Keycloak Provider

KEYCLOAK_SERVER_URL=https://keycloak.example.com
KEYCLOAK_REALM=mcp
MCP_URL=https://mcp.example.com

import { MCPServer } from "mcp-use";
import { oauthKeycloakProvider } from "mcp-use/oauth/keycloak";

const serverUrl = process.env.KEYCLOAK_SERVER_URL;
const realm = process.env.KEYCLOAK_REALM;
if (!serverUrl || !realm) {
  throw new Error("KEYCLOAK_SERVER_URL and KEYCLOAK_REALM are required");
}

const server = new MCPServer({
  name: "keycloak-server",
  version: "1.0.0",
  oauth: oauthKeycloakProvider({ serverUrl, realm }),
});

export default server;

server.tool(
  {
    name: "admin_action",
    description: "Run an operation for a Keycloak resource administrator.",
  },
  async (_args, ctx) => {
    if (!ctx.auth.permissions.includes("mcp-api:admin")) {
      return {
        isError: true,
        content: [{ type: "text", text: "Forbidden" }],
      };
    }

    return {
      content: [{ type: "text", text: `Allowed ${ctx.auth.user.id}` }],
    };
  },
);