KeyCloak MCP
Connects Claude to Keycloak's Admin REST API using service account authentication, so you can search users, reset passwords in bulk from CSV, track login events by IP or client, and monitor brute force attempts without touching user sessions or the userinfo endpoint. The tools cover the morning patrol basics: active sessions, login stats bucketed by hour or client, admin event history for tracking attribute changes, and a daily brief that flags IPs over your failure threshold. Helpful if you're managing a Keycloak realm and want conversational access to user counts, group membership, password update logs, and session kills without writing scripts or clicking through the admin console. Optional site labeling maps IP ranges to human readable location tags.
- tools
- 33
- transport
- STDIO
- last updated
- Oct 22, 2026
Tools
33 toolsPublic tool metadata for what this MCP can expose to an agent.
count_usersTotal user count in the realm
Total user count in the realm
No parameter schema in public metadata yet.
search_usersPartial-match search (username / email / name)
Partial-match search (username / email / name)
No parameter schema in public metadata yet.
get_userFull detail for an exact username
Full detail for an exact username
No parameter schema in public metadata yet.
reset_passwordReset one user's password
Reset one user's password
No parameter schema in public metadata yet.
reset_passwords_batchBulk reset from CSV (username,password per line; blank password is generated)
Bulk reset from CSV (username,password per line; blank password is generated)
No parameter schema in public metadata yet.
get_user_sessionsActive sessions for one user, timestamps in local time
Active sessions for one user, timestamps in local time
No parameter schema in public metadata yet.
logout_userKill all active sessions for one user
Kill all active sessions for one user
No parameter schema in public metadata yet.
set_user_enabledEnable or disable one user; disabling blocks all logins (custom attributes preserved)
Enable or disable one user; disabling blocks all logins (custom attributes preserved)
No parameter schema in public metadata yet.
get_user_credentialsCredential types configured for one user; an otp entry means TOTP/HOTP is set up
Credential types configured for one user; an otp entry means TOTP/HOTP is set up
No parameter schema in public metadata yet.
get_totp_usersRealm-wide TOTP adoption: how many users have an otp credential, with percentage and (optionally) the user list
Realm-wide TOTP adoption: how many users have an otp credential, with percentage and (optionally) the user list
No parameter schema in public metadata yet.
list_user_groupsWhich groups a user belongs to
Which groups a user belongs to
No parameter schema in public metadata yet.
list_users_by_groupMembers of a group
Members of a group
No parameter schema in public metadata yet.
get_brute_force_statusWhether a user is currently locked by brute-force detection
Whether a user is currently locked by brute-force detection
No parameter schema in public metadata yet.
get_realm_security_defensesRealm-level security policy: brute-force detection settings, password policy, and browser security headers
Realm-level security policy: brute-force detection settings, password policy, and browser security headers
No parameter schema in public metadata yet.
get_config_changesWhat changed in the realm configuration since a stored daily snapshot
What changed in the realm configuration since a stored daily snapshot
No parameter schema in public metadata yet.
get_login_failures_by_ipFailure breakdown by source IP (site-labeled when KEYCLOAK_SITES_INI is set)
Failure breakdown by source IP (site-labeled when KEYCLOAK_SITES_INI is set)
No parameter schema in public metadata yet.
get_ip_activityExhaustive investigation of one source IP: success/failure counts, affected users/clients, timeline
Exhaustive investigation of one source IP: success/failure counts, affected users/clients, timeline
No parameter schema in public metadata yet.
spray_checkPassword-spray detection with the breach list built in, with confidence levels and evidence tuples
Password-spray detection with the breach list built in, with confidence levels and evidence tuples
No parameter schema in public metadata yet.
detect_login_loopsFlag users who logged in too many times in a short window (redirect loops)
Flag users who logged in too many times in a short window (redirect loops)
No parameter schema in public metadata yet.
get_eventsFilter user events by type, username, client, IP, and date range
Filter user events by type, username, client, IP, and date range
No parameter schema in public metadata yet.
get_login_statsLogin success/failure totals, paginated across all results
Login success/failure totals, paginated across all results
No parameter schema in public metadata yet.
get_login_stats_by_hourLogins bucketed by hour of day (local time)
Logins bucketed by hour of day (local time)
No parameter schema in public metadata yet.
get_login_stats_by_clientLogins bucketed by client / SP
Logins bucketed by client / SP
No parameter schema in public metadata yet.
get_password_update_eventsUPDATE_PASSWORD history
UPDATE_PASSWORD history
No parameter schema in public metadata yet.
get_admin_eventsFilter admin events by operation, resource type, resource path, and date range
Filter admin events by operation, resource type, resource path, and date range
No parameter schema in public metadata yet.
get_user_attribute_historyUPDATE/ACTION events scoped to one user, for tracking custom attribute writes
UPDATE/ACTION events scoped to one user, for tracking custom attribute writes
No parameter schema in public metadata yet.
get_session_statsActive session count per client
Active session count per client
No parameter schema in public metadata yet.
get_client_sessionsActive sessions for one client (SP)
Active sessions for one client (SP)
No parameter schema in public metadata yet.
list_clientsSAML and OIDC clients in the realm
SAML and OIDC clients in the realm
No parameter schema in public metadata yet.
get_clientOne client's configuration, including authentication flow overrides, omitting secrets and signing material
One client's configuration, including authentication flow overrides, omitting secrets and signing material
No parameter schema in public metadata yet.
get_realm_rolesRealm-level roles
Realm-level roles
No parameter schema in public metadata yet.
health_checkReport the running server version and verify KeyCloak backend reachability and service account authentication
Report the running server version and verify KeyCloak backend reachability and service account authentication
No parameter schema in public metadata yet.
daily_briefOne-shot morning health check summarizing login stats, brute-force IPs, spray check, sessions, password updates, admin events, and configuration changes in a Markdown summary
One-shot morning health check summarizing login stats, brute-force IPs, spray check, sessions, password updates, admin events, and configuration changes in a Markdown summary
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
keycloak-mcp
English | 日本語
An MCP (Model Context Protocol) server for the KeyCloak Admin REST API.
Documentation: https://shigechika.github.io/keycloak-mcp/
Authenticates via a Service Account (Client Credentials Grant), so no human password or TOTP is involved. Also Infinispan-safe — it never creates user sessions and never hits the userinfo endpoint.
Features
Users
| Tool | Description |
|---|---|
count_users | Total user count in the realm |
search_users | Partial-match search (username / email / name) |
get_user | Full detail for an exact username |
reset_password | Reset one user's password |
reset_passwords_batch | Bulk reset from CSV (username,password per line; blank password is generated) |
get_user_sessions | Active sessions for one user, timestamps in local time |
logout_user | Kill all active sessions for one user |
set_user_enabled | Enable or disable one user; disabling blocks all logins (custom attributes preserved) |
MFA / Credentials
Details
- Repository
- github.com/shigechika/keycloak-mcp
- Package
keycloak-mcp- Transport
- STDIO
- Registry
- MCP registry, active