bibliocommons-mcp-keycloak

# Keycloak MCP Server MCP server for Keycloak Identity and Access Management instances. Auto-generates 401 tools from the Keycloak OpenAPI specification using `FastMCP.from_openapi()`. Includes [CodeMode](https://gofastmcp.com/servers/transforms/code-mode#code-mode) for efficient AI interaction with large tool sets, and supports dual authentication modes (OAuth2 HTTP transport for user sessions, client_credentials for stdio service accounts). ## Configuration **Authentication**: Keycloak supports two modes depending on transport: - **stdio (service account)**: Uses `client_credentials` or `password` grant to obtain tokens automatically - **HTTP (user OAuth)**: Uses OIDC proxy to authenticate end-users via browser flow ### Option 1: config.json ```bash cp config.json.example config.json # Edit config.json with your Keycloak credentials ``` ### Option 2: Environment Variables ```bash export KEYCLOAK_HOST="keycloak.example.com" export KEYCLOAK_REALM="master" export KEYCLOAK_CLIENT_ID="admin-cli" export KEYCLOAK_CLIENT_SECRET="your-client-secret" # Or use password grant: export KEYCLOAK_USERNAME="admin" export KEYCLOAK_PASSWORD="admin-password" export KEYCLOAK_VERIFY_SSL="true" export KEYCLOAK_CA_CERT_PATH="" export KEYCLOAK_TIMEOUT="30" ``` ## Authentication Modes ### stdio Mode (Service Account) For AI assistants connecting via stdio transport. The server acquires tokens automatically using either: - **Client credentials grant**: Set `client_id` + `client_secret`. Best for service-to-service. - **Password grant**: Set `username` + `password`. Falls back to `admin-cli` as client_id. Tokens are cached and refreshed automatically before expiry. ### HTTP Mode (User OAuth Flow) For web-based access where end-users authenticate via browser: ```bash python -m bibliocommons_mcp_keycloak --transport http --port 8000 ``` Uses OIDC proxy with your Keycloak realm's well-known configuration. Users authenticate through the standard Keycloak login page. ## Install…