keycloak-mcp-server

remove-role-from-user

Remove a realm role or client role from a user in Keycloak by providing realm, user ID, role name, and optional client ID for client roles.

Instructions

Remove a realm role, or a client role when clientId is given, from a user

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "realm": "<realm>",
      "userId": "<userId>",
      "roleName": "<roleName>"
    },
    "name": "remove-role-from-user"
  }
}

Input Schema

Name	Required	Description
`realm`	Yes	Realm name
`userId`	Yes	User ID
`clientId`	No	Client ID to resolve roleName as a client role. Omit for a realm role
`roleName`	Yes	Role name

Schema Changelog

Changes observed during successful MCP inspections.

First observedv2.0.0Aug 14, 2026

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description shoulders the burden of behavioral disclosure, but it only says 'Remove' without explaining side effects, idempotency, required permissions, or error behavior when the role is not assigned. This is a significant gap for a mutating operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly worded sentence that gets straight to the point. No wasted words, and the conditional clause adds important nuance without bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple role-removal tool, the description covers the core action and parameter semantics via the schema, making it minimally viable. However, the lack of behavioral notes (e.g., what happens if role not found, whether removal is permanent) leaves gaps in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full descriptions for all four parameters, including clientId's role-resolution behavior. The description adds little beyond restating that clientId switches to client role, so it meets the baseline but doesn't elevate understanding further.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Remove' and clearly identifies the resource: a role from a user. It also distinguishes between realm roles and client roles with the clientId condition, making it distinct from siblings like assign-role-to-user or remove-role-from-group.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description tells when to include clientId ('when clientId is given') to remove a client role versus omitting it for a realm role. This provides clear conditional usage guidance, though it doesn't explicitly mention alternatives or when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server