs locally over stdio via the published package.

People who work with keycloak, user and client and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-09-13 · ★ 2 · #110 OF 278 MAINTAINED API INTEGRATION · VERIFIED 2026-09-18

MIT · TypeScript servers · how we verify → /methodology

01 · Install Keycloak Admin

before you install - you'll need

Set KEYCLOAK_BASE_URL, KEYCLOAK_REALM, AUTH_MODE, KC_CLIENT_ID, KC_CLIENT_SECRET, ALLOWED_REALMS before connecting. READ_ONLY is optional or environment-specific per the README.

Claude Code

claude mcp add mrz1880-mcp-keycloak-admin -- npx -y mcp-keycloak-admin

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "mrz1880-mcp-keycloak-admin": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-keycloak-admin"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

npm package mcp-keycloak-admin - unscoped; check the name against the project README before installing

registry namespace io.github.mrz1880 is GitHub-verified and matches the repo owner

03 · What Keycloak Admin can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can search realm users by email, username or free text, fetch a single user by id, list a user's active sessions, and create a realm user.

Capability map

Tools grouped from the project's README - what Keycloak Admin lets an agent do.

Keycloak

31 tools - e.g. Search realm users by email, username or free text.; Fetch a single user by id.; List a user's active sessions.

keycloak_user_search · keycloak_user_get · keycloak_user_sessions_list · keycloak_user_create · keycloak_user_update · keycloak_user_set_enabled…

auth & access

9 tools - e.g. List realm roles.; List a user's realm roles.; Grant a realm role to a user.

keycloak_role_list · keycloak_user_roles_get · keycloak_user_role_assign · keycloak_user_role_unassign · keycloak_client_roles_list · keycloak_user_client_roles_get…

Latest releases

v0.2.3 · 2026-06-26

Added · keycloak_client_create and keycloak_client_update now accept webOrigins · (allowed CORS web origins), alongside the existing redirectUris. · Security · Force the transitive esbuild dev dependency to >= 0.28.1…

v0.2.2 · 2026-06-24

Documentation & tooling · Richer tool definitions: every tool now has a fuller description (purpose, when to use it, side effects and return value) and every parameter carries a description, improving how assistants…

v0.2.1 · 2026-06-24

Documentation & tooling · Publish metadata for the official MCP registry: a server.json descriptor and an mcpName link in package.json (io.github.mrz1880/mcp-keycloak-admin).

04 · Who maintains Keycloak Admin

Keycloak Admin is maintained by mrz1880. It's the only MCP server we track from this author; the repo dates to Jun 2026.

05 · Facts

repository: github.com/mrz1880/mcp-keycloak-admin
category: API integration - ranked #110 of 278 actively-maintained API integration servers as of 2026-09-18.
release cadence: 5 releases in the last 90 days (latest 2026-06-26)
registry: io.github.mrz1880/mcp-keycloak-admin (active, first published 2026-06-23 · 3 versions)
packages: npm:mcp-keycloak-admin

06 · Keycloak Admin FAQ

Is Keycloak Admin still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-13 and it shipped 5 releases in the last 90 days. We re-verify nightly.

What can Keycloak Admin do?

With this server connected, an agent can search realm users by email, username or free text, fetch a single user by id, list a user's active sessions, and create a realm user.

How do I install Keycloak Admin?

Run `npx -y mcp-keycloak-admin`. The README documents 7 environment variables (KEYCLOAK_BASE_URL, KEYCLOAK_REALM, AUTH_MODE…) to set first. Set KEYCLOAK_BASE_URL, KEYCLOAK_REALM, AUTH_MODE, KC_CLIENT_ID, KC_CLIENT_SECRET, ALLOWED_REALMS before connecting. READ_ONLY is optional or environment-specific per the README. You can also paste the ready-made client config above.

Does Keycloak Admin run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Keycloak Admin

Alternatives to Keycloak Admin

Maintained API integration servers if Keycloak Admin isn't the fit.

More API integration MCP servers · Allure Testops MCP · Tesla · Legislative Yuan · Swagger MCP Bridge · Neo4j MCP Canary

More TypeScript MCP servers · Glyphic · Smart Connections MCP · Multimeter · ConnectWise PSA · IT Glue (mspstack) · see all