How to Use the Keycloak MCP in Cline

Q: Can Cline reset Keycloak passwords directly?

Yes, the server includes a specific resetuserpassword tool. If you get locked out of a test account during development, just ask your agent in VS Code to force a password update.

Q: What happens if I delete a realm by mistake?

There is no undo button for deleterealm. If your agent executes this tool, the entire tenant and all associated data vanish immediately. Always restrict destructive permissions on the credentials you provide to the MCP connection.

Q: Is it safe to pull Keycloak user data into VS Code?

The listusers and getclientsecret tools expose highly sensitive credentials and personal information straight to your editor. We secure this by running the connection through a zero-trust architecture, ensuring your Keycloak admin token and the resulting data stream directly to your local machine without being logged by the middleman.

Give Cline total control over Keycloak identity management to build, test, and tear down auth infrastructure inside VS Code.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Keycloak MCP to Cline

Create your Vinkius account to connect Keycloak to Cline and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Keycloak with Cline

Ask AI about this MCP

ChatGPT

Claude

Perplexity

End-to-End IAM With Cline

The Keycloak MCP Server hands your coding agent 34 direct administrative tools to manage access control. You tell Cline to build an admin dashboard, and it doesn't just write the React components—it actually reaches out via `create_client` to register the app in your local Keycloak instance and fetches the OIDC credentials. Then it writes the authentication wrapper, injects the real client ID it just generated, and tests the flow. If it needs mock data, Cline runs `create_user` five times, assigns roles using `update_user`, and shows you the working login screen.

Live Auth Flow Debugging

Troubleshooting token rejections is painful when your editor and identity provider are disconnected. Now Cline can pull `list_admin_events` directly into VS Code to see exactly why your JWT failed validation. Once it finds the mismatch in client scopes, your agent executes `update_client` to fix the configuration on the server. It then regenerates the credentials with `regenerate_client_secret` and updates your local configuration files automatically.

Keycloak MCP Server Environment Sync

Keeping local development in sync with staging identity setups requires constant manual exports. Cline automates this entirely by executing `partial_export_realm` against your remote server and saving the JSON directly to your workspace. When a new developer pulls the repo, they just ask the agent to set up auth. Cline reads that exported configuration and runs `import_realm` to spin up an exact replica of the production tenant, complete with all `list_auth_flows` configurations.

Setup guide

Set up Keycloak MCP in Cline

Prerequisites

VS Code with Cline extension installed
Active Vinkius subscription with a valid endpoint token

1

Open Cline MCP settings

Click the Cline icon in the VS Code sidebar to open the Cline panel. Then click the MCP Servers icon (server stack) at the top-right corner of the panel.
2

Add a remote server

Click "Remote Servers" at the top, then click "Add Remote MCP". In the Name field, type keycloak-mcp. In the URL field, paste your Vinkius endpoint: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp. Get your token from cloud.vinkius.com.
3

Enable the server

After saving, the server appears in the Cline MCP panel. Toggle the switch to enable it. The status indicator turns green when the connection is live.
4

Start using tools

Return to the Cline chat and ask: "Check my latest Keycloak refund status." Cline will discover the available tools and request your approval before invoking each one — giving you full control over every action.

Cline MCP Settings

{
  "mcpServers": {
    "keycloak-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Keycloak. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Keycloak now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Keycloak MCP in Cline

Open the Cline sidebar in VS Code and click the MCP Servers icon. You can use the Remote Servers tab to add the Vinkius URL via Streamable HTTP transport, or manually edit the `cline_mcp_settings.json` file.

Absolutely. You can instruct your agent to write a Playwright test and it will use `create_user` to provision temporary accounts before the test runs. Afterward, it can clean up the mess with `delete_user`.

Yes, the server includes a specific `reset_user_password` tool. If you get locked out of a test account during development, just ask your agent in VS Code to force a password update.

There is no undo button for `delete_realm`. If your agent executes this tool, the entire tenant and all associated data vanish immediately. Always restrict destructive permissions on the credentials you provide to the MCP connection.

The `list_users` and `get_client_secret` tools expose highly sensitive credentials and personal information straight to your editor. We secure this by running the connection through a zero-trust architecture, ensuring your Keycloak admin token and the resulting data stream directly to your local machine without being logged by the middleman.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript