Home › Security › Keycloak Admin

Keycloak Admin

Administer Keycloak via its Admin REST API: users, roles, clients, groups, IdP, events.

TypeScript Local

★ 3 stars Last pushed 2026-11-04 License: MIT

View repository →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 0.2.3)

npx -y [email protected]

Or add to your MCP client config:

{
  "mcpServers": {
    "mcp-keycloak-admin": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "KEYCLOAK_BASE_URL": "<YOUR_VALUE>",
        "KEYCLOAK_REALM": "<YOUR_VALUE>",
        "AUTH_MODE": "<YOUR_VALUE>",
        "KC_CLIENT_SECRET": "<YOUR_VALUE>",
        "KC_ADMIN_PASSWORD": "<YOUR_VALUE>"
      }
    }
  }
}

KEYCLOAK_BASE_URL required — Base URL of the Keycloak server (no trailing slash).
KEYCLOAK_REALM required — Realm the server operates on.
AUTH_MODE required — Authentication mode: service_account or password.
KC_CLIENT_ID — Confidential client id (service_account mode).
KC_CLIENT_SECRET secret — Client secret (service_account mode).
KC_ADMIN_USERNAME — Admin username (password mode).
KC_ADMIN_PASSWORD secret — Admin password (password mode).
KC_ADMIN_REALM — Realm holding the admin user (password mode; default master).
READ_ONLY — When true, write and destructive tools are not registered.
ALLOWED_REALMS — Comma-separated allow-list of realms the server may operate on.