MCP Server

The Skycloak MCP server lets an MCP client (Claude Desktop, Claude Code, Cursor) manage your clusters, realms, applications, identity providers, users, and branding directly. It speaks the Model Context Protocol and signs in with your browser, so there is nothing to install and no API key to manage.

Hosted server (recommended)

Point your client at https://mcp.skycloak.io. Nothing to download.

claude mcp add --transport http skycloak https://mcp.skycloak.io

For a client that takes JSON config:

{
  "mcpServers": {
    "skycloak": {
      "type": "http",
      "url": "https://mcp.skycloak.io"
    }
  }
}

On first use the server returns a 401 carrying its OAuth metadata, and your client opens a browser for you to sign in. No API key to create, copy, or rotate.

If your client does not speak OAuth, or you are running headless, send an API key from the dashboard instead:

curl -H "Authorization: Bearer sk_sc_..." https://mcp.skycloak.io

Permissions and safety

Your agent gets exactly what you get. Tools are registered against the scopes on the credential you signed in with, so an account that cannot delete a realm cannot delete one through an agent either.
Destructive tools demand an explicit confirmation. Deleting a realm, an application, or an identity provider requires confirm=true. Without it the tool refuses and says so, rather than guessing.
Rate limited per plan. On a 429 the server returns Retry-After.

Tool surface

The server exposes 129 tools: 58 read and 71 write. The write column marks the tools that change something. Which of them you actually get depends on the scopes of the credential you signed in with.

Area	Read	Write
Clusters	`get_cluster`, `get_cluster_credentials`, `get_cluster_insights`, `get_cluster_maintenance_window`, `get_cluster_upgrade_path`, `list_cluster_features`, `list_cluster_locations`, `list_cluster_types`, `list_cluster_upgrades`, `list_cluster_versions`, `list_clusters`	`cancel_cluster_upgrade`, `create_cluster`, `delete_cluster`, `delete_cluster_maintenance_window`, `set_cluster_maintenance_window`, `update_cluster`
Edge security & WAF	`get_cluster_security`, `get_security_logs`, `list_cluster_captcha_domains`	`add_cluster_captcha_domain`, `remove_cluster_captcha_domain`, `update_cluster_security`
Custom domains	`get_domain`, `get_domain_route`, `list_domain_routes`, `list_domains`	`create_domain`, `create_domain_route`, `delete_domain`, `delete_domain_route`, `update_domain_route`, `verify_domain`
Webhooks	`get_webhook_subscription`, `list_webhook_event_types`, `list_webhook_subscriptions`	`create_webhook_subscription`, `delete_webhook_subscription`, `test_webhook_subscription`, `update_webhook_subscription`
SIEM destinations	`get_siem_destination`, `list_siem_destinations`	`create_siem_destination`, `delete_siem_destination`, `test_siem_destination`, `update_siem_destination`
Events, logs & exports	`get_export`, `get_login_branding`, `get_logs`, `get_realm_export`, `get_realm_import`, `list_exports`, `query_events`	`create_export`, `create_realm_export`, `create_realm_import`, `create_realm_import_upload_url`, `delete_export`, `delete_login_branding`, `export_cluster_events`, `upsert_login_branding`
Realms	`get_realm`, `list_realms`	`create_realm`, `delete_realm`, `update_realm`
Users, roles & groups	`get_realm_group`, `get_realm_role`, `get_realm_user`, `list_realm_group_members`, `list_realm_groups`, `list_realm_roles`, `list_realm_users`, `list_user_groups`, `list_user_roles`	`add_realm_user_to_group`, `assign_realm_user_role`, `create_realm_group`, `create_realm_role`, `create_realm_user`, `delete_realm_group`, `delete_realm_role`, `delete_realm_user`, `remove_realm_user_from_group`, `remove_realm_user_role`, `update_realm_group`, `update_realm_role`, `update_realm_user`
Applications & SSO	`discover_oidc`, `get_application`, `get_identity_provider`, `list_application_roles`, `list_application_sessions`, `list_applications`, `list_identity_provider_templates`, `list_identity_providers`	`assign_application_role`, `create_application`, `create_identity_provider`, `delete_application`, `delete_identity_provider`, `remove_application_role`, `rotate_application_secret`, `test_identity_provider`, `update_application`, `update_identity_provider`
Branding & themes	`download_theme_content`, `get_client_theme_assignment`, `get_email_branding`, `get_theme`, `get_theme_assignment`, `list_themes`	`delete_email_branding`, `delete_theme`, `set_client_theme_assignment`, `set_theme_assignment`, `update_theme`, `upsert_email_branding`
Extensions	`list_cluster_extensions`, `list_extensions`	`delete_extension`, `install_extension`, `uninstall_extension`, `update_extension`, `upgrade_extension`
SMTP	`get_smtp`	`delete_smtp`, `test_smtp`, `upsert_smtp`

A few conventions worth knowing: create_cluster is asynchronous, so poll get_cluster until the cluster is available. create_domain returns the DNS records you must create, and verify_domain triggers the check. set_theme_assignment activates a custom theme per Keycloak theme type, and an empty string resets to the built-in default.

Behind a corporate proxy

You do not need to configure any of this by hand. Your client discovers where to send you. It only matters if you are on a network that allowlists outbound hosts, in which case two need to be reachable:

Host	Reached by	When
`mcp.skycloak.io`	your MCP client	every request
`login.app.skycloak.io`	your browser	first sign-in, and when the session expires

Nothing else. The server talks to the Skycloak API from its own side, so that traffic never leaves your machine.

Last updated on August 17, 2026