KeyCloak MCP

Name: KeyCloak MCP
Author: shigechika

作者：shigechika版本 1.5.1i★ –i在你的电脑上运行

注册名称io.github.shigechika/keycloak-mcp

安装

概览

作者提供的说明（英文原文）

MCP server for KeyCloak Admin REST API via Service Account

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i非常新↓ 150/周 · ★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 其他

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
注册中心没有列出需要填写的密钥。

你需要

PyPI已安装 Python 的 uv（用于 uvx 命令）

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "keycloak": {
      "command": "uvx",
      "args": [
        "keycloak-mcp"
      ]
    }
  }
}

在终端中运行这条命令

claude mcp add keycloak -- uvx keycloak-mcp

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "keycloak": {
      "command": "uvx",
      "args": [
        "keycloak-mcp"
      ]
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "keycloak": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "keycloak-mcp"
      ]
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 shigechika 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“其他”中的其他服务器比较i

星标数多于此分类中其他 18438 个服务器的 0%
发布到注册中心的时间比此分类中其他 18438 个服务器的 71% 更新
基础检查结果等于或优于此分类中其他 18438 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

KeyCloak MCP 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（1.5.1）于17天前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Python (uv)。

有什么可以替代它？

同一分类中有：Spec Driven Development, Remote Desktop Commander, Tethered Trust

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

作者：formulahendry起步阶段↓ 66/周★ 44014个月前更新

在你的电脑上运行

安装

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

作者：desktop-commander正在增长★ 2113天前更新

在云端运行✓ desktopcommander.app

安装

Tethered Trust

Fit, compatibility and recall checks for AI agents before they buy: verdicts, evidence, receipts.

作者：tetheredtrust.com非常新今天更新

在云端运行✓ tetheredtrust.com

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

keycloak-mcp

English | 日本語

An MCP (Model Context Protocol) server for the KeyCloak Admin REST API.

Documentation: https://shigechika.github.io/keycloak-mcp/

Authenticates via a Service Account (Client Credentials Grant), so no human password or TOTP is involved. Also Infinispan-safe — it never creates user sessions and never hits the userinfo endpoint.

Features

Users

Tool	Description
`count_users`	Total user count in the realm
`search_users`	Partial-match search (username / email / name)
`get_user`	Full detail for an exact username
`reset_password`	Reset one user's password
`reset_passwords_batch`	Bulk reset from CSV (`username,password` per line; blank password is generated)
`get_user_sessions`	Active sessions for one user, timestamps in local time
`logout_user`	Kill all active sessions for one user
`set_user_enabled`	Enable or disable one user; disabling blocks all logins (custom attributes preserved)

MFA / Credentials

Tool	Description
`get_user_credentials`	Credential types configured for one user; an `otp` entry means TOTP/HOTP is set up
`get_totp_users`	Realm-wide TOTP adoption: how many users have an `otp` credential, with percentage and (optionally) the user list. Enumerates users and reads each one's credentials (N+1; bound with `max_users`)

Groups

Tool	Description
`list_user_groups`	Which groups a user belongs to
`list_users_by_group`	Members of a group

Security

Tool	Description
`get_brute_force_status`	Whether a user is currently locked by brute-force detection
`get_realm_security_defenses`	Realm-level security policy: whether brute-force detection is enabled and its thresholds, the password policy, and browser security headers
`get_config_changes`	What changed in the realm configuration since a stored daily snapshot (see Configuration snapshots). Read-only; `baseline_date` picks an older snapshot.
`get_login_failures_by_ip`	Failure breakdown by source IP (site-labeled when `KEYCLOAK_SITES_INI` is set)
`get_ip_activity`	Exhaustive investigation of one source IP: success/failure counts, affected users/clients, timeline. Returns structured JSON.
`spray_check`	Password-spray detection with the breach list built in: every external IP with ≥ 10 distinct users and < 20 % login success is a spray source, and its successful logins (evidence tuple `time / ip / username / user_id / client_id`) are the breach candidates. Each row carries a `confidence`: `high` is a breach verdict; `low` means the volume rule fired on a shared egress (school NAT, home line, VDI) — signalled by `user_success_rate` (distinct users that logged in ÷ distinct users, ≥ 0.2), `failure_concentration` (share of failures on one username, ≥ 0.5) or a `KEYCLOAK_KNOWN_EGRESS` match — and the logins are to be verified with the owner, not published. `top_failed_users` and `not_found_domains` show who kept failing and which mistyped domains produced `user_not_found`. Fixed-shape JSON, `complete: false` when the window was truncated.
`detect_login_loops`	Flag users who logged in too many times in a short window (redirect loops)

Events

Tool	Description
`get_events`	Filter by type, username, client, IP, and date range. Username is resolved to user ID internally. Failure events include KeyCloak's `error` field (e.g. `invalid_user_credentials`).
`get_login_stats`	Login success/failure totals, paginated across all results
`get_login_stats_by_hour`	Logins bucketed by hour of day (local time)
`get_login_stats_by_client`	Logins bucketed by client / SP
`get_password_update_events`	`UPDATE_PASSWORD` history

Admin Events

get_events only sees *user* events. Actions driven by an admin — or by a service account writing custom attributes — don't show up there. The admin-event endpoint fills that gap.

Tool	Description
`get_admin_events`	Filter by operation (CREATE / UPDATE / DELETE / ACTION), resource type (USER / CLIENT / ROLE / GROUP / …), resource path, and date range
`get_user_attribute_history`	UPDATE/ACTION events scoped to one user — handy for tracking when a custom attribute (e.g. `provisioning_flag`) was written by an automated pipeline

Both tools accept max_repr to control the representation payload: positive = truncate to N chars (default 500), 0 = omit, negative = include in full.

Sessions & Clients

Tool	Description
`get_session_stats`	Active session count per client
`get_client_sessions`	Active sessions for one client (SP)
`list_clients`	SAML and OIDC clients in the realm
`get_client`	One client's configuration, including its authentication flow overrides (the per-SP MFA switch). Omits `attributes` and `protocolMappers`, so no client secret or SAML signing material reaches tool output.
`get_realm_roles`	Realm-level roles

Morning Patrol

Tool Description

health_check Report the running server version and verify the KeyCloak backend is reachable and the service account can authenticate. Lightweight (one token request; no user/event/session scans). Returns a fixed-shape dict with status, auth, and the configured URL/realm. The tool's own description enumerates the values those fields can take, and is the one place that does.

daily_brief One-shot morning health check: login stats, brute-force IPs, spray check (same rule as spray_check, with breached accounts and evidence), active sessions, password updates, admin events, and configuration changes (admin events on roles, role mappings, flows, client scopes, protocol mappers, components and the realm, plus the snapshot comparison when KEYCLOAK_STATE_DIR is set; both are flagged [CONFIG]), and additions to groups that carry roles (flagged [PRIVILEGE] when the group grants a realm-management role other than the read-only query-*/view-*) in a single Markdown summary. IPs exceeding ip_failure_threshold failures (default 50) and spray sources are flagged WARNING; API errors surface as CRITICAL. since_hours controls the look-back window (default 18 h).

Setup

# uv

uv pip install keycloak-mcp

pip

pip install keycloak-mcp

From source:

git clone https://github.com/shigechika/keycloak-mcp.git

cd keycloak-mcp

uv

uv sync

pip

pip install -e .

Configuration

Variable	Description	Default
`KEYCLOAK_URL`	Base URL, e.g. `https://keycloak.example.com`	required
`KEYCLOAK_REALM`	Realm name	`master`
`KEYCLOAK_CLIENT_ID`	Service Account client ID	required
`KEYCLOAK_CLIENT_SECRET`	Client secret	required
`KEYCLOAK_SITES_INI`	INI file for IP-to-site labeling (see below)	unset
`KEYCLOAK_KNOWN_EGRESS`	Comma-separated CIDRs of known shared egress points (VDI, VPN concentrators, partner proxies). `spray_check` labels matching IPs `known_egress: true` and marks them `confidence: low`; they are never excluded	unset
`KEYCLOAK_DEFAULT_DATE_FROM_HOURS`	Default look-back window for event tools when `date_from` is omitted. Set to `0` to scan full history (can hang on large realms).	`24`
`KEYCLOAK_DEADLINE`	Per-call wall-clock budget (seconds) for the heavy event/TOTP tools. When a wide window / large realm would exceed it, the tool stops and returns a disclosed partial (⚠️ warning) instead of running past the client's ~60s gateway timeout and hammering KeyCloak. Each request's timeout is also capped at the time left, and nothing is retried past the deadline, so one slow page cannot run a call past it. `0` or negative disables.	`45`
`KEYCLOAK_MAX_EVENTS`	Per-pagination cap on events fetched by the event tools (also bounds how deep the slow high-offset pagination goes). Over the cap the result is a disclosed partial. `0` or negative disables.	`200000`
`KEYCLOAK_MAX_USERS`	Default cap on users scanned by `get_totp_users` when its `max_users` argument is `0` (each user costs one credential call). `0` or negative disables (whole realm, bounded only by `KEYCLOAK_DEADLINE`).	`5000`
`KEYCLOAK_USER_ATTRIBUTE_WHITELIST`	Comma-separated custom user-attribute keys that `get_user` is allowed to surface. Unset by default: `get_user` only ever returns username/name/email/enabled/created, since the search endpoint it resolves the username through returns a brief representation with no `attributes` at all. Opting a key in makes `get_user` do one extra by-ID lookup and append that attribute's value when present. Everything else stays out of tool output. As a safety net, a whitelisted key whose name looks credential-shaped (contains `password`, `secret`, `token`, etc.) is reported as blocked rather than shown — not a guarantee, since a credential attribute named outside that pattern list still gets through.	unset
`KEYCLOAK_GROUP_WRITE_ROOT`	Enables the opt-in group-change tools (`plan_group_changes`, `apply_group_changes`) and confines them to groups below this absolute path (e.g. `/Staff`). Unset, empty or malformed: the two tools are not registered at all. Set it only on a deployment that puts a human approval step in front of the server.	unset
`KEYCLOAK_PROTECTED_GROUPS`	`;`-separated full group paths that the group-change tools refuse to add to or remove from (descendants included). A malformed entry disables the group-change tools rather than silently dropping the protection.	unset
`KEYCLOAK_GROUP_BATCH_MAX`	Maximum rows per group-change call.	`30`
`KEYCLOAK_GROUP_MODE`	`multi` (KeyCloak's default: a user can be in many groups) or `single` for a deployment where adding a group replaces every other membership (for example an event listener that keeps one group per user). Any other value disables the group tools. See Group changes.	`multi`
`KEYCLOAK_STATE_DIR`	Directory for the daily configuration snapshots ( `/config-snapshots`, created 0700, files 0600). Unset: no snapshots; `daily_brief` still reports configuration admin events. See Configuration snapshots.	unset
`KEYCLOAK_GROUP_DEADLINE`	Time budget (seconds) for the group-change tools. A batch of 30 users needs more than the default 45 s; raise it where nothing with a ~60 s timeout sits in front of the server (for example a client that spawns it directly). Unset: `KEYCLOAK_DEADLINE`.	unset
`KEYCLOAK_SESSION_PROBES`	Separate connections whose session listings `get_user_sessions` (and the remaining-session count of `set_user_enabled`) merges. Behind a load balancer, KeyCloak nodes that do not share user sessions (no distributed Infinispan cache) each list only their own.	`8`
`KEYCLOAK_LOGOUT_CLEAN_PROBES`	`logout_user` keeps probing — each probe on its own connection lists the sessions and logs the user out on the node it reached when that node lists a session — until this many probes in a row see no session. The first probe sends the logout even when it lists nothing: it also sets the user's `notBefore` in the database, which all nodes check, and the tool reports it. Which node a new connection reaches is up to the load balancer: under source-IP affinity the probes may never reach some node, so `notBefore` is the effect that holds on every node. Where sessions are shared, set this and `KEYCLOAK_SESSION_PROBES` to `1`.	`10`

| KEYCLOAK_LOGOUT_MAX_PROBES | Upper bound on logout_user probes; if sessions are still seen at the bound, the tool says so (⚠️) instead of reporting success. The probes, like the session listings of get_user_sessions and set_user_enabled, are bounded by `KEYCLOAK_DEA

只显示了开头部分；其余内容请在仓库中阅读