keycloak-model-context-protocol

How to start

1. Run the command in your terminal, in the project where you want it.
2. Set KEYCLOAK_URL with --env or in your shell.
3. Check it: run /mcp in Claude Code and look for it in the list.

What it needs

• KEYCLOAK_URLRequired. Base URL of the Keycloak server, e.g. https://keycloak.example.com
• KEYCLOAK_AUTH_REALMOptional. Realm used to obtain the admin token
• KEYCLOAK_CLIENT_IDOptional. Client ID used for login (default admin-cli for the password grant, required for client_credentials)
• KEYCLOAK_CLIENT_SECRETOptional. Secret: keep it out of your repo. Client secret for the client_credentials grant (recommended: a dedicated service account)
• KEYCLOAK_USERNAMEOptional. Username for the password grant (alternative to client credentials)
• KEYCLOAK_PASSWORDOptional. Secret: keep it out of your repo. Password for the password grant
• KEYCLOAK_GRANT_TYPEOptional. Grant type; auto-detected if unset (client_credentials when a secret is set, else password)
• KEYCLOAK_MCP_READ_ONLYOptional. If true, only read-only tools are registered
• KEYCLOAK_MCP_REALMSOptional. Comma-separated allowlist of target realms; empty means all realms
• KEYCLOAK_MCP_ALLOW_MASTER_WRITEOptional. If true, write tools may modify the master realm
• KEYCLOAK_MCP_TOOLSETSOptional. Comma-separated enabled toolsets (core, groups, roles, clients, sessions, events, security) or all
• KEYCLOAK_MCP_REQUIRE_CONFIRMATIONOptional. If true, destructive tools require confirm=true
• KEYCLOAK_MCP_TIMEOUT_MSOptional. HTTP timeout for Keycloak requests in milliseconds
• KEYCLOAK_MCP_LOG_LEVELOptional. Log level written to stderr

Environment variables as listed in the server's MCP Registry entry.