Loading ToolBench
Model Context Protocol server for Keycloak — multi-realm admin access with security modes and access-control flags.
Strong foundation with clear naming conventions (verb_noun pattern), comprehensive parameter descriptions, and proper schema definitions. All 13 tools follow consistent patterns. Tool descriptions are well-written (avg ~120 chars, within 10-1024 range). Parameters include type definitions and descriptions. However, output schemas are not explicitly documented in the source, and error handling lacks recovery guidance. Security controls are well-implemented (realm allowlist, dry-run mode, permission gates), but error messages could be more actionable for LLM self-correction.
Return the number of users in a realm, optionally matching a search term.
Create a new user in a realm. The user is created enabled unless specified otherwise. Set a password separately with reset_password.
Permanently delete a user from a realm. Requires admin mode AND KEYCLOAK_ALLOW_DELETE=true. Irreversible.
Fetch the configuration of a single realm.
Fetch a single user representation by their Keycloak id.
List OAuth/OIDC clients configured in a realm. Client secrets are not included.
Output schemas not documented in source code. While input schemas are properly defined with types and descriptions, return value structures are not explicitly declared. LLMs cannot plan downstream tool calls without knowing what fields to expect.
Error messages in toErrorResult() are generic. While KeycloakError includes status and body, there is no recovery guidance (e.g., 'User not found. Try search_users() with a partial name'). LLMs cannot self-correct without actionable error context.
Pagination support is incomplete. list_users and list_groups accept 'first' and 'max' parameters, but no 'total_count' or 'next_cursor' is documented in output. Large result sets could exhaust context windows without clear pagination metadata.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
List groups in a realm.
List the realm-level roles defined in a realm.
List all realms visible to the configured credentials. Realms outside the allowlist are filtered out.
List users in a realm. Supports free-text search and pagination. Passwords and secrets are never returned by Keycloak.
Revoke all active sessions for a user, forcing re-authentication.
Set a user's password. By default the password is temporary and must be changed at next login.
Patch an existing user. Only provided fields are changed. Use enabled=false to disable an account.
Confirmation/dry-run pattern not applied uniformly. delete_user requires KEYCLOAK_ALLOW_DELETE=true, but create_user and update_user lack confirmation steps. Agents could accidentally create/modify users without explicit approval.
Parameter 'search' in list_users and list_groups lacks format constraints. Description says 'free-text search' but does not specify max length, character restrictions, or whether regex is supported. LLMs may pass oversized or malformed search strings.