Keycloak Admin runs on your own machine — the client starts it, so there is no endpoint to ping. 109 installs a week from npm. Last commit 22 Oct 2026.
Administer Keycloak via its Admin REST API: users, roles, clients, groups, IdP, events.
Nothing serious here today
Today is the operative word: we check Keycloak Admin every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add mcp-keycloak-admin -e 'KEYCLOAK_BASE_URL=<KEYCLOAK_BASE_URL>' -e 'KEYCLOAK_REALM=<KEYCLOAK_REALM>' -e 'AUTH_MODE=<AUTH_MODE>' -- npx -y mcp-keycloak-admin{
"mcpServers": {
"mcp-keycloak-admin": {
"command": "npx",
"args": [
"-y",
"mcp-keycloak-admin"
],
"env": {
"AUTH_MODE": "<AUTH_MODE>",
"KEYCLOAK_BASE_URL": "<KEYCLOAK_BASE_URL>",
"KEYCLOAK_REALM": "<KEYCLOAK_REALM>"
}
}
}
}[mcp_servers.mcp-keycloak-admin]
command = "npx"
args = ["-y", "mcp-keycloak-admin"]
env = { KEYCLOAK_BASE_URL = "<KEYCLOAK_BASE_URL>", KEYCLOAK_REALM = "<KEYCLOAK_REALM>", AUTH_MODE = "<AUTH_MODE>" }{
"mcpServers": {
"mcp-keycloak-admin": {
"command": "npx",
"args": [
"-y",
"mcp-keycloak-admin"
],
"env": {
"AUTH_MODE": "<AUTH_MODE>",
"KEYCLOAK_BASE_URL": "<KEYCLOAK_BASE_URL>",
"KEYCLOAK_REALM": "<KEYCLOAK_REALM>"
}
}
}
}{
"servers": {
"mcp-keycloak-admin": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcp-keycloak-admin"
],
"env": {
"AUTH_MODE": "<AUTH_MODE>",
"KEYCLOAK_BASE_URL": "<KEYCLOAK_BASE_URL>",
"KEYCLOAK_REALM": "<KEYCLOAK_REALM>"
}
}
}
}Put your own values in place of
<KEYCLOAK_BASE_URL> (Base URL of the Keycloak server (no trailing slash)), <KEYCLOAK_REALM> (Realm the server operates on), <AUTH_MODE> (Authentication mode: service_account or password).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
KC_CLIENT_ID (Confidential client id (service_account mode)), KC_CLIENT_SECRET (Client secret (service_account mode)), KC_ADMIN_USERNAME (Admin username (password mode)), KC_ADMIN_PASSWORD (Admin password (password mode)), KC_ADMIN_REALM (Realm holding the admin user (password mode; default master)), READ_ONLY (When true, write and destructive tools are not registered), ALLOWED_REALMS (Comma-separated allow-list of realms the server may operate on).
Alternatives to Keycloak Admin
same job, measured the same wayManage Keycloak users, groups, roles and realms through the Keycloak Admin REST API.
Keycloak admin for AI agents — realms, users, clients, roles; safe-by-default governance.
MCP server for KeyCloak Admin REST API via Service Account
Governed Keycloak + authentik identity ops: users, events, clients, MFA, RCA. 29 tools.
Managed Keycloak from any MCP client: clusters, realms, apps, SSO, users, domains, audit events.
Google Workspace Admin via MCP. Manage users, groups, aliases, org units.
MCP server for consuming and managing Groups.io data via the Groups.io REST API
Read Schedule it events, resources, groups and labels; create and update events and resources.
Keycloak Admin — questions
Answers built from our own checks of this server.