English Français العربية

Keycloak Admin API

Official registry Other

Unofficial: one tool per Keycloak admin operation on a realm, read-only unless writes are enabled

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package keycloak-api
Claude Code 
claude mcp add keycloak-admin-api -e 'KEYCLOAK_URL=<KEYCLOAK_URL>' -e 'KEYCLOAK_REALM=<KEYCLOAK_REALM>' -e 'KEYCLOAK_TOKEN=<your keycloak_token>' -e 'KEYCLOAK_CLIENT_ID=<KEYCLOAK_CLIENT_ID>' -e 'KEYCLOAK_CLIENT_SECRET=<your keycloak_client_secret>' -e 'KEYCLOAK_TOKEN_REALM=<KEYCLOAK_TOKEN_REALM>' -e 'KEYCLOAK_MCP_ALLOW_WRITES=<KEYCLOAK_MCP_ALLOW_WRITES>' -- npx -y keycloak-api@3.7.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "keycloak-admin-api": {
            "command": "npx",
            "args": [
                "-y",
                "keycloak-api@3.7.1"
            ],
            "env": {
                "KEYCLOAK_URL": "<KEYCLOAK_URL>",
                "KEYCLOAK_REALM": "<KEYCLOAK_REALM>",
                "KEYCLOAK_TOKEN": "<your keycloak_token>",
                "KEYCLOAK_CLIENT_ID": "<KEYCLOAK_CLIENT_ID>",
                "KEYCLOAK_CLIENT_SECRET": "<your keycloak_client_secret>",
                "KEYCLOAK_TOKEN_REALM": "<KEYCLOAK_TOKEN_REALM>",
                "KEYCLOAK_MCP_ALLOW_WRITES": "<KEYCLOAK_MCP_ALLOW_WRITES>"
            }
        }
    }
}

Environment variables

  • KEYCLOAK_URL required Base URL of the server, such as https://keycloak.example.com
  • KEYCLOAK_REALM required Realm the tools act on
  • KEYCLOAK_TOKEN secret A fixed access token; otherwise set KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET
  • KEYCLOAK_CLIENT_ID A confidential client with a service account, for the client credentials grant
  • KEYCLOAK_CLIENT_SECRET secret Secret of that client
  • KEYCLOAK_TOKEN_REALM Realm of that client, if not KEYCLOAK_REALM (for example master)
  • KEYCLOAK_MCP_ALLOW_WRITES 1 to list the tools that change data

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

openapi

Type-safe TypeScript clients generated from public OpenAPI specs, plus the site at openapi.sferadev.com that lists them.

PackageAPI
cloudflare-api-jsCloudflare
keycloak-apiKeycloak
litellm-apiLiteLLM
netlify-apiNetlify
nuki-api-jsNuki
v0-apiVercel v0
vercel-api-jsVercel
zoom-api-jsZoom

Coding agents can load skills/openapi-clients, an Agent Skill on picking a client, auth, finding an operation, errors, streaming and Effect: npx skills add sferarc/openapi.

packages/openapi-utils holds the shared kubb config, spec fetching and runtime helpers every client is generated with. apps/openapi is the website.

Development

The toolchain is pinned in mise.toml. With mise installed:

mise install
pnpm install
pnpm tsc && pnpm check && pnpm test
pnpm generate --filter=<package>   # regenerate one client from its live spec

The Update OpenAPI workflow regenerates each client from its upstream spec and opens a PR with a changeset written from the diff. Releases go through changesets: merging the version PR publishes to npm.

Frequently asked questions

What is Keycloak Admin API?

Unofficial: one tool per Keycloak admin operation on a realm, read-only unless writes are enabled

How do I install Keycloak Admin API?

It runs on your machine. In Claude Code: claude mcp add keycloak-admin-api -e 'KEYCLOAK_URL=<KEYCLOAK_URL>' -e 'KEYCLOAK_REALM=<KEYCLOAK_REALM>' -e 'KEYCLOAK_TOKEN=<your keycloak_token>' -e 'KEYCLOAK_CLIENT_ID=<KEYCLOAK_CLIENT_ID>' -e 'KEYCLOAK_CLIENT_SECRET=<your keycloak_client_secret>' -e 'KEYCLOAK_TOKEN_REALM=<KEYCLOAK_TOKEN_REALM>' -e 'KEYCLOAK_MCP_ALLOW_WRITES=<KEYCLOAK_MCP_ALLOW_WRITES>' -- npx -y keycloak-api@3.7.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Keycloak Admin API need an API key?

Yes. It expects KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_TOKEN, KEYCLOAK_CLIENT_SECRET, which you set in its configuration.

Is Keycloak Admin API open source?

Yes. Its code is on GitHub under the ISC license.

Who maintains Keycloak Admin API?

It is published by sferarc. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.