Skycloak
About
Model Context Protocol server for Skycloak managed Keycloak. Manage clusters, realms, applications, SSO and users from any MCP client.
Details
- Author
- sky-cloak
- Downloads
- 172
- Transport
- SSE
- Categories
- Developer Tools, Security
Jump to
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
SkycloakCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
{
"mcpServers": {
"skycloak": {
"type": "http",
"url": "https://mcp.skycloak.io"
}
}
}
skycloak_add_cluster_captcha_domain
Register a hostname for CAPTCHA protection on a cluster.
skycloak_add_realm_user_to_group
Add a user to a realm group.
skycloak_assign_application_role
Grant a role to an application's service account. Provide role_client_id for a client role, or omit it for a realm role.
skycloak_assign_realm_user_role
Assign a realm role to a user.
skycloak_cancel_cluster_upgrade
Cancel an in-progress cluster version upgrade. Set confirm=true to proceed.
skycloak_create_application
Create an OIDC/SAML client (application) in a realm. Returns the client secret for confidential clients (store it; it is not retrievable later).
skycloak_create_cluster
Provision a new Keycloak cluster. Asynchronous: the returned cluster starts in a provisioning state — poll skycloak_get_cluster until its status is 'available'. Requires --allow-writes.
skycloak_create_domain
Add a custom domain to a cluster. Returns the DNS records the customer must create to verify and route the domain.
skycloak_create_domain_route
Add a realm route to a custom domain.
skycloak_create_export
Start a database export for a cluster. Asynchronous: poll skycloak_get_export until the status is 'completed' to obtain the download URL. Including credentials requires an encryption_password.
skycloak_create_identity_provider
Create an OIDC identity provider (SSO connection) in a realm.
skycloak_create_realm
Create a new Keycloak realm in a cluster. Requires the server to be started with --allow-writes and a write-scoped API key.
skycloak_create_realm_export
Export a Keycloak realm to an encrypted archive. Asynchronous: poll skycloak_get_realm_export until status is 'completed'. The archive is always encrypted, so encryption_password is required, and the same password is needed to import it again. This is a realm export (one realm's configuration); skycloak_create_export is the separate whole-cluster database export.
skycloak_create_realm_group
Create a realm group, optionally nested under a parent group.
skycloak_create_realm_import
Import a Keycloak realm into a cluster from an uploaded archive or an existing realm export. Asynchronous: poll skycloak_get_realm_import. Creates a new realm: preflight refuses a name collision rather than overwriting, so an existing realm of the same name fails with 409. It does import users and their credentials, so set confirm=true to proceed.
skycloak_create_realm_import_upload_url
Get a presigned URL to upload a realm archive to. PUT the archive to upload_url, then pass the returned s3_key to skycloak_create_realm_import as upload_s3_key. Not needed when importing an existing export: pass that export's ID as source_export_id instead.
skycloak_create_realm_role
Create a realm-scoped role.
skycloak_create_realm_user
Create a realm user with an initial temporary password.
skycloak_create_siem_destination
Create a SIEM destination. Credentials are write-only and are not returned.
skycloak_create_webhook_subscription
Create a webhook subscription. Signing secrets and authorization headers are write-only.
skycloak_delete_application
Delete an application (OIDC/SAML client) from a realm. Set confirm=true to proceed.
skycloak_delete_cluster
Permanently delete a Keycloak cluster and all of its realms and data. Irreversible. Set confirm=true to proceed.
skycloak_delete_cluster_maintenance_window
Delete a cluster-specific maintenance window so the cluster follows the workspace default. Set confirm=true to proceed.
skycloak_delete_domain
Remove a custom domain from a cluster. Set confirm=true to proceed.
skycloak_delete_domain_route
Remove a realm route from a custom domain. Set confirm=true to proceed.
skycloak_delete_email_branding
Revert email branding to defaults. Set confirm=true to proceed.
skycloak_delete_export
Delete a database export archive. Set confirm=true to proceed.
skycloak_delete_extension
Delete a custom extension from the workspace catalog. Set confirm=true to proceed.
skycloak_delete_identity_provider
Delete an identity provider from a realm. Set confirm=true to proceed.
skycloak_delete_login_branding
Revert login branding to defaults. Set confirm=true to proceed.
skycloak_delete_realm
Permanently delete a realm and all of its users, clients and configuration. This is irreversible. Set confirm=true to proceed.
skycloak_delete_realm_group
Delete a realm group. Set confirm=true to proceed.
skycloak_delete_realm_role
Delete a realm role. Set confirm=true to proceed.
skycloak_delete_realm_user
Delete a realm user. Set confirm=true to proceed.
skycloak_delete_siem_destination
Delete a SIEM destination. Set confirm=true to proceed.
skycloak_delete_smtp
Remove a realm's SMTP configuration. Set confirm=true to proceed.
skycloak_delete_theme
Delete a custom theme. Set confirm=true to proceed.
skycloak_delete_webhook_subscription
Delete a webhook subscription. Set confirm=true to proceed.
skycloak_discover_oidc
Resolve an OIDC issuer's discovery document to obtain its authorization, token, and userinfo endpoints. Use the result when creating an identity provider.
skycloak_download_theme_content
Download a custom theme's content archive. Returns size and SHA-256 always, and the archive itself only when it is small enough to inline.
skycloak_export_cluster_events
Export a cluster's events as a document and return its contents.
skycloak_get_application
Get an application (OIDC/SAML client) by client ID.
skycloak_get_client_theme_assignment
Get a client's login-theme override (empty means the realm default).
skycloak_get_cluster
Get full details for a single Keycloak cluster by its ID.
skycloak_get_cluster_insights
Get cluster analytics as a JSON document. type is one of: overview, authentication, events, performance, security.
skycloak_get_cluster_maintenance_window
Get a cluster-specific maintenance window. A 404 means the cluster follows the workspace default.
skycloak_get_cluster_security
Get a cluster's edge-security configuration: IP allow-listing, rate limiting, WAF, geo-blocking, and bot management.
skycloak_get_cluster_upgrade_path
Get the recommended version-upgrade path for a cluster.
skycloak_get_domain
Get a custom domain by ID, including its DNS records and verification/SSL status.
skycloak_get_domain_route
Get a single realm route on a custom domain.
skycloak_get_email_branding
Get the email-template branding (colors, logo, footer) for a realm.
skycloak_get_export
Get a database export job by ID, including its status, progress, and (once completed) the time-limited download URL.
skycloak_get_identity_provider
Get an identity provider by provider ID.
skycloak_get_login_branding
Get the login-page branding (colors, logo, toggles) for a realm.
skycloak_get_logs
Read recent Keycloak server logs for a cluster, optionally filtered by level and a search string.
skycloak_get_realm
Get a realm by name.
skycloak_get_realm_export
Get a realm export job by ID. Poll this after skycloak_create_realm_export until status is 'completed'; the download URL only appears then and expires 24 hours later.
skycloak_get_realm_group
Get a realm group by ID.
skycloak_get_realm_import
Get a realm import job by ID. Poll this after skycloak_create_realm_import until status is 'completed' or 'failed'.
skycloak_get_realm_role
Get a realm role by name.
skycloak_get_realm_user
Get a realm user by ID.
skycloak_get_security_logs
Read recent security (WAF) logs for a cluster — blocked requests, attack types, source IPs.
skycloak_get_siem_destination
Get a SIEM destination by ID.
skycloak_get_smtp
Get a realm's SMTP configuration (secret values are never returned).
skycloak_get_theme
Get a custom theme by ID.
skycloak_get_theme_assignment
Get the active custom theme per Keycloak theme type (login, account, admin, email) for a realm.
skycloak_get_webhook_subscription
Get a webhook subscription by ID.
skycloak_install_extension
Install a catalog extension on a cluster. Installation is asynchronous; poll skycloak_list_cluster_extensions until the status settles. Provide required parameters keyed by parameter name.
skycloak_list_application_roles
List the roles assigned to an application's service account.
skycloak_list_application_sessions
List active user sessions for an application.
skycloak_list_applications
List the OIDC/SAML clients (applications) in a realm.
skycloak_list_cluster_captcha_domains
List hostnames registered for CAPTCHA protection on a cluster.
skycloak_list_cluster_extensions
List the extensions currently installed on a cluster, with their version and upgrade status.
skycloak_list_cluster_features
List the Keycloak feature flags available to tenant clusters.
skycloak_list_cluster_locations
List the deployment regions available to the workspace.
skycloak_list_cluster_types
List the cluster types the workspace can provision.
skycloak_list_cluster_upgrades
List the version-upgrade history for a cluster.
skycloak_list_cluster_versions
List the Keycloak versions available for a cluster type.
skycloak_list_clusters
List the Keycloak clusters in your Skycloak workspace, with their status, type, size, version and location.
skycloak_list_domain_routes
List the realm routes configured on a custom domain.
skycloak_list_domains
List the custom domains configured on a cluster.
skycloak_list_exports
List the database export jobs for a cluster, with their status and expiry.
skycloak_list_extensions
List the extension catalog available to the workspace (marketplace extensions that can be installed on a cluster).
skycloak_list_identity_provider_templates
List the pre-configured identity-provider templates. Use a template id when creating a provider.
skycloak_list_identity_providers
List the identity providers (SSO connections) in a realm.
skycloak_list_realm_group_members
List the users that belong to a realm group.
skycloak_list_realm_groups
List the top-level groups in a realm.
skycloak_list_realm_roles
List the realm-scoped roles in a realm.
skycloak_list_realm_users
List the users in a realm.
skycloak_list_realms
List the Keycloak realms in a Skycloak cluster.
skycloak_list_siem_destinations
List SIEM destinations configured for the workspace.
skycloak_list_themes
List the custom themes uploaded to a cluster, with their IDs, status, and theme types.
skycloak_list_user_groups
List the groups a user belongs to.
skycloak_list_user_roles
List the realm roles assigned to a user.
skycloak_list_webhook_event_types
List webhook event types. Optionally filter by source: platform or keycloak.
skycloak_list_webhook_subscriptions
List webhook subscriptions. Optionally filter by source, cluster_id, and enabled.
skycloak_query_events
Query Keycloak user and admin events for a cluster (logins, token grants, admin operations), filterable by category, realm, username and search.
skycloak_remove_application_role
Remove a role from an application's service account.
skycloak_remove_cluster_captcha_domain
Remove a hostname from CAPTCHA protection on a cluster. Set confirm=true to proceed.
skycloak_remove_realm_user_from_group
Remove a user from a realm group.
skycloak_remove_realm_user_role
Remove a realm role from a user.
skycloak_rotate_application_secret
Regenerate an application's client secret and return the new value (shown only once).
skycloak_set_client_theme_assignment
Set a client's login-theme override. Pass a theme ID, or an empty string to reset to the realm default.
skycloak_set_cluster_maintenance_window
Create or replace a cluster-specific maintenance window.
skycloak_set_theme_assignment
Assign custom themes to a realm per Keycloak theme type. Pass a theme ID to activate it, or an empty string to reset that type to Keycloak's built-in default. Only the provided fields are changed.
skycloak_test_identity_provider
Test connectivity to an identity provider, optionally overriding the client credentials for this test only.
skycloak_test_siem_destination
Send a test event to a SIEM destination.
skycloak_test_smtp
Send a test email through a realm's configured SMTP server to verify delivery.
skycloak_test_webhook_subscription
Send a test event to a webhook subscription.
skycloak_uninstall_extension
Uninstall an extension from a cluster. Set confirm=true to proceed.
skycloak_update_application
Update an application's name, description, or redirect URIs.
skycloak_update_cluster
Update a cluster's version (to trigger an upgrade) or size.
skycloak_update_cluster_security
Update a cluster's edge-security configuration. Only the sections you provide are changed; CAPTCHA settings are preserved. Supports IP allow-listing, rate limiting, WAF, geo-blocking, and bot management.
skycloak_update_domain_route
Update a domain route's admin access and CORS origins.
skycloak_update_extension
Update a custom extension's name or description.
skycloak_update_identity_provider
Update an identity provider's display name and enabled state.
skycloak_update_realm
Update a realm's display name and enabled state.
skycloak_update_realm_group
Rename a realm group.
skycloak_update_realm_role
Rename a realm role or change its description.
skycloak_update_realm_user
Update a realm user's profile (email, name, enabled, email_verified).
skycloak_update_siem_destination
Update a SIEM destination. Only provided fields are changed; credentials remain write-only.
skycloak_update_theme
Update a theme's name, description, or version.
skycloak_update_webhook_subscription
Update a webhook subscription. Use clear_authorization_header, clear_cluster_id, or clear_realm_id to remove nullable fields.
skycloak_upgrade_extension
Upgrade an installed extension to the latest available version. Asynchronous.
skycloak_upsert_email_branding
Create or update email-template branding (color, logo, footer).
skycloak_upsert_login_branding
Create or update login-page branding (colors, logo, registration toggle).
skycloak_upsert_smtp
Create or update a realm's SMTP configuration (basic auth).
skycloak_verify_domain
Trigger DNS verification for a custom domain and return its updated status.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"skycloak": {
"skycloak": {
"type": "http",
"url": "https://mcp.skycloak.io"
}
}
}
}McpServers
{
"skycloak": {
"type": "http",
"url": "https://mcp.skycloak.io"
}
}Manage your Skycloak (managed Keycloak) clusters, realms, and SSO from any MCP client.
- Cluster upgrade review— Ask which clusters are behind on Keycloak upgrades and get the upgrade path vialist_cluster_upgradesandget_cluster_upgrade_path.
- Realm provisioning— Create a realm with Google and GitHub sign-in usingcreate_realmandcreate_identity_provider.
- SIEM forwarding— Set up a SIEM destination that forwards admin events to a Datadog webhook viacreate_siem_destination.
- Custom domain setup— Add a custom domain, get DNS records, and verify withcreate_domainandverify_domain.
Status:early release. Tool coverage is growing; see the changelog for what's available.
claude mcp add --transport http skycloak https://mcp.skycloak.io
- "Which of my Keycloak clusters are behind on upgrades?"
- "Create a staging realm on the EU cluster with Google and GitHub sign-in."
- "Who was added to the production realm in the last week?"
- "Set up a SIEM destination that forwards admin events to our Datadog webhook."
129 tools: 58 read-only and 71 write. Read-only tools are always available. On the hosted server the write tools are registered too and gated by your credential's scopes; the local binary registers them only when started with--allow-writes.
Tool names carry askycloak_prefix that the table below omits, solist_clustersisskycloak_list_clustersin your client.
Conventions:destructive tools (delete_*,uninstall_extension,cancel_cluster_upgrade) requireconfirm=true.create_clusteris asynchronous: pollget_clusteruntil the cluster isavailable.create_domainreturns the DNS records the customer must create;verify_domaintriggers a DNS check.set_theme_assignmentactivates a custom theme per Keycloak theme type (empty string resets to the built-in default).update_cluster_securityleaves CAPTCHA settings untouched. Realm import/export moves one realm's configuration and is separate fromcreate_export, which dumps a whole cluster's database: both are asynchronous, and the realm archive is always encrypted, so the password used to export it is needed to import it again. A realm can be imported straight from an existing export (source_export_id) or from an uploaded archive (create_realm_import_upload_url, PUT, thenupload_s3_key); importing creates a realm and refuses a name collision rather than overwriting, and needsconfirm=truebecause it brings users and credentials with it.
Eight prompts give you a starting point into that tool surface. Clients surface them as slash commands or suggested actions; each one takes arguments (realm, cluster, time window) and walks the model through the right tools in the right order.
Prompts are gated the same way as the tools they name: the three that mutate are only offered to sessions that could call the write tools they reference, and their instructions tell the model to confirm with you before changing anything. Theconfirm=truerequirement on destructive tools still applies on top.
Where a prompt is a starting point, a skill is a full operational playbook the model loads on demand. The server ships four, served over the draftSEP-2640 Skills extension: it declaresio.modelcontextprotocol/skillsin its capabilities, answersskills/listandskills/get, and serves eachSKILL.mdas an ordinary resource atskill://<name>/SKILL.mdwith a sha256 digest in its listing entry. OpenAI's plugin directory imports skills in exactly this shape.
Skills follow the same gating as the tools they name: the three workflows built around write tools are withheld from read-only sessions, and a scoped session is only offered a skill whose tools it actually has. The sources live ininternal/tools/skills/, one directory per skill, in the standardAgent Skillsformat, so they also work copied straight into a local skills directory.
For hosted HTTP the simplest route is OAuth, which needs no credential at all:
claude mcp add --transport http skycloak https://mcp.skycloak.io
The first call opens your browser, you approve in the Skycloak login page, and the tools appear. If you belong to more than one workspace, name the one you want:
claude mcp add --transport http skycloak "https://mcp.skycloak.io?workspace=<workspace-id>"
Otherwise, create an API key in the Skycloak dashboard and configure your MCP client to send it as a bearer token:
claude mcp add --transport http skycloak https://mcp.skycloak.io --header "Authorization: Bearer sk_sc_XXX"
This adds the following to.claude.json:
{ "mcpServers": { "skycloak": { "type": "http", "url": "https://mcp.skycloak.io", "headers": { "Authorization": "Bearer sk_sc_XXX" } } } }
skycloak-mcp init # one-time browser sign-in; stores a key in your keychain
{ "mcpServers": { "skycloak": { "command": "skycloak-mcp", "args": ["run", "--transport", "stdio"] } } }
claude mcp add skycloak -- skycloak-mcp run --transport stdio
For headless / CI (no browser), skipinitand pass the key instead: add"env": { "SKYCLOAK_API_KEY": "sk_sc_..." }to the config, orclaude mcp add skycloak --env SKYCLOAK_API_KEY=sk_sc_... -- skycloak-mcp run --transport stdio.
Add?readonly=trueto a hosted HTTP URL to expose only read-only tools for that HTTP session, or?readonly=falseto request the write-capable tool surface. The query parameter defaults tofalse, but write tools are registered only when the server was started with--allow-writes.
Add?workspace=<uuid>to pick which workspace an OAuth session acts on. It is only needed when you belong to more than one; with a single workspace the server picks it for you, and if you belong to several and name none, the connection fails with a message listing them.
skycloak-mcp run --transport http --http-addr :8080
It needs no credential of its own: callers supply theirs per request, so nothing is injected at deploy time.GET /healthzandGET /readyzare unauthenticated and report only that the process is up; they deliberately do not probe the Skycloak API, so an upstream blip cannot fail every replica's probe at once. The server holds no session state, so replicas need no session affinity and can be scaled or rolled freely.SIGTERMstops new connections and drains in-flight calls.
The OAuth path is on wheneverSKYCLOAK_ISSUERandSKYCLOAK_DASHBOARD_URLare set, which they are by default.GET /.well-known/oauth-protected-resourceis then served unauthenticated, naming the realm as the authorization server. Itsresourcevalue is taken fromSKYCLOAK_PUBLIC_URLwhen set, and otherwise from the request's ownHostand scheme, so a single-host deployment behind an ingress needs no extra configuration. The scheme comes fromX-Forwarded-Protowhen present, and otherwise defaults tohttpsfor anything but a loopback host, since TLS terminates upstream and publishing anhttp://identifier would not match the URL the client connected on. SetSKYCLOAK_PUBLIC_URLif your ingress rewritesHost. The document also listsopenid profile emailas itsscopes_supported, and theWWW-Authenticatechallenge repeats them as ascopeparameter, so a client reading either one asks the realm for them:openidis required, because the token exchange makes the dashboard call Keycloak's userinfo endpoint and Keycloak refuses a token granted without it. A token that arrives without it is refused at verification with a401and the challenge, rather than carried to an exchange that cannot succeed, so a client still holding a grant from before stops retrying and signs in again. Blanking either of the issuer or dashboard variables turns OAuth off entirely, and the server goes back to challenging for an API key and nothing else.
OPENAI_APPS_CHALLENGE_TOKENserves OpenAI's plugin-directory domain verification token at/.well-known/openai-apps-challenge, as plain text and nothing else. Unset, the route is not registered and the path 404s.
Startup logs one line with the wiring it resolved (oauth=,issuer=,dashboard=,public_url=,endpoint=,allow_writes=), so a misconfigured deployment can be spotted without a redeploy. Every request refused on the OAuth path logs one line naming the stage that failed (verify,exchangeorscopes), the status the caller got, and the underlying error. A verification failure adds the check that rejected the token (expired,wrong_issuer,bad_signature,unknown_key_id,wrong_token_type,no_openid_scope, and so on); an exchange failure adds the dashboard's status and the host called. The caller appears as the token's subject once it is verified, and never as a credential: the access token, theAuthorizationheader and the minted API key are never logged.
Commands:init(browser sign-in),run(serve),logout(remove the stored key).initaccepts--workspace <id>,--allow-writes,--allow-credentials, and--ttl-days(default 90).
make build # build the server binary make test # unit tests make run # run on stdio for local testing make inspector # MCP Inspector against the local binary make lint # golangci-lint make generate # regenerate the API client from the OpenAPI spec
The API client underinternal/apiclientis generated from the Skycloak OpenAPI specification withoapi-codegen.
The client ininternal/apiclientis generated frominternal/apiclient/openapi.yamlwithoapi-codegen; runmake generateto refresh it. CI fails if the committed generated code drifts from the spec. Requests are retried on429/5xxwithRetry-After-aware backoff.
Released as GitHub binaries and aghcr.io/sky-cloak/skycloak-mcpcontainer image on each tag, and published to theMCP Registryasio.skycloak/skycloak-mcp. Most people do not need either: the hosted server needs no install.
Please report vulnerabilities privately. SeeSECURITY.md.
Apache-2.0. The OpenAPI description ininternal/apiclient/openapi.yamlis generated from the Skycloak platform API and is (c) Skycloak; it is included here so the client can be generated and verified. SeeNOTICE.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
The first MCP server governed by ICA. A remote streamable HTTP server at https://mcp.aleeth.com/mcp with 37 governed tools: every call is risk-checked by Rail Guard before it runs and sealed with a signed Ed25519 receipt on a hash-chained public ledger anchored to Bitcoin. Fails closed: no receipt, no response. OAuth 2.0 with RFC 9728 discovery; anonymous requests get 401. This repository is the public interface and provenance record: a generated tool manifest with per-tool annotations, an SBOM and vulnerability scan with digested provenance, and a TRUST.md of verify-it-yourself commands. The implementation is private by design. Independent probe grade A from mcp-spec-check, re-verified 2026-07-24.
Turn any OpenAPI spec into a hosted MCP server in 30 seconds. One typed tool per endpoint, server-side auth injection, stable URL across spec updates. EU-hosted, GDPR-native.
Discover powerful AI agents, invoke them instantly, and verify every result with Ed25519 cryptographic proofs. Nine tools — five free, four billed — all protected by OAuth 2.1.
AI-safe approval plan gated Kubernetes operations through MCP with OAuth, RBAC, audit, guardrails.
A remote MCP server with GitHub OAuth authentication and built-in analytics tracking.
A local MCP server that breaks on demand. Test your client against auth failures, disappearing tools, flaky responses, and token expiry, all from a web UI.
An MCP server with built-in GitHub OAuth support, deployable on Cloudflare Workers.
An MCP server with built-in GitHub OAuth support, designed for deployment on Cloudflare Workers.
Hosted mock-API MCP server: agents create live REST/GraphQL mock APIs, import OpenAPI/CSV/db.json, seed fake data, query and write records — free, no auth, stateless Streamable HTTP.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
