Report whether this server has working Keycloak credentials, which realm and account it acts as, whether writes are enabled, and — when something is missing — exactly what to set. Call this first when a tool you expected is not listed: an absent tool here means missing configuration rather than a bug.

Show who the server is authenticated as and what it is actually allowed to do: the issuing realm, the client, the acting user, token expiry, and the realm + 'realm-management' roles that govern admin access. The roles are read from the account's role mappings on the server, not from the token — Keycloak issues tokens with no role claims to some clients, so the token alone proves nothing. Call this FIRST when another tool returns 403.

Keycloak server version, uptime, JVM/memory info and enabled feature flags. The raw endpoint also dumps every SPI provider and theme (~1MB); this returns only the useful head of it.

List the realms this token can see.

Get a realm's full configuration: token lifespans, login/registration settings, password policy, SSO session timeouts, and the flow bindings.

Search users in a realm. Use search for a loose match across name/username/email, username/email + exact for a precise lookup, or q to match custom attributes.

Count users matching a filter, without fetching them.

Get one user's full representation, including custom attributes.

List the groups a user belongs to.

Get a user's role mappings. By default returns only roles assigned DIRECTLY to the user; set effective to also include roles inherited from groups and from composite roles — that is the set that actually lands in their token.

List a user's active SSO sessions (where and when they are logged in).

List the realm's groups. Groups are a tree — top-level groups are returned with their subGroups nested inside.

Get one group with its attributes and subgroups.

List the users in a group.

Get the roles mapped to a group. Every member of the group inherits these roles.

List the realm-level roles defined in a realm.

Get one realm role by name, with its attributes and composite flag.

List the users who have a given realm role — i.e. 'who has this role?'.

List the roles contained in a composite role. Takes the role's UUID (not its name) — get it from keycloak_get_realm_role.

List the roles defined by a client. Note these are distinct from realm roles — realm-management's roles (view-users, manage-users, ...) are client roles.

List the realm's clients (applications). Returns both id (the UUID every other client tool needs) and clientId (the name shown in the console).

Get a client's full configuration: flows, redirect URIs, web origins, and its attributes (including token lifespans). Its secret, if any, is redacted — use keycloak_get_client_secret to read it.

Get a confidential client's CURRENT SECRET IN PLAIN TEXT. This is a live credential — it will appear in the conversation. Requires manage-clients. (To keep it out of reach entirely, move this tool's registration behind KEYCLOAK_ALLOW_WRITES.)

Get the service-account user backing a client. That user is where the client's admin roles are assigned, so this is the way to check what a client can actually do.

Get the ready-to-use adapter config (keycloak.json) for a client — issuer URL, realm, credentials. Handy for wiring an app up to this client.

Count active sessions per client across the realm — who is logged in, and where.

List the active user sessions for one client.

Count the active sessions for one client.

Show whether event logging is enabled for the realm, which event types are recorded, and how long they are kept. Check this first if the event tools come back empty.

Search user events — logins, logouts, failed logins, registrations. The way to answer 'why can't this user log in?'. Requires user event logging to be enabled on the realm.

Search admin events — the audit trail of changes made to the realm itself (who created this user, who changed that client). Requires admin event logging to be enabled.

List the realm's client scopes. A client scope is a reusable bundle of protocol mappers and role scope — it's what decides which claims end up in a token.

Get one client scope with its protocol mappers.

Show which client scopes are assigned to a client, split into default (always applied) and optional (applied only when the request asks for them).

List the protocol mappers on a client or on a client scope. Mappers are what put claims into a token (a user attribute, group membership, an audience, a hardcoded value).

Generate the access token a client would actually issue, without logging anyone in. The direct way to answer 'why is this claim missing from my JWT?'.

List the realm's identity providers (external login sources: Google, GitHub, a corporate SAML or OIDC IdP). Their client secrets are redacted.

Get one identity provider's full config — endpoints, trust settings, sync mode. Its client secret is redacted.

List an identity provider's mappers — the rules translating claims from the external IdP into Keycloak users, roles and groups.

List the realm's authentication flows — the step-by-step login pipelines (browser, direct grant, registration, reset credentials).

Get the ordered steps inside a flow and whether each is REQUIRED, ALTERNATIVE, CONDITIONAL or DISABLED. This is what determines what a user is actually asked for when logging in (password, OTP, ...).

List the realm's required actions (Update Password, Verify Email, Configure OTP) and whether each is enabled or applied to new users by default.

Show which flow is bound to each authentication entry point of the realm — i.e. which flow actually runs on a browser login, a direct grant, a registration, a password reset.

Escape hatch: call any Keycloak Admin REST endpoint directly. Use it when no curated tool fits — user federation components, authorization policies, organizations, partial import/export, credentials. path is relative to the realm (users/123/credentials resolves under /admin/realms/{realm}/), or pass an absolute admin path starting with /admin/ (e.g. /admin/serverinfo). Writes are DISABLED: only GET is permitted. Set KEYCLOAK_ALLOW_WRITES=1 to allow mutations.