{"server":{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","name":"io.github.ChristophEnglisch/keycloak-model-context-protocol","description":"Manage Keycloak users, groups, roles and realms through the Keycloak Admin REST API.","repository":{"url":"https://github.com/ChristophEnglisch/keycloak-model-context-protocol","source":"github"},"version":"1.0.2","packages":[{"registryType":"npm","identifier":"keycloak-model-context-protocol","version":"1.0.2","transport":{"type":"stdio"},"environmentVariables":[{"description":"Base URL of the Keycloak server, e.g. https://keycloak.example.com","isRequired":true,"format":"string","name":"KEYCLOAK_URL"},{"description":"Realm used to obtain the admin token","format":"string","default":"master","name":"KEYCLOAK_AUTH_REALM"},{"description":"Client ID used for login (default admin-cli for the password grant, required for client_credentials)","format":"string","name":"KEYCLOAK_CLIENT_ID"},{"description":"Client secret for the client_credentials grant (recommended: a dedicated service account)","format":"string","isSecret":true,"name":"KEYCLOAK_CLIENT_SECRET"},{"description":"Username for the password grant (alternative to client credentials)","format":"string","name":"KEYCLOAK_USERNAME"},{"description":"Password for the password grant","format":"string","isSecret":true,"name":"KEYCLOAK_PASSWORD"},{"description":"Grant type; auto-detected if unset (client_credentials when a secret is set, else password)","format":"string","choices":["client_credentials","password"],"name":"KEYCLOAK_GRANT_TYPE"},{"description":"If true, only read-only tools are registered","format":"boolean","default":"false","name":"KEYCLOAK_MCP_READ_ONLY"},{"description":"Comma-separated allowlist of target realms; empty means all realms","format":"string","name":"KEYCLOAK_MCP_REALMS"},{"description":"If true, write tools may modify the master realm","format":"boolean","default":"false","name":"KEYCLOAK_MCP_ALLOW_MASTER_WRITE"},{"description":"Comma-separated enabled toolsets (core, groups, roles, clients, sessions, events, security) or all","format":"string","default":"core,groups,roles","name":"KEYCLOAK_MCP_TOOLSETS"},{"description":"If true, destructive tools require confirm=true","format":"boolean","default":"true","name":"KEYCLOAK_MCP_REQUIRE_CONFIRMATION"},{"description":"HTTP timeout for Keycloak requests in milliseconds","format":"number","default":"30000","name":"KEYCLOAK_MCP_TIMEOUT_MS"},{"description":"Log level written to stderr","format":"string","default":"info","choices":["debug","info","warn","error"],"name":"KEYCLOAK_MCP_LOG_LEVEL"}]}]},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","statusChangedAt":"2026-10-24T19:06:28.331104Z","publishedAt":"2026-10-24T19:06:28.331104Z","updatedAt":"2026-10-24T19:06:28.331104Z","isLatest":true}}}