# Keycloak MCP for AI Agents AI Agent Connect > Keycloak MCP lets you manage your entire identity and access management infrastructure through natural language. You can handle user accounts, realm configurations, and security roles without jumping between different administrative dashboards. It turns your AI agent into a security admin that can handle password resets, audit logs, and client credential management instantly. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_VDd8VBVZZLNJBW8pUCGwjhe4HqDkWkhkqiAnNHpc/ai-agent-connect - **Tags:** iam, authentication, authorization, sso, keycloak-admin ## Description Imagine you're in the middle of a deployment and a production user gets locked out. Usually, you'd have to log into your admin console, find the right realm, locate the user, and manually reset the credentials. With this Connector, you just tell your AI agent to do it for you. It handles the heavy lifting of navigating the Keycloak backend so you can stay focused on the actual deployment. This connection works by letting your agent interact with your instance to perform routine maintenance like creating new groups, updating client secrets, or forcing a global logout during a security incident. It's a huge time saver for anyone who spends their day juggling multiple security configurations. Because Vinkius makes it so easy to connect these types of tools, you can move from a manual, click-heavy workflow to a conversation-based one where you just describe the change you need and the agent executes it. Whether you're auditing admin events to see who's been poking around or setting up new authentication flows for a new app, this tool keeps your security posture tight without the friction of a traditional UI. ## Tools ### create_group Create a new top-level group in a realm. Use this to organize different departments or teams. ### create_role Create a new realm-level role for permissions. This helps define what different users can do. ### list_users Get a list of all users within a specific realm. Use this to see everyone in a specific environment. ### logout_all_users Terminate every active session in a realm immediately. Use this for an instant global logout. ### partial_export_realm Export a specific subset of realm data. Use this to move small pieces of configuration. ### regenerate_client_secret Create a new secret for an existing client. Use this to rotate keys for your applications. ### reset_user_password Change the password for a specific user account. Use this to help users who are locked out. ### create_auth_flow Create a new authentication flow for your users. This helps define how users log in. ### create_client Set up a new client for an application. This is used to connect new apps to your identity provider. ### update_client Modify the configuration of an existing client. Use this to change OIDC or SAML settings. ### update_group Edit the details or membership of a group. This allows you to change who belongs to which team. ### update_realm Change the core information of a realm. Use this for high-level realm configuration updates. ### update_user Modify user profile details and status. This is useful for changing emails or account statuses. ### create_user Add a new user account to your system. Use this to onboard new people into your platform. ### delete_client Remove a client from your realm. Use this to decommission old applications. ### delete_group Delete a group and its associated members. This helps clean up old organizational structures. ### delete_realm Permanently remove a realm from your instance. Use this for deleting entire environments. ### delete_user Remove a user account from your realm. Use this to offboard users who no longer need access. ### get_client_secret Retrieve the secret key for a specific client. This is what you need for application configuration. ### get_client View the full representation of a client's configuration. Use this to check current client settings. ### get_group View the details and membership of a specific group. This shows you who is in a specific team. ### get_realm Retrieve the configuration details for a realm. Use this to see the high-level settings of a realm. ### get_role Get the details for a specific realm-level role. This helps you see what permissions a role has. ### get_user Fetch the profile information for a specific user. Use this to check a user's account status. ### import_realm Bring in a realm configuration from an external file. Use this to move configurations between environments. ### list_admin_events View a history of administrative actions within a realm. This is great for security auditing. ### list_auth_flows See all available authentication flows. Use this to check the different ways users can log in. ### list_client_roles View roles assigned at the client level. This shows you permissions specific to one application. ### list_clients See a list of all clients registered in a realm. Use this to see all connected apps. ### list_groups View the entire hierarchy of groups. This helps you see your full organizational structure. ### list_realms See all realms available to your admin account. Use this to see all different environments. ### list_required_actions Check the actions required for specific security flows. This helps you understand login requirements. ### list_roles See all realm-level roles currently available. Use this to audit all possible permissions. ### list_user_groups See which groups a specific user belongs to. Use this to check a user's team memberships. ## Prompt Examples **Prompt:** ``` I need to create a new user for the staging environment. Can you add a user with the email dev-test@example.com to the 'staging' realm? ``` **Response:** ``` I've added the user to the staging realm. Here's the summary: - **Username**: dev-test - **Email**: dev-test@example.com - **Status**: Enabled - **Realm**: staging The account is now active and ready for testing. ``` **Prompt:** ``` Someone reported a security issue. Can you force a logout for everyone in the 'production-apps' realm right now? ``` **Response:** ``` I've terminated all active sessions in the 'production-apps' realm. **Action Summary:** - **Target Realm**: production-apps - **Action**: Global Session Termination - **Status**: Complete All users will be required to re-authenticate the next time they access the app. ``` **Prompt:** ``` What are the latest admin events for our master realm? I need to see who changed the client settings yesterday. ``` **Response:** ``` I've pulled the admin events for the 'master' realm from the last 24 hours. | Timestamp | Admin | Action | Details | | :--- | :--- | :--- | :--- | | 2026-07-09 14:20 | admin_user_1 | Update Client | Modified 'web-app-client' | | 2026-07-09 16:45 | security_ops | Create Role | Added 'audit-viewer' | | 2026-07-10 09:12 | admin_user_1 | Update Realm | Changed 'master' description | ``` ## Capabilities ### Reset user passwords Instantly change credentials for locked-out accounts via chat. ### Force global logouts Terminate all active sessions across a realm to stop a security threat. ### Create new clients Set up OIDC or SAML configurations for new applications in seconds. ### Audit admin events Review logs to see what changes have been made to your security infrastructure. ### Manage user groups Organize and assign permissions to different user categories easily. ### Regenerate client secrets Update sensitive credentials without needing to manually copy-paste from a dashboard. ## Use Cases ### Emergency Lockdown A security breach is detected. The admin tells the agent to use logout_all_users to clear all sessions immediately. ### Rapid Onboarding A new app needs OIDC. The developer asks the agent to create_client and regenerate_client_secret for the new service. ### Bulk User Cleanup A project ends and 50 users need removal. The admin asks the agent to delete_user for the specific list of IDs. ### Audit Compliance During a security review, the admin asks the agent to list_admin_events to verify who changed the realm settings last week. ## Benefits - Stop clicking through tabs to manage users. Use create_user and update_user to handle account changes in seconds. - Respond to security threats faster. Use logout_all_users to terminate all sessions instantly during an incident. - Simplify client setup. Use create_client and regenerate_client_secret to provision new apps without manual copy-pasting. - Audit your security posture easily. Use list_admin_events to see exactly what changes your team has made to the realm. - Organize permissions better. Use create_group and list_user_groups to manage complex security hierarchies via chat. - Streamline migrations. Use import_realm to quickly bring in existing configurations from other environments. ## How It Works The bottom line is that you turn your AI agent into a functional admin for your Keycloak identity provider. 1. Subscribe to the Keycloak MCP on Vinkius. 2. Input your Keycloak Base URL and a valid Admin Access Token into your client. 3. Ask your agent to perform tasks like listing realms or creating new users. ## Frequently Asked Questions **Can the Keycloak MCP help me manage my users?** Yes, it lets you create, update, and delete user accounts using natural language. You can also reset passwords and check group memberships without opening the admin console. **How does Keycloak work with AI agents for security?** It allows your agent to perform administrative tasks like auditing events and managing roles. This means you can ask your agent to check logs or update security settings instantly. **Can I use Keycloak to manage my OIDC clients?** Absolutely. You can use the Connector to create new clients, update existing ones, and retrieve or regenerate client secrets for your applications. **Is Keycloak safe for managing my company's identity?** Yes, it's a standard tool for IAM. This Connector simply provides a way for your AI agent to interact with it using your existing admin credentials. **Can I use Keycloak to perform a global logout?** Yes, you can tell your agent to remove all active sessions in a realm. This is helpful for quickly mitigating threats during a security incident. **Can I use Keycloak to import realm configurations?** Yes, you can use the import_realm tool to bring in realm configurations from external files, making it easier to sync environments. **Can I reset a user's password using this integration?** Yes. You can use the `reset_user_password` tool by providing the realm name, the user ID, and the new credential representation. This allows for immediate password management via the AI. **Is it possible to audit administrative changes in a specific realm?** Absolutely. The `list_admin_events` tool retrieves the history of administrative actions for a target realm, helping you track who changed what and when. **Can I retrieve OIDC client secrets for my applications?** Yes, the `get_client_secret` tool allows you to fetch the secret for any configured client in a realm. You can also use `regenerate_client_secret` if a rotation is required.