{
 "categories": [
  "identity",
  "open-source"
 ],
 "deployment": "hybrid",
 "evidence": [
  {
   "date": "2026-09-13",
   "fact": "homepage",
   "note": "Keycloak presents open-source IAM with SSO, identity brokering, social login, LDAP/AD federation, and a central Admin Console. The page states it is a CNCF incubation project.",
   "source": "https://www.keycloak.org/",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "license",
   "note": "The Keycloak repository LICENSE.txt is Apache License 2.0.",
   "source": "https://raw.githubusercontent.com/keycloak/keycloak/main/LICENSE.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "deployment",
   "note": "Official getting-started guides cover OpenJDK, Docker, Podman, Kubernetes, OpenShift, and running Keycloak as a Windows service. That is hybrid self-hosted delivery.",
   "source": "https://www.keycloak.org/guides",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "platforms[0]",
   "note": "The Docker getting-started guide runs the official quay.io/keycloak/keycloak:26.7.3 image, which is a Linux container deploy.",
   "source": "https://www.keycloak.org/getting-started/getting-started-docker",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "platforms[1]",
   "note": "Guides include Run Keycloak as a Windows Service and kcadm.bat in the Admin CLI.",
   "source": "https://www.keycloak.org/guides",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "platforms[2]",
   "note": "The same guide opens the Keycloak Admin Console and Account Console in a web browser.",
   "source": "https://www.keycloak.org/getting-started/getting-started-docker",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "status",
   "note": "The downloads page lists Keycloak 26.7.3 as the current server distribution.",
   "source": "https://www.keycloak.org/downloads",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.exists",
   "note": "The Server Developer Guide states that Keycloak comes with a fully functional Admin REST API with all features provided by the Admin Console.",
   "source": "https://www.keycloak.org/docs/latest/server_development/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.kinds[0]",
   "note": "The Admin REST API reference uses URI scheme {base url}/admin/realms and documents HTTP operations on realms, users, clients, roles, groups, identity providers, and related admin resources.",
   "source": "https://www.keycloak.org/docs-api/latest/rest-api/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.kinds[1]",
   "note": "The same reference publishes preview OpenAPI definitions in JSON and YAML.",
   "source": "https://www.keycloak.org/docs-api/latest/rest-api/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.auth[0]",
   "note": "The guide documents obtaining an access token with client_id=admin-cli, username, password, and grant_type=password, then sending Authorization: bearer on Admin REST calls.",
   "source": "https://www.keycloak.org/docs/latest/server_development/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.auth[1]",
   "note": "The guide documents service-account authentication with client_id, client_secret, and grant_type=client_credentials against /realms/master/protocol/openid-connect/token.",
   "source": "https://www.keycloak.org/docs/latest/server_development/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.coverage",
   "note": "Vendor wording is that the Admin REST API has all features provided by the Admin Console. The reference lists Attack Detection through Users and Workflows.",
   "source": "https://www.keycloak.org/docs/latest/server_development/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.api.docs",
   "note": "Opened the current Admin REST API OpenAPI 3.0.3 document titled Keycloak Admin REST API.",
   "source": "https://www.keycloak.org/docs-api/latest/rest-api/openapi.json",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.sdk.exists",
   "note": "Keycloak documents an official Java admin client, org.keycloak:keycloak-admin-client, for the Admin REST API.",
   "source": "https://www.keycloak.org/securing-apps/admin-client",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.sdk.languages[0]",
   "note": "The downloads page lists the Admin Client Maven coordinate org.keycloak:keycloak-admin-client version 26.0.12.",
   "source": "https://www.keycloak.org/downloads",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.sdk.official",
   "note": "The admin-client guide is first-party Keycloak documentation for the Java library.",
   "source": "https://www.keycloak.org/securing-apps/admin-client",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.mcp.first_party",
   "note": "Opened Keycloak's MCP page. It documents using Keycloak as an authorization server for other MCP servers. It does not declare a first-party Keycloak admin MCP, so first_party stays unknown.",
   "source": "https://www.keycloak.org/securing-apps/mcp-authz-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.mcp.third_party[0]",
   "note": "dockndevai/mcp-keycloak is an independent MIT MCP server for Keycloak admin over the Admin REST API, with read-only, read-write, and admin modes. Commits on 2026-09-12. Not archived.",
   "source": "https://github.com/dockndevai/mcp-keycloak",
   "tier": "scraped"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.mcp.third_party[0]",
   "note": "The official MCP registry lists io.github.dockndevai/mcp-keycloak as Keycloak admin for AI agents covering realms, users, clients, and roles.",
   "source": "https://registry.modelcontextprotocol.io/v0.1/servers?search=keycloak",
   "tier": "scraped"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.cli.exists",
   "note": "The Server Administration Guide documents the Admin CLI kcadm.sh / kcadm.bat. It authenticates and performs create, get, update, and delete against Admin REST endpoints.",
   "source": "https://www.keycloak.org/docs/latest/server_admin/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.extensibility.scripting[0]",
   "note": "Keycloak documents kc.sh / kc.bat export and import of realm JSON, plus Admin Console partial export and import.",
   "source": "https://www.keycloak.org/server/importExport",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.data_access.export[0]",
   "note": "kc.sh export writes realm JSON to a directory or file. Admin Console partial export writes realm-export.json.",
   "source": "https://www.keycloak.org/server/importExport",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.data_access.import[0]",
   "note": "kc.sh import and --import-realm load realm JSON. Admin Console partial import accepts a previously exported JSON file.",
   "source": "https://www.keycloak.org/server/importExport",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "https://www.keycloak.org/llms.txt returned HTTP 404 on 2026-09-13.",
   "source": "https://www.keycloak.org/llms.txt",
   "tier": "scraped"
  },
  {
   "date": "2026-09-13",
   "fact": "verdict.scores.api",
   "note": "A documented Admin REST API with OpenAPI, password and client-credentials grants, and official Java and CLI clients is a broad production path. Self-hosted deployment and admin-role gates keep it in the 7-8 band rather than an unusually complete SaaS management plane.",
   "source": "https://www.keycloak.org/docs-api/latest/rest-api/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "verdict.scores.mcp",
   "note": "One maintained third-party MCP implementation published on npm as @dockndevai/mcp-keycloak 0.2.2. It covers a subset of Admin REST tools and is not vendor-owned, which is the one-maintained-third-party band.",
   "source": "https://raw.githubusercontent.com/dockndevai/mcp-keycloak/main/README.md",
   "tier": "scraped"
  },
  {
   "date": "2026-09-13",
   "fact": "verdict.scores.cli",
   "note": "kcadm is official, maps CRUD to Admin REST, and supports config-credentials sessions or per-invocation --no-config auth. It is a practical admin CLI, not a structured-output-first agent CLI.",
   "source": "https://www.keycloak.org/docs/latest/server_admin/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[0].url",
   "note": "Opened the current Server Developer Guide Admin REST API chapter, including password and client-credentials examples.",
   "source": "https://www.keycloak.org/docs/latest/server_development/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[1].url",
   "note": "Opened the current Admin REST API reference, including /admin/realms and preview OpenAPI links.",
   "source": "https://www.keycloak.org/docs-api/latest/rest-api/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[2].url",
   "note": "Opened the current Server Administration Guide Admin CLI chapter for kcadm.sh and kcadm.bat.",
   "source": "https://www.keycloak.org/docs/latest/server_admin/index.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[3].url",
   "note": "Opened the third-party MCP repository. It is not archived and had commits on 2026-09-12.",
   "source": "https://github.com/dockndevai/mcp-keycloak",
   "tier": "scraped"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[4].url",
   "note": "Opened the current official Java admin-client guide.",
   "source": "https://www.keycloak.org/securing-apps/admin-client",
   "tier": "declared"
  },
  {
   "date": "2026-09-13",
   "fact": "freshness.watch[5].url",
   "note": "Opened the current Integrating with Model Context Protocol guide. It is MCP authorization-server setup, not a Keycloak admin MCP.",
   "source": "https://www.keycloak.org/securing-apps/mcp-authz-server",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-13",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://www.keycloak.org/docs/latest/server_development/index.html"
   },
   {
    "type": "docs",
    "url": "https://www.keycloak.org/docs-api/latest/rest-api/index.html"
   },
   {
    "type": "docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html"
   },
   {
    "type": "repo",
    "url": "https://github.com/dockndevai/mcp-keycloak"
   },
   {
    "type": "docs",
    "url": "https://www.keycloak.org/securing-apps/admin-client"
   },
   {
    "type": "mcp",
    "url": "https://www.keycloak.org/securing-apps/mcp-authz-server"
   }
  ]
 },
 "homepage": "https://www.keycloak.org/",
 "id": "keycloak",
 "license": "open-source",
 "modalities": {
  "agent_docs": {
   "llms_txt": false
  },
  "api": {
   "auth": [
    "oauth2-password",
    "oauth2-client-credentials"
   ],
   "coverage": "full",
   "docs": "https://www.keycloak.org/docs-api/latest/rest-api/index.html",
   "exists": true,
   "kinds": [
    "rest",
    "openapi"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "realm-json"
   ],
   "import": [
    "realm-json"
   ]
  },
  "extensibility": {
   "scripting": [
    "kc-import-export"
   ],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [
    {
     "maintained": true,
     "registries": [
      "official-mcp-registry",
      "github"
     ],
     "repo": "https://github.com/dockndevai/mcp-keycloak"
    }
   ],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The Admin REST API, official Java admin client, and kcadm Admin CLI cover realm, user, client, and role administration without browser control. The opened Keycloak MCP guide is an authorization-server setup for other MCP servers, not a first-party Keycloak admin MCP. Red Hat build of Keycloak is outside this record.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "java"
   ],
   "official": true
  }
 },
 "name": "Keycloak",
 "platforms": [
  "linux",
  "windows",
  "web"
 ],
 "related": {
  "alternatives": [
   "okta",
   "microsoft-entra-id",
   "auth0",
   "fusionauth",
   "stytch"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Keycloak",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": 7,
   "computer_use": null,
   "integrations": null,
   "mcp": 4,
   "overall": 8,
   "rpa": null
  },
  "summary": "Keycloak is automatable today through the Admin REST API. The Server Developer Guide states that the Admin REST API has all features provided by the Admin Console. The current reference lives at {base url}/admin/realms and publishes preview OpenAPI JSON and YAML. Authentication is an OAuth 2.0 access token: a username and password grant against admin-cli, or a confidential-client service account using client credentials. Official tooling includes the Java keycloak-admin-client library and the Admin CLI (kcadm.sh / kcadm.bat) packaged with the server distribution. kc.sh export and import write and read realm JSON. Keycloak 26.7.3 is the opened download. Vendor docs describe Keycloak as an authorization server for other MCP servers; they do not declare an official Keycloak admin MCP, so first-party MCP ownership stays unknown. A maintained third-party server, @dockndevai/mcp-keycloak, is listed in the official MCP registry and wraps a subset of Admin REST tools. Connector catalogs were not opened. Computer-use viability is unassessed. API scores 8 and is the best path. CLI scores 7. MCP scores 4 for one maintained third-party implementation.\n"
 }
}