Add Skycloak to Cursor with MCP: Operate Managed Keycloak from Your IDE

Last updated: September 2026

Skycloak ships a hosted Model Context Protocol (MCP) server at https://mcp.skycloak.io. You add that URL in Cursor, complete browser OAuth, and the agent can call platform tools with the same permissions as your user. This is how you operate managed Keycloak from the IDE without pasting long-lived admin passwords into a chat.

This post covers IAM operations: clusters, realms, applications, identity providers, edge controls, and audit. Keycloak remains the open, exportable engine underneath. Skycloak is the managed control plane around it, including surfaces a raw Keycloak Admin API does not expose (custom domains, WAF, webhooks, SIEM destinations).

The full tool list is on the Skycloak MCP page and in the MCP documentation.

MCP client vs MCP server (30 seconds)

MCP client: Cursor (or Claude Code, VS Code, ChatGPT custom connector, and so on). It discovers tools and calls them.
MCP server: https://mcp.skycloak.io. It exposes Skycloak platform operations over streamable HTTP.
Authorization server: your Skycloak login (OAuth). The MCP server returns 401 with OAuth metadata on first use; the client opens a browser for sign-in.

This post is not “how to protect your own MCP resource server with Keycloak as the AS.” For that pattern, use Securing MCP servers with Keycloak OAuth 2.0. Here Skycloak is the MCP server you consume from the IDE.

What you can operate from Cursor

The hosted server exposes 129 tools (58 read, 71 write), gated by the scopes on the credential you signed in with. Categories include:

Clusters: list, create, update, upgrades, insights, maintenance windows.
Edge security and WAF: read and update cluster security, captcha domains, security logs.
Custom domains: create, verify, routes.
Webhooks and SIEM: subscriptions, destinations, test delivery.
Events, logs, exports: query events, logs, realm and cluster exports.
Realms, users, roles, groups: standard Keycloak admin surface.
Applications and SSO: OIDC clients, secrets rotation, identity providers, OIDC discovery.
Branding, themes, extensions, SMTP.

Destructive operations (for example deleting a realm, application, or identity provider) refuse unless the tool call includes explicit confirmation such as confirm=true.

That permission model is the IAM point: the assistant gets your access, not a shadow superuser.

Wire Cursor to Skycloak

1. Cursor JSON config

Cursor only needs the URL:

{
  "mcpServers": {
    "skycloak": {
      "url": "https://mcp.skycloak.io"
    }
  }
}

Save it as .cursor/mcp.json in the project or ~/.cursor/mcp.json for all projects. No API key field is required for interactive OAuth.

claude mcp add --transport http skycloak https://mcp.skycloak.io

On first use the server challenges with OAuth. Complete sign-in in the browser. After that, ask Cursor things like:

“List my Skycloak clusters and which Keycloak versions they run.”
“Which realms still allow self-registration?”
“Show identity providers on realm X and whether Google is enabled.”

Prefer read questions first. For writes, name the non-prod cluster and realm explicitly.

4. Headless or clients without OAuth

Docs allow a dashboard API key as Authorization: Bearer sk_sc_... for headless or non-OAuth clients. Treat it like any admin secret: never paste it into prompts, rotate it from the dashboard.

5. Corporate proxy allowlist

Outbound hosts that must be reachable: mcp.skycloak.io (client) and login.app.skycloak.io (browser sign-in). The server talks to the Skycloak API from its own side.

Failure modes to plan for

Over-scoped humans. If your user can delete production realms, so can the agent after you confirm. Use least-privilege Skycloak users for day-to-day agent work.

Production writes from chat. Keep a convention: agent may mutate dev and staging only unless two humans agree. Confirmation flags reduce accidents, but production changes still need your normal review process.

Confusing MCP server with Admin API automation. Terraform and GitOps remain the path for reviewed, repeatable infrastructure. MCP is for investigation, audit questions, and one-off changes. Skycloak documents that split explicitly on the MCP product page.

Building the wrong tutorial. If your goal is to put OAuth in front of your MCP tools, you want Keycloak (or Skycloak) as the authorization server for those tools, not this hosted connector. Start from the securing-MCP guide linked above, and for Claude Code or VS Code client registration see Keycloak CIMD for MCP.

Example prompts that stay safe

Read-only

“Using Skycloak MCP, list clusters and Keycloak versions. Do not change anything.”
“List realms on cluster <name> and flag any with registration allowed.”
“Show applications on realm <realm> and which are confidential.”

Guarded write (non-prod only)

“On cluster dev, realm demo, create a confidential OIDC app named billing-api with PKCE (S256) and show me the redirect URI fields before saving.”
“Rotate the client secret for application billing-api on realm demo only after I confirm the app name.”

Refuse patterns

“Delete production” without cluster, realm, and confirm=true.
“Make me realm-admin everywhere.”
Pasting API keys into the prompt when OAuth is available.

How this fits Terraform and GitOps

Keep Terraform (or realm export in git) as the system of record for reviewed config. Use MCP when you need a conversation with the live platform: incident questions, drift checks, one-off non-prod fixes, upgrade path inspection. The MCP product page states that split explicitly: Terraform for declarative review; MCP for investigation and small changes that never justified a PR.

Verify your connection

MCP server shows connected in Cursor.
A read tool call succeeds (list clusters or list realms).
A destructive tool without confirmation is rejected by the server.
You know how to cut access if the laptop is lost: revoke the API key or end the Skycloak session.

When all four pass, the setup is ready for day-to-day use.

Get started

You need a Skycloak account and at least one cluster for MCP to be useful. The MCP server is included with every plan (rate limited like the rest of the API). Start the 21-day free trial (no card) to try the realm and application tools, or pick the 7-day Expert path if you want a dedicated cluster from day one. Compliance includes SOC 2 Type II, ISO 27001, GDPR, and HIPAA.