Serveur MCP pour Keycloak

Votre Managed Keycloak, dans la conversation.

Q: How do I connect it to Claude, ChatGPT, Gemini, Grok or Cursor?

Give the client the URL https://mcp.skycloak.io and it does the rest. In Claude, ChatGPT, Gemini and Grok that means adding a custom connector; in Claude Code it is claude mcp add --transport http skycloak https://mcp.skycloak.io; in Cursor, VS Code and other editors it is a JSON entry with "type": "http" and that URL. On first use the server returns a 401 carrying its OAuth metadata and the client opens a browser for you to sign in. See the MCP documentation for the full setup.

Le serveur MCP Skycloak donne à n'importe quel client MCP, Claude, ChatGPT, Gemini, Grok ou votre éditeur, toute votre plateforme : clusters, realms, applications, SSO, domaines personnalisés, WAF, webhooks, SIEM et branding. Une commande, connexion navigateur, rien à installer.

Read the MCP docs Start essai gratuit

terminal bash

$ claude mcp add --transport http skycloak https://mcp.skycloak.io

C'est Claude Code. Partout ailleurs, vous collez la même URL : un connecteur personnalisé dans Claude, ChatGPT, Gemini ou Grok, une entrée JSON dans Cursor ou VS Code. Pas de clé API à créer, coller dans un fichier de configuration ou oublier de faire tourner.

Tout ce que l'API peut faire

Pas seulement le realm. La plateforme qui l'entoure.

Pointez un agent vers une API admin Keycloak et il peut éditer des realms. Il ne peut pas provisionner un cluster, vérifier un domaine personnalisé, modifier une règle WAF ou envoyer des événements à votre SIEM. Ces surfaces sont la plateforme managée, et c'est exactement là qu'un assistant économise le plus de temps.

Clusters

Provision, resize, upgrade and inspect the managed Keycloak clusters themselves.

list_clusters get_cluster create_cluster update_cluster list_cluster_upgrades get_cluster_upgrade_path get_cluster_insights

Edge security & WAF

Read and change the protection in front of the cluster, not just the settings inside it.

get_cluster_security update_cluster_security

Custom domains

Add a domain, get back the DNS records to create, then trigger verification and manage routes.

list_domains create_domain verify_domain list_domain_routes create_domain_route

Webhooks

Subscribe to platform events, inspect what is subscribed, and fire a test delivery.

list_webhook_subscriptions list_webhook_event_types create_webhook_subscription test_webhook_subscription

SIEM destinations

Wire cluster events into Splunk, Datadog, Sentinel or a webhook sink, and test the pipe.

list_siem_destinations create_siem_destination update_siem_destination test_siem_destination

Events, logs & exports

Query authentication and admin events, read logs, and export realms or event history.

query_events get_logs create_export export_cluster_events create_realm_export

Realms, users & roles

The Keycloak layer: realms, users, roles, groups and membership.

list_realms create_realm list_realm_users create_realm_user assign_realm_user_role add_realm_user_to_group

Applications & SSO

OIDC and SAML clients, their roles and sessions, plus the identity providers behind sign-in.

list_applications create_application rotate_application_secret list_identity_providers create_identity_provider discover_oidc

Branding & themes

list_themes set_theme_assignment upsert_login_branding upsert_email_branding

Extensions & SMTP

Install and upgrade Keycloak extensions, and configure or test outbound mail.

list_extensions install_extension upgrade_extension get_smtp upsert_smtp test_smtp

Choses à lui demander réellement

Questions pour lesquelles un tableau de bord vous fait cliquer.

Huit tâches que les équipes confient au serveur MCP chaque jour, s'exécutant sur une plateforme en direct. Choisissez-en une, ou laissez-le jouer.

skycloak-mcp ~ connected to mcp.skycloak.io example

Which realms across my clusters still have self-registration enabled?

skycloak_list_clusters 3 clusters

skycloak_list_realms 11 realms across 3 clusters

Checked 11 realms across 3 clusters. 2 still allow self-registration:

prod-eu / acme registrationAllowed: true

staging-eu / checkout registrationAllowed: true

The other 9 have it off. Want me to disable those two?

Connectez-le

$ claude mcp add --transport http skycloak https://mcp.skycloak.io

That is Claude Code. Everywhere else you paste the same URL: a custom connector in Claude, ChatGPT, Gemini or Grok, a JSON entry in Cursor or VS Code. No API key to create or rotate.

Bounded by your own access. Read questions run against your live platform. Anything that changes state is limited to your permissions, and deletions refuse to run without an explicit confirm=true.

Permissions

Votre agent obtient exactement l'accès que vous avez.

The scary part of handing an assistant your fournisseur d'identité is not that it does nothing useful. It is that it does something very useful to the wrong realm. So there is no second permission system to reason about.

Un seul modèle de permissions

Les outils sont enregistrés contre les scopes du credential avec lequel vous vous êtes connecté. Si votre compte ne peut pas faire tourner un secret client, votre assistant non plus. Rien à configurer, rien qui puisse dériver par rapport à votre accès réel.

Les outils destructifs refusent par défaut

Deleting a realm, an application or an fournisseur d'identité requires an explicit confirm=true. Without it the tool declines and says why, so an ambiguous instruction cannot cascade into a deletion.

OAuth standard, pas de secret partagé

La connexion s'effectue via votre compte Skycloak sur OAuth. Il n'y a pas de clé longue durée dans un fichier de configuration sur un laptop, et révoquer l'accès est la même action que vous utilisez déjà.

FAQ

Le serveur MCP, répondu.

What is an MCP server for Keycloak?

An MCP server for Keycloak is a hosted Model Context Protocol endpoint that lets an AI assistant read and change your identity infrastructure through defined tools instead of a dashboard or hand-written API calls. The Skycloak one lives at https://mcp.skycloak.io and exposes every operation the Skycloak platform API supports, spanning managed Keycloak clusters, realms, applications, identity providers, users, custom domains, edge security and WAF, webhooks, SIEM destinations, branding, extensions, SMTP and audit logs. You connect with one command and sign in through your browser over OAuth, there is nothing to install, and an assistant only ever gets the access the signed-in account already has.

How do I connect it to Claude, ChatGPT, Gemini, Grok or Cursor?

Give the client the URL https://mcp.skycloak.io and it does the rest. In Claude, ChatGPT, Gemini and Grok that means adding a custom connector; in Claude Code it is claude mcp add --transport http skycloak https://mcp.skycloak.io; in Cursor, VS Code and other editors it is a JSON entry with "type": "http" and that URL. On first use the server returns a 401 carrying its OAuth metadata and the client opens a browser for you to sign in. See the MCP documentation for the full setup.

Do I need an API key?

No. The hosted server implements OAuth discovery, so your client finds the authorization server on its own and opens a browser for you to approve. There is no key to create, paste into a config file, or rotate. If your client does not speak OAuth, or you are running headless in CI, you can send a Skycloak API key as a bearer token instead.

Can an AI assistant delete my production realm?

Only if you can. Tools are registered against the scopes of the credential you signed in with, so the assistant inherits exactly your access and never more. On top of that, destructive tools such as deleting a realm, an application or an identity provider refuse to run unless they are passed an explicit confirm=true, so a vague instruction cannot cascade into a deletion.

Is this just for Keycloak configuration?

No, and that is the main difference from pointing an agent at a Keycloak admin API. The Skycloak MCP server reaches the managed platform around Keycloak as well: provisioning and upgrading clusters, custom domains and their DNS verification, the WAF and edge security rules, webhook subscriptions, SIEM destinations, extensions, SMTP and branding. Those surfaces do not exist in the Keycloak admin API at all.

Which MCP clients does it work with?

Any spec-compliant one. It speaks streamable HTTP, the standard MCP remote transport, and authenticates over OAuth, so it is not tied to a vendor. That covers the assistants with custom-connector support (Claude, ChatGPT, Gemini, Grok) and the editors and agents that speak MCP (Cursor, VS Code, Windsurf, Zed, Cline, Goose). Claude Code and Cursor are the ones we test against on every release.

What does it cost?

Nothing extra. The MCP server is included with every Skycloak plan and is rate limited per plan like the rest of the API. You need a Skycloak account and at least one cluster for it to be useful.

How is this different from the Terraform provider?

They solve different halves of the same problem. The Terraform provider is for declarative, reviewed, repeatable infrastructure that lives in version control. The MCP server is for the conversational half: investigating, auditing and answering questions, plus the one-off changes that never justified a pull request. Most teams end up using both.

Démarrer l'essai gratuit Documentation MCP