keycloak-mcp

The server uses the official Keycloak Admin Client and implements robust input validation using Zod schemas for all tool arguments. Admin credentials (URL, username, password) are loaded from environment variables or command-line arguments and are validated to ensure they are not empty. There are no direct 'eval' calls or obvious malicious patterns in the provided source. The primary security consideration is the sensitive nature of the Keycloak admin credentials, which grant full administrative access to Keycloak. Proper handling of these credentials in the deployment environment (e.g., using secure secrets management) is critical to prevent unauthorized access to the Keycloak instance.