Integration

Keycloak integration

Keycloak is a self-hosted identity and access management server. Administer one realm: search, create, update and delete users, email them required actions or email verification, sign them out, manage their credentials, identity provider links, consents and login failures; manage groups, realm and client roles and their mappings; read clients, sessions, login and admin events; manage organizations, their members and invitations. These tools change who can log in and what people can access. Left out: realm, client, identity provider and authentication flow configuration, client secrets, setting a password directly (use send_user_actions_email), adding an organization member without an invitation, impersonation and deleting events. Authentication is a confidential client with a service account (client credentials grant) whose service account holds admin roles; connect with its client ID and secret, your server host and the realms.

Connect Keycloak How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Keycloak.Built from the 104 Keycloak tools below, on the connection you add once.

What you can do with Keycloak

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Group, 10 operations

add_user_to_groupAdd user to groupPUTAdds a user to a group, which grants them the group's roles. Changes what that person can access.
create_groupCreate groupPOSTCreates a top-level group with a name, description and attributes. Returns the new group's URL in Location.
delete_groupDelete groupDELETEPermanently deletes a group (cannot be undone); its members lose the roles it granted.
get_groupGet groupGETReturns one group: name, description, path, parent, attributes, subgroup count and its realm and client roles.
list_client_role_groupsList client role groupsGETLists the groups that have a client role, with paging.
list_groupsList groupsGETLists the realm's top-level groups, or searches all groups by name or attributes (subgroups are returned only with search or q), with paging.
list_realm_role_groupsList realm role groupsGETLists the groups that have a realm role, with paging.
list_user_groupsList user groupsGETLists the groups a user belongs to, with paging and an optional name search.
remove_user_from_groupRemove user from groupDELETERemoves a user from a group, which takes away the group's roles. Changes what that person can access.
update_groupUpdate groupPUTUpdates a group's name, description or attributes (subgroups are not changed). The description is replaced, so a call without it clears it; attributes, when sent, replace all of them. Start from get_group.

Role, 10 operations

create_client_roleCreate client rolePOSTCreates a role in a client with a name, description and attributes. Returns the new role's URL in Location.
create_realm_roleCreate realm rolePOSTCreates a realm role with a name, description and attributes. Returns the new role's URL in Location.
delete_client_roleDelete client roleDELETEPermanently deletes a client role (cannot be undone); users and groups that had it lose it. Changes what those people can access.
delete_realm_roleDelete realm roleDELETEPermanently deletes a realm role (cannot be undone); users and groups that had it lose it. Changes what those people can access.
get_client_roleGet client roleGETReturns one role of a client by name: id, description, whether it is composite, and attributes.
get_realm_roleGet realm roleGETReturns one realm role by name: id, description, whether it is composite, and attributes.
list_client_rolesList client rolesGETLists the roles of a client, with paging and an optional name search.
list_realm_rolesList realm rolesGETLists the realm roles, with paging and an optional name search.
update_client_roleUpdate client rolePUTUpdates a client role. name is required (send the current one to keep it); a call without description clears it; attributes, when sent, replace all of them. Start from get_client_role.
update_realm_roleUpdate realm rolePUTUpdates a realm role. name is required (send the current one to keep it); a call without description clears it; attributes, when sent, replace all of them. Start from get_realm_role.

User, 10 operations

clear_all_login_failuresClear all login failuresDELETEClears the login failures of every user in the realm, releasing all users temporarily disabled by brute force detection.
clear_user_login_failuresClear user login failuresDELETEClears a user's login failures, which can release a user temporarily disabled by brute force detection. Lets that person log in again.
create_userCreate userPOSTCreates a user in the realm with a username, email, names, attributes, groups and required actions. Changes who can log in to the realm. Returns the new user's URL in Location.
delete_userDelete userDELETEPermanently deletes a user from the realm; the person can no longer log in. Cannot be undone.
get_userGet userGETReturns one user: username, email, names, attributes, enabled and email-verified flags, required actions and creation time. Personal data.
get_user_login_failuresGet user login failuresGETReturns a user's status in brute force detection (login failures, and whether the user is temporarily disabled), as Keycloak returns it.
list_client_role_usersList client role usersGETLists the users who have a client role mapped directly, with paging. Personal data.
list_realm_role_usersList realm role usersGETLists the users who have a realm role mapped directly, with paging. Personal data.
list_usersList usersGETSearches the realm's users by username, email, first or last name, attributes, linked identity provider or creation date, with paging. Returns names, emails, attributes and status: personal data.
update_userUpdate userPUTUpdates a user (get_user gives the current values). Fields left out are kept, but sending attributes replaces them all and removes username, email, firstName or lastName left out of the call. enabled false stops the person from logging in.

Client, 9 operations

add_group_client_rolesAdd group client rolesPOSTGrants roles of one client to a group, and so to every member. Changes what those people can access.
add_user_client_rolesAdd user client rolesPOSTGrants roles of one client to a user. Changes what that person can access.
get_clientGet clientGETReturns one client: clientId, name, URLs, redirect URIs, protocol, enabled flows and client scopes. Its secret, attributes and protocol mappers are not returned.
list_clientsList clientsGETLists the realm's clients (applications) with their id, clientId, name, URLs, protocol and enabled flows. Secrets, attributes and protocol mappers are not returned.
list_group_client_rolesList group client rolesGETLists the roles of one client mapped to a group.
list_realm_role_client_compositesList realm role client compositesGETLists the roles of one client contained in a composite realm role.
list_user_client_rolesList user client rolesGETLists the roles of one client mapped directly to a user.
remove_group_client_rolesRemove group client rolesDELETETakes roles of one client away from a group and its members. Changes what those people can access.
remove_user_client_rolesRemove user client rolesDELETETakes roles of one client away from a user. Changes what that person can access.

Realm, 7 operations

add_group_realm_rolesAdd group realm rolesPOSTGrants realm roles to a group, and so to every member. Changes what those people can access.
add_user_realm_rolesAdd user realm rolesPOSTGrants realm roles to a user. Changes what that person can access.
list_group_realm_rolesList group realm rolesGETLists the realm roles mapped to a group.
list_realm_role_realm_compositesList realm role realm compositesGETLists the realm roles contained in a composite realm role.
list_user_realm_rolesList user realm rolesGETLists the realm roles mapped directly to a user.
remove_group_realm_rolesRemove group realm rolesDELETETakes realm roles away from a group and its members. Changes what those people can access.
remove_user_realm_rolesRemove user realm rolesDELETETakes realm roles away from a user. Changes what that person can access.

Composite, 6 operations

add_realm_role_compositesAdd realm role compositesPOSTAdds roles to a realm role, making it composite: everyone holding it gains the added roles.
list_group_effective_realm_rolesList group effective realm rolesGETLists a group's effective realm roles, with composite roles expanded.
list_realm_role_compositesList realm role compositesGETLists the roles contained in a composite realm role.
list_user_effective_client_rolesList user effective client rolesGETLists a user's effective roles for one client, with composite roles expanded.
list_user_effective_realm_rolesList user effective realm rolesGETLists a user's effective realm roles, with composite roles expanded.
remove_realm_role_compositesRemove realm role compositesDELETERemoves roles from a composite realm role: everyone holding it loses them.

Organization, 6 operations

create_organizationCreate organizationPOSTCreates an organization with a name, alias, description, redirect URL, attributes and internet domains. Returns its URL in Location.
delete_organizationDelete organizationDELETEPermanently deletes an organization and all data associated with it. Its managed members are deleted as users and can no longer log in; unmanaged members stay in the realm. Cannot be undone.
get_organizationGet organizationGETReturns one organization: name, alias, enabled flag, description, redirect URL, attributes and internet domains.
list_organizationsList organizationsGETLists the realm's organizations, searched by name or domain, by attributes or by linked identity provider, with paging.
list_user_organizationsList user organizationsGETLists the organizations a user is a member of.
update_organizationUpdate organizationPUTReplaces an organization's settings: send name, alias, enabled, description, redirect URL and attributes as get_organization returns them, with your change; one left out is cleared or refused, and enabled becomes true. Domains left out are kept.

Available, 4 operations

list_group_available_client_rolesList group available client rolesGETLists the roles of one client that can still be granted to a group.
list_group_available_realm_rolesList group available realm rolesGETLists the realm roles that can still be granted to a group.
list_user_available_client_rolesList user available client rolesGETLists the roles of one client that can still be granted to a user.
list_user_available_realm_rolesList user available realm rolesGETLists the realm roles that can still be granted to a user.

Member, 4 operations

get_organization_memberGet organization memberGETReturns one member of an organization, or not found when the user is not a member. Personal data.
list_group_membersList group membersGETLists the users who are members of a group, with paging. Personal data.
list_organization_membersList organization membersGETLists the members of an organization, searched by username, email or name, with paging. Personal data.
remove_organization_memberRemove organization memberDELETERemoves a user from an organization. A managed member (a user the organization owns) is deleted as a user and can no longer log in.

Default group, 3 operations

add_default_groupAdd default groupPUTMakes a group a default group: users created afterwards join it automatically, with its roles.
list_default_groupsList default groupsGETLists the realm's default groups, which every new user joins automatically.
remove_default_groupRemove default groupDELETEStops a group from being a default group; its current members stay.

Invitation, 3 operations

delete_organization_invitationDelete organization invitationDELETEDeletes an organization invitation, so its link no longer works.
get_organization_invitationGet organization invitationGETReturns one organization invitation: email, names, sent and expiry times and status.
list_organization_invitationsList organization invitationsGETLists an organization's invitations with email, names, sent and expiry times and status, filtered by email, name or status. Personal data.

Child, 2 operations

create_subgroupCreate subgroupPOSTCreates a subgroup under a group, with a name, description and attributes. Returns the new group's URL in Location.
list_subgroupsList subgroupsGETLists the subgroups of a group, with paging and an optional name search.

Consent, 2 operations

list_user_consentsList user consentsGETLists the consents a user granted to clients, as Keycloak returns them (one entry per client).
revoke_user_consentRevoke user consentDELETERevokes a user's consent and offline tokens for one client. The client loses the access the user granted it.

Count, 2 operations

count_groupsCount groupsGETReturns how many groups the realm has, optionally only those matching a name search, or only top-level groups.
count_user_groupsCount user groupsGETReturns how many groups a user belongs to, optionally only groups matching a name search.

Credential, 2 operations

delete_user_credentialDelete user credentialDELETEPermanently removes one of a user's credentials, such as an OTP device or a password (cannot be undone). Changes how that person logs in.
list_user_credentialsList user credentialsGETLists a user's credentials (such as password or OTP) with their id, type, label, creation date and priority. Secret values are never returned.

Federated identity, 2 operations

list_user_identity_provider_linksList user identity provider linksGETLists the identity provider accounts linked to a user (such as Google or a company provider), with the provider alias and the user's id and name there. Personal data.
unlink_user_identity_providerUnlink user identity providerDELETEUnlinks an identity provider account from a user. The person can no longer log in through that provider until it is linked again.

Role mapping, 2 operations

list_group_role_mappingsList group role mappingsGETReturns all role mappings of a group: realm roles, and client roles grouped by client.
list_user_role_mappingsList user role mappingsGETReturns all role mappings of a user: realm roles, and client roles grouped by client.

Session, 2 operations

delete_sessionDelete sessionDELETEEnds one user session (an offline session with isOffline true); clients with an admin URL are told to invalidate it. The person must log in again.
list_user_sessionsList user sessionsGETLists a user's active sessions with IP address, start and last access times and the clients used. Personal data.

Admin event, 1 operation

list_admin_eventsList admin eventsGETLists admin events (changes made through the admin console or API) with operation, resource type and path, who made them and when. The changed representation is not returned.

Client session stat, 1 operation

list_client_session_statsList client session statsGETLists, for each client that has sessions, how many sessions are currently active.

Event, 1 operation

list_eventsList eventsGETLists login events (such as logins, logouts and errors) with type, time, user, client, session, IP address and details, filtered by type, user, client, IP or date. Personal data.

Execute actions email, 1 operation

send_user_actions_emailSend user actions emailPUTEmails a user a link to complete required actions, such as UPDATE_PASSWORD, VERIFY_EMAIL or CONFIGURE_TOTP. Sends an email to a real person; the realm needs email settings.

Group by path, 1 operation

get_group_by_pathGet group by pathGETReturns a group found by its path, such as Staff/Sales.

Invite existing user, 1 operation

invite_existing_user_to_organizationInvite existing user to organizationPOSTEmails an existing user an invitation to join the organization. Sends an email to a real person.

Invite user, 1 operation

invite_user_to_organizationInvite user to organizationPOSTEmails a person an invitation to the organization: an invitation link when the email belongs to a user, otherwise a registration link. Sends an email to a real person.

Logout, 1 operation

logout_userLogout userPOSTSigns a user out of every session and tells clients with an admin URL to invalidate them. The person must log in again.

Offline session, 1 operation

list_client_offline_sessionsList client offline sessionsGETLists the offline sessions of a client with user, IP address and times, with paging. Personal data.

Offline session count, 1 operation

count_client_offline_sessionsCount client offline sessionsGETReturns the number of offline sessions of a client.

Profile, 1 operation

get_user_profile_configGet user profile configGETReturns the realm's user profile configuration: the user attributes with their validations and permissions, attribute groups and the policy for unmanaged attributes.

Required action, 1 operation

list_required_actionsList required actionsGETLists the realm's required actions (such as UPDATE_PASSWORD or CONFIGURE_TOTP) with their alias, name and enabled flag, for send_user_actions_email.

Resend, 1 operation

resend_organization_invitationResend organization invitationPOSTSends an organization invitation email again. Sends an email to a real person.

Roles by id, 1 operation

get_role_by_idGet role by idGETReturns a realm or client role by its id.

Send verify email, 1 operation

send_verify_emailSend verify emailPUTEmails a user a link to verify their email address (valid 12 hours by default). Sends an email to a real person.

Service account user, 1 operation

get_client_service_account_userGet client service account userGETReturns the service account user of a client that has service accounts enabled.

Session count, 1 operation

count_client_sessionsCount client sessionsGETReturns the number of active user sessions of a client.

User session, 1 operation

list_client_sessionsList client sessionsGETLists the user sessions of a client with user, IP address and times, with paging. Personal data.

Use Keycloak from Claude Code, Cursor or Codex

Connect Keycloak in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Keycloak operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Keycloak

Create your workspace
Sign up free. Nothing to install.
Connect Keycloak once
Add your Keycloak connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.