keycloak-model-context-protocol

Package (npm 1.1.0)

npx -y [email protected]

Or add to your MCP client config:

{
  "mcpServers": {
    "keycloak-model-context-protocol": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "KEYCLOAK_URL": "<YOUR_VALUE>",
        "KEYCLOAK_AUTH_REALM": "<YOUR_VALUE>",
        "KEYCLOAK_CLIENT_ID": "<YOUR_VALUE>",
        "KEYCLOAK_CLIENT_SECRET": "<YOUR_VALUE>",
        "KEYCLOAK_USERNAME": "<YOUR_VALUE>",
        "KEYCLOAK_PASSWORD": "<YOUR_VALUE>",
        "KEYCLOAK_GRANT_TYPE": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_READ_ONLY": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_REALMS": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_ALLOW_MASTER_WRITE": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_TOOLSETS": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_REQUIRE_CONFIRMATION": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_TIMEOUT_MS": "<YOUR_VALUE>",
        "KEYCLOAK_MCP_LOG_LEVEL": "<YOUR_VALUE>"
      }
    }
  }
}

• KEYCLOAK_URL required — Base URL of the Keycloak server, e.g. https://keycloak.example.com
• KEYCLOAK_AUTH_REALM — Realm used to obtain the admin token
• KEYCLOAK_CLIENT_ID — Client ID used for login (default admin-cli for the password grant, required for client_credentials)
• KEYCLOAK_CLIENT_SECRET secret — Client secret for the client_credentials grant (recommended: a dedicated service account)
• KEYCLOAK_USERNAME — Username for the password grant (alternative to client credentials)
• KEYCLOAK_PASSWORD secret — Password for the password grant
• KEYCLOAK_GRANT_TYPE — Grant type; auto-detected if unset (client_credentials when a secret is set, else password)
• KEYCLOAK_MCP_READ_ONLY — If true, only read-only tools are registered
• KEYCLOAK_MCP_REALMS — Comma-separated allowlist of target realms; empty means all realms
• KEYCLOAK_MCP_ALLOW_MASTER_WRITE — If true, write tools may modify the master realm
• KEYCLOAK_MCP_TOOLSETS — Comma-separated enabled toolsets (core, groups, roles, clients, sessions, events, security) or all
• KEYCLOAK_MCP_REQUIRE_CONFIRMATION — If true, destructive tools require confirm=true
• KEYCLOAK_MCP_TIMEOUT_MS — HTTP timeout for Keycloak requests in milliseconds
• KEYCLOAK_MCP_LOG_LEVEL — Log level written to stderr