{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_h85zf3qt2wd2","handle":"keycloak-mcp-server","url":"https://wellknown.network/agents/keycloak-mcp-server","links":{"self":"https://wellknown.network/agents/keycloak-mcp-server/record.json","html":"https://wellknown.network/agents/keycloak-mcp-server","markdown":"https://wellknown.network/agents/keycloak-mcp-server/record.md","api":"https://wellknown.network/api/v1/agents/keycloak-mcp-server","status":"https://wellknown.network/api/v1/agents/keycloak-mcp-server/status","claim":"https://wellknown.network/agents/keycloak-mcp-server/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/keycloak-mcp-server/claim.json","badge":"https://wellknown.network/agents/keycloak-mcp-server/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/keycloak-mcp-server/history","tools":"https://wellknown.network/api/v1/agents/keycloak-mcp-server/tools"},"ard":{"identifier":"urn:air::server:keycloak-mcp-server","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"keycloak-mcp-server","summary":"Keycloak MCP server that calls the Admin API as the signed-in user, via OAuth","description":"# Keycloak MCP Server\n\n[![Python 3.12+](https://img.shields.io/badge/python-3.12%20|%203.13%20|%203.14-blue.svg)](https://www.python.org/downloads/)\n[![Tests](https://github.com/drtinkerer/keycloak-mcp-server/actions/workflows/test.yml/badge.svg)](https://github.com/drtinkerer/keycloak-mcp-server/actions/workflows/test.yml)\n[![Coverage](https://codecov.io/gh/drtinkerer/keycloak-mcp-server/branch/main/graph/badge.svg)](https://codecov.io/gh/drtinkerer/keycloak-mcp-server)\n[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/drtinkerer/keycloak-mcp-server)\n[![M8ven Score](https://m8ven.ai/badge/mcp/drtinkerer-keycloak-mcp-server-cbzxll?v=2fcfb8e724b3bb231a1f025ca32a655d)](https://m8ven.ai/mcp/drtinkerer-keycloak-mcp-server-cbzxll?s=readme)\n\nAn MCP server for the Keycloak Admin REST API where **every call runs as the\nsigned-in user**. Users log in to Keycloak from their MCP client (Claude Code,\n…) in the browser; the server checks *their own* access token and sends it to the\nAdmin API, so Keycloak enforces each user's existing roles. There is no shared\nadmin password or service account, and the server stores nothing.\n\n```\nMCP client ──browser login (OAuth 2.1 + PKCE)──▶ Keycloak\n     │\n     └── tool call, Bearer <user's token> ──▶ this server ──Admin API, same token──▶ Keycloak\n                     (verifies signature, audience, client)          (decides: allowed / 403)\n```\n\n## Why per-user identity\n\nMost Keycloak MCP servers authenticate with one admin account or service account,\nso anyone who can reach the server acts with its full power, and the audit trail\nshows the shared account instead of the person. Here:\n\n- **Least privilege for free**: a user with only `view-clients` can list clients\n  and gets a clean permission error for everything else.\n- **Audit trails name the real user**.\n- **No admin…","publisher":{"name":"Bhushan Rane","url":null},"homepage":"https://github.com/drtinkerer/keycloak-mcp-server","repository":"https://github.com/drtinkerer/keycloak-mcp-server/releases","version":"0.2.0","license":"Apache-2.0","protocols":["mcp"],"tags":["fastmcp","iam","keycloak","mcp","model-context-protocol","oauth"],"pricing":null,"endpoints":[{"url":"pypi:keycloak-mcp-server","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"declared"}],"categories":["security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"keycloak-mcp-server","registry":"pypi","observedAt":"2026-11-05T21:26:46.918Z","publishedAt":"2026-10-16T14:51:32.603168Z","latestVersion":"0.2.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"keycloak-mcp-server","url":"https://pypi.org/project/keycloak-mcp-server/","firstSeenAt":"2026-10-12T14:24:49.019Z","fetchedAt":"2026-11-05T21:26:02.212Z","normalizedAt":"2026-11-05T21:26:02.212Z"}]},"firstSeenAt":"2026-10-12T14:24:49.019Z","updatedAt":"2026-11-05T21:26:46.918Z"}