The MCP tool directory.

Start a database export for a cluster. Asynchronous: poll skycloak_get_export until the status is 'completed' to obtain the download URL. Including credentials requires an encryption_password.

Create an OIDC identity provider (SSO connection) in a realm.

Create a new Keycloak realm in a cluster. Requires the server to be started with --allow-writes and a write-scoped API key.

Export a Keycloak realm to an encrypted archive. Asynchronous: poll skycloak_get_realm_export until status is 'completed'. The archive is always encrypted, so encryption_password is required, and the same password is needed to import it again. This is a realm export (one realm's configuration); skycloak_create_export is the separate whole-cluster database export.

Create a realm group, optionally nested under a parent group.

Import a Keycloak realm into a cluster from an uploaded archive or an existing realm export. Asynchronous: poll skycloak_get_realm_import. Creates a new realm: preflight refuses a name collision rather than overwriting, so an existing realm of the same name fails with 409. It does import users and their credentials, so set confirm=true to proceed.

Get a presigned URL to upload a realm archive to. PUT the archive to upload_url, then pass the returned s3_key to skycloak_create_realm_import as upload_s3_key. Not needed when importing an existing export: pass that export's ID as source_export_id instead.

Create a realm-scoped role.

Create a realm user with an initial temporary password.

Create a SIEM destination. Credentials are write-only and are not returned.

Create a webhook subscription. Signing secrets and authorization headers are write-only.

Delete an application (OIDC/SAML client) from a realm. Set confirm=true to proceed.

Permanently delete a Keycloak cluster and all of its realms and data. Irreversible. Set confirm=true to proceed.

Delete a cluster-specific maintenance window so the cluster follows the workspace default. Set confirm=true to proceed.

Remove a custom domain from a cluster. Set confirm=true to proceed.

Remove a realm route from a custom domain. Set confirm=true to proceed.

Revert email branding to defaults. Set confirm=true to proceed.

Delete a database export archive. Set confirm=true to proceed.

Delete a custom extension from the workspace catalog. Set confirm=true to proceed.

Delete an identity provider from a realm. Set confirm=true to proceed.

Revert login branding to defaults. Set confirm=true to proceed.

Permanently delete a realm and all of its users, clients and configuration. This is irreversible. Set confirm=true to proceed.

Delete a realm group. Set confirm=true to proceed.

Delete a realm role. Set confirm=true to proceed.

Delete a realm user. Set confirm=true to proceed.

Delete a SIEM destination. Set confirm=true to proceed.

Remove a realm's SMTP configuration. Set confirm=true to proceed.

Delete a custom theme. Set confirm=true to proceed.

Delete a webhook subscription. Set confirm=true to proceed.

Resolve an OIDC issuer's discovery document to obtain its authorization, token, and userinfo endpoints. Use the result when creating an identity provider.