Spec Driven Development
de formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Se ejecuta en tu computadora★ 440MITActualizado hace 14 meses
Instalar
KeyCloak MCP
Resumen
Descripción del creador (original en inglés)
MCP server for KeyCloak Admin REST API via Service Account
Los tres pilares de PopNx MCP
Estos tres nunca se combinan en una sola puntuación: las opiniones, las mediciones y la popularidad son cosas distintas.
- Opinión de usuariosiAún no hay reseñasLas reseñas se abrirán junto con las cuentas en una etapa posterior
- Nuestras revisiones básicasi1 de 1 superadasRevisado con información pública; el código aún no se ha escaneado
- UsoiAún sin medir★ –
Qué puedes hacer con él
Todavía no escribimos un resumen sencillo para este. Abajo están los datos que leímos del registro.
- Conexión: Se ejecuta en tu computadora
- Transporte: stdio
- Categoría: Otros
Instalación
Elige la app de IA que usas y copia la configuración.
Antes de instalar
- Revisiones básicas: 1 de 1 superadas
- Se ejecuta en tu computadora con los permisos de tu usuario (archivos, red, apps).
- El registro no indica ninguna clave que completar.
Necesitas
- PyPIuv de Python instalado (para el comando uvx)
¿Qué app usas?
Elige tu app arriba. La recordamos, así que la próxima vez el botón dirá “Instalar en …”.
Abre Claude Desktop → Settings → Developer → Edit Config y pega esto en claude_desktop_config.json
{
"mcpServers": {
"keycloak": {
"command": "uvx",
"args": [
"keycloak-mcp"
]
}
}
}Ejecuta esto en tu terminal
claude mcp add keycloak -- uvx keycloak-mcpO copia la configuración tú
Pégalo en .cursor/mcp.json de tu proyecto, o en ~/.cursor/mcp.json
{
"mcpServers": {
"keycloak": {
"command": "uvx",
"args": [
"keycloak-mcp"
]
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
O copia la configuración tú
Pégalo en .vscode/mcp.json de tu proyecto
{
"servers": {
"keycloak": {
"type": "stdio",
"command": "uvx",
"args": [
"keycloak-mcp"
]
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
Este se ejecuta en tu computadora, y ChatGPT solo puede conectarse a servidores en internet. Elige otra app.
Tu elección se guarda en una cookie en este dispositivo; no necesitas cuenta.
Esta configuración se genera a partir de la ficha del creador en el registro. Si el README dice otra cosa, sigue el README.
Qué puede hacer
Se ejecuta en tu computadora; la lista de herramientas aparece en tu app de IA después de instalarlo.
Revisiones básicasi
Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 7 nov 2026
- ✓ Superada
El creador coincide con el repo
El nombre en el registro se verificó con la cuenta de GitHub shigechika, dueña del repo
- … Aún sin revisar
Sigue en mantenimiento
Todavía no hemos leído este repo en GitHub
- … Aún sin revisar
Tiene licencia
Todavía no hemos leído este repo en GitHub
- – No aplica
El endpoint responde
Este se ejecuta en tu computadora; no hay endpoint en internet
- – No aplica
Inicio de sesión con OAuth
Se ejecuta en tu computadora y usa ajustes locales en su lugar
- … Aún sin revisar
Sin instrucciones ocultas en las descripciones de herramientas
Se ejecuta en tu computadora; solo podemos leer listas de herramientas de endpoints en internet
Comparado con otros en Otrosi
- Más estrellas que el 0% de los otros 18348 servidores de esta categoría
- Publicado en el registro más recientemente que el 72% de los otros 18348 servidores de esta categoría
- Revisiones básicas iguales o mejores que el 100% de los otros 18348 servidores de esta categoría
Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.
Preguntas frecuentes
¿Es seguro KeyCloak MCP?
Superó 1 de 1 revisiones básicas aplicables. No hemos leído el código. Antes de agregar una clave o un token, revisa qué acceso pide el servidor y usa una clave que tenga solo los permisos que necesitas.
¿Qué claves o códigos necesita?
El registro no indica ninguna clave obligatoria, aunque algunos servidores te piden iniciar sesión la primera vez que los usas.
¿Se ejecuta en mi computadora o en la nube?
Se ejecuta en tu computadora. Tu app de IA lo inicia cuando hace falta, y los datos no pasan por los servidores del creador (a menos que el propio servidor llame a un servicio en línea).
¿Sigue en mantenimiento?
El repo de GitHub cambió por última vez –, y la última versión (1.5.1) llegó al registro hace 16 días.
¿Qué apps pueden usarlo?
Las apps compatibles con MCP, como Claude Desktop, Claude Code, Cursor y VS Code. También necesitas Python (uv) en tu computadora.
¿Qué puedo usar en su lugar?
En la misma categoría: Spec Driven Development, Remote Desktop Commander, 好縮 Short
Alternativas
Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.
Cómo leer una tarjeta:★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi
Remote Desktop Commander
de desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Se ejecuta en la nube★ 211Actualizado anteayer
Instalar
好縮 Short
de gooonamee
Smart URL shortener: create, tag and track short links on s.gooo.name.
Se ejecuta en la nubeActualizado hoy
Instalar
README del creador
Abrir el README
Copiado tal cual del repo del creador. PopNx MCP no lo ha revisado ni lo respalda. Se quitaron HTML, imágenes y scripts. Los enlaces llevan fuera de este sitio.
keycloak-mcp
English | 日本語
An MCP (Model Context Protocol) server for the KeyCloak Admin REST API.
Documentation: https://shigechika.github.io/keycloak-mcp/
Authenticates via a Service Account (Client Credentials Grant), so no human password or TOTP is involved. Also Infinispan-safe — it never creates user sessions and never hits the userinfo endpoint.
Features
Users
| Tool | Description |
|---|---|
count_users | Total user count in the realm |
search_users | Partial-match search (username / email / name) |
get_user | Full detail for an exact username |
reset_password | Reset one user's password |
reset_passwords_batch | Bulk reset from CSV (username,password per line; blank password is generated) |
get_user_sessions | Active sessions for one user, timestamps in local time |
logout_user | Kill all active sessions for one user |
set_user_enabled | Enable or disable one user; disabling blocks all logins (custom attributes preserved) |
MFA / Credentials
| Tool | Description |
|---|---|
get_user_credentials | Credential types configured for one user; an otp entry means TOTP/HOTP is set up |
get_totp_users | Realm-wide TOTP adoption: how many users have an otp credential, with percentage and (optionally) the user list. Enumerates users and reads each one's credentials (N+1; bound with max_users) |
Groups
| Tool | Description |
|---|---|
list_user_groups | Which groups a user belongs to |
list_users_by_group | Members of a group |
Security
| Tool | Description |
|---|---|
get_brute_force_status | Whether a user is currently locked by brute-force detection |
get_realm_security_defenses | Realm-level security policy: whether brute-force detection is enabled and its thresholds, the password policy, and browser security headers |
get_config_changes | What changed in the realm configuration since a stored daily snapshot (see *Configuration snapshots*). Read-only; baseline_date picks an older snapshot. |
get_login_failures_by_ip | Failure breakdown by source IP (site-labeled when KEYCLOAK_SITES_INI is set) |
get_ip_activity | Exhaustive investigation of one source IP: success/failure counts, affected users/clients, timeline. Returns structured JSON. |
spray_check | Password-spray detection with the breach list built in: every external IP with ≥ 10 distinct users and < 20 % login success is a spray source, and its successful logins (evidence tuple time / ip / username / user_id / client_id) are the breach candidates. Each row carries a confidence: high is a breach verdict; low means the volume rule fired on a shared egress (school NAT, home line, VDI) — signalled by user_success_rate (distinct users that logged in ÷ distinct users, ≥ 0.2), failure_concentration (share of failures on one username, ≥ 0.5) or a KEYCLOAK_KNOWN_EGRESS match — and the logins are to be verified with the owner, not published. top_failed_users and not_found_domains show who kept failing and which mistyped domains produced user_not_found. Fixed-shape JSON, complete: false when the window was truncated. |
detect_login_loops | Flag users who logged in too many times in a short window (redirect loops) |
Events
| Tool | Description |
|---|---|
get_events | Filter by type, username, client, IP, and date range. Username is resolved to user ID internally. Failure events include KeyCloak's error field (e.g. invalid_user_credentials). |
get_login_stats | Login success/failure totals, paginated across all results |
get_login_stats_by_hour | Logins bucketed by hour of day (local time) |
get_login_stats_by_client | Logins bucketed by client / SP |
get_password_update_events | UPDATE_PASSWORD history |
Admin Events
get_events only sees *user* events. Actions driven by an admin — or by a service account writing custom attributes — don't show up there. The admin-event endpoint fills that gap.
| Tool | Description |
|---|---|
get_admin_events | Filter by operation (CREATE / UPDATE / DELETE / ACTION), resource type (USER / CLIENT / ROLE / GROUP / …), resource path, and date range |
get_user_attribute_history | UPDATE/ACTION events scoped to one user — handy for tracking when a custom attribute (e.g. provisioning_flag) was written by an automated pipeline |
Both tools accept max_repr to control the representation payload: positive = truncate to N chars (default 500), 0 = omit, negative = include in full.
Sessions & Clients
| Tool | Description |
|---|---|
get_session_stats | Active session count per client |
get_client_sessions | Active sessions for one client (SP) |
list_clients | SAML and OIDC clients in the realm |
get_client | One client's configuration, including its authentication flow overrides (the per-SP MFA switch). Omits attributes and protocolMappers, so no client secret or SAML signing material reaches tool output. |
get_realm_roles | Realm-level roles |
Morning Patrol
| Tool | Description |
|---|---|
health_check | Report the running server version and verify the KeyCloak backend is reachable and the service account can authenticate. Lightweight (one token request; no user/event/session scans). Returns a fixed-shape dict with status, auth, and the configured URL/realm. The tool's own description enumerates the values those fields can take, and is the one place that does. |
daily_brief | One-shot morning health check: login stats, brute-force IPs, spray check (same rule as spray_check, with breached accounts and evidence), active sessions, password updates, admin events, and configuration changes (admin events on roles, role mappings, flows, client scopes, protocol mappers, components and the realm, plus the snapshot comparison when KEYCLOAK_STATE_DIR is set; both are flagged [CONFIG]), and additions to groups that carry roles (flagged [PRIVILEGE] when the group grants a realm-management role other than the read-only query-*/view-*) in a single Markdown summary. IPs exceeding ip_failure_threshold failures (default 50) and spray sources are flagged WARNING; API errors surface as CRITICAL. since_hours controls the look-back window (default 18 h). |
Setup
# uvuv pip install keycloak-mcp
pip
pip install keycloak-mcp
From source:
git clone https://github.com/shigechika/keycloak-mcp.gitcd keycloak-mcp
uv
uv sync
pip
pip install -e .
Configuration
| Variable | Description | Default |
|---|---|---|
KEYCLOAK_URL | Base URL, e.g. https://keycloak.example.com | *required* |
KEYCLOAK_REALM | Realm name | master |
KEYCLOAK_CLIENT_ID | Service Account client ID | *required* |
KEYCLOAK_CLIENT_SECRET | Client secret | *required* |
KEYCLOAK_SITES_INI | INI file for IP-to-site labeling (see below) | *unset* |
KEYCLOAK_KNOWN_EGRESS | Comma-separated CIDRs of known shared egress points (VDI, VPN concentrators, partner proxies). spray_check labels matching IPs known_egress: true and marks them confidence: low; they are never excluded | *unset* |
KEYCLOAK_DEFAULT_DATE_FROM_HOURS | Default look-back window for event tools when date_from is omitted. Set to 0 to scan full history (can hang on large realms). | 24 |
KEYCLOAK_DEADLINE | Per-call wall-clock budget (seconds) for the heavy event/TOTP tools. When a wide window / large realm would exceed it, the tool stops and returns a disclosed partial (⚠️ warning) instead of running past the client's ~60s gateway timeout and hammering KeyCloak. Each request's timeout is also capped at the time left, and nothing is retried past the deadline, so one slow page cannot run a call past it. 0 or negative disables. | 45 |
KEYCLOAK_MAX_EVENTS | Per-pagination cap on events fetched by the event tools (also bounds how deep the slow high-offset pagination goes). Over the cap the result is a disclosed partial. 0 or negative disables. | 200000 |
KEYCLOAK_MAX_USERS | Default cap on users scanned by get_totp_users when its max_users argument is 0 (each user costs one credential call). 0 or negative disables (whole realm, bounded only by KEYCLOAK_DEADLINE). | 5000 |
KEYCLOAK_USER_ATTRIBUTE_WHITELIST | Comma-separated custom user-attribute keys that get_user is allowed to surface. Unset by default: get_user only ever returns username/name/email/enabled/created, since the search endpoint it resolves the username through returns a brief representation with no attributes at all. Opting a key in makes get_user do one extra by-ID lookup and append that attribute's value when present. Everything else stays out of tool output. As a safety net, a whitelisted key whose name looks credential-shaped (contains password, secret, token, etc.) is reported as blocked rather than shown — not a guarantee, since a credential attribute named outside that pattern list still gets through. | *unset* |
KEYCLOAK_GROUP_WRITE_ROOT | Enables the opt-in group-change tools (plan_group_changes, apply_group_changes) and confines them to groups below this absolute path (e.g. /Staff). Unset, empty or malformed: the two tools are not registered at all. Set it only on a deployment that puts a human approval step in front of the server. | *unset* |
KEYCLOAK_PROTECTED_GROUPS | ;-separated full group paths that the group-change tools refuse to add to or remove from (descendants included). A malformed entry disables the group-change tools rather than silently dropping the protection. | *unset* |
KEYCLOAK_GROUP_BATCH_MAX | Maximum rows per group-change call. | 30 |
KEYCLOAK_GROUP_MODE | multi (KeyCloak's default: a user can be in many groups) or single for a deployment where adding a group replaces every other membership (for example an event listener that keeps one group per user). Any other value disables the group tools. See *Group changes*. | multi |
KEYCLOAK_STATE_DIR | Directory for the daily configuration snapshots ( /config-snapshots, created 0700, files 0600). Unset: no snapshots; daily_brief still reports configuration admin events. See *Configuration snapshots*. | *unset* |
KEYCLOAK_GROUP_DEADLINE | Time budget (seconds) for the group-change tools. A batch of 30 users needs more than the default 45 s; raise it where nothing with a ~60 s timeout sits in front of the server (for example a client that spawns it directly). Unset: KEYCLOAK_DEADLINE. | *unset* |
KEYCLOAK_SESSION_PROBES | Separate connections whose session listings get_user_sessions (and the remaining-session count of set_user_enabled) merges. Behind a load balancer, KeyCloak nodes that do not share user sessions (no distributed Infinispan cache) each list only their own. | 8 |
KEYCLOAK_LOGOUT_CLEAN_PROBES | logout_user keeps probing — each probe on its own connection lists the sessions and logs the user out on the node it reached when that node lists a session — until this many probes in a row see no session. The first probe sends the logout even when it lists nothing: it also sets the user's notBefore in the database, which all nodes check, and the tool reports it. Which node a new connection reaches is up to the load balancer: under source-IP affinity the probes may never reach some node, so notBefore is the effect that holds on every node. Where sessions are shared, set this and KEYCLOAK_SESSION_PROBES to 1. | 10 |
| KEYCLOAK_LOGOUT_MAX_PROBES | Upper bound on logout_user probes; if sessions are still seen at the bound, the tool says so (⚠️) instead of reporting success. The probes, like the session listings of get_user_sessions and set_user_enabled, are bounded by `KEYCLOAK_DEA
Solo se muestra el principio; lee el resto en el repo