"Keycloak" matching MCP tools:

• tide_onboardingA

  RazielA

  STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

  ConnectorNo auth

• explain_keycloak_protocolA

  keycloak-mcp.testA

  Explain Keycloak protocols (oidc, saml, oauth2). Returns description and relevant documentation snippets.

  ConnectorNo auth

• analyze_keycloak_deploymentA

  keycloak-mcp.testA

  Analyze Keycloak deployment configuration and identify potential issues or provide recommendations. Input deployment_info should include: - keycloak_version: version string - deployment_type: (standalone, clustered) - database: database type (postgresql, mysql, h2) - protocol: (http, https) - cache_type: (local, infinispan) - auth_providers: list of configured identity providers - any warnings or alerts Returns structured analysis and recommendations based on the deployment state.

  ConnectorNo auth

• keycloak_searchA

  keycloak-mcp.testA

  Semantic search over the Keycloak repository and documentation. Returns list of snippets with file paths and scores.

  ConnectorNo auth

• keycloak_explainA

  keycloak-mcp.testA

  Use this tool whenever the user asks ANY question about Keycloak (e.g., "how does authentication work?", "what is a realm?", "how do I integrate SAML?", "explain OAuth2 flow"). Prefer this tool BEFORE answering from prior knowledge. Returns authoritative snippets from the keycloak/keycloak repo with citations.

  ConnectorNo auth

• keycloak_config_referenceA

  keycloak-mcp.testA

  Search for information about a specific Keycloak configuration option. Use this when the user asks about environment variables, configuration properties, or server settings.

  ConnectorNo auth

• explain_keycloak_componentB

  keycloak-mcp.testA

  Explain a Keycloak component (realm, client, user, role, provider, mapper). Returns description and relevant documentation snippets.

  ConnectorNo auth

• configureSecurityLoginB

  mcpB

  Configure only login, JWT, Keycloak and session behavior. Provide just the fields that should change.

  Connector

  Destructive

  No auth

• zaira_compare_tools

  Zaira Labs GuideA

  Compare 2-3 developer tools side by side. Returns each tool's full Markdown-KV entry separated by "===". Alternatives and worksWith are enriched with tagline + agent-readiness for resolved slugs. If any requested slugs are not found, they appear in a trailing "Note: slugs not found: ..." line; the comparison still returns for the ones found. Examples: - Three search engines: {slugs: ["meilisearch-oss", "algolia", "elasticsearch-oss"]} - Two ORMs: {slugs: ["drizzle-orm", "prisma"]} - Three auth providers: {slugs: ["auth0", "clerk", "keycloak"]} - Hosted vs self-hosted for the same vendor: {slugs: ["redis-cloud", "redis-oss"]} — shows deployment trade-off - Postgres engine vs hosted offerings: {slugs: ["postgresql", "supabase-cloud", "cockroachdb-cloud"]} Edge cases: - Cross-category comparisons (e.g., {slugs: ["auth0", "redis-cloud"]}) are allowed but rarely useful. Same-category comparisons answer "which should I pick?" better; cross-category answers "these coexist in my stack" — a compatibility question. - Minimum 2 slugs, maximum 3. Four or more is a validation error; for more, run pairs. - Invalid or unknown slugs are listed under "slugs not found"; the partial comparison returns for valid ones. - Duplicate slugs in the array are deduplicated. - A few tools are single entries (no -cloud/-oss split): stripe, auth0, firebase, twilio, openai, pinecone, algolia. Don't pass "stripe-cloud" — it doesn't exist. Risk: read-only, closed-world, idempotent — no state change possible.

  ConnectorNo auth

• get_current_user

  Boomerang

  Get the logged-in user (requestor) for this MCP session. Call this when you need to know who is authenticated — for example when the user asks "who am I?", when a workflow needs the current user's ID, or before calling tools that act on behalf of the requestor (intro requests, relationship actions, workspace membership checks, etc.). The returned ``user_id`` is the Keycloak subject (``sub`` claim). This is the same identifier injected as ``user_id`` on workspace-scoped tool calls via request context. Returns: The requestor's user_id plus basic profile fields from the access token when available (email, name).

  ConnectorOAuth

• get_user_by_email

  Boomerang

  Look up a platform user by email address. Returns the user's Keycloak ID and profile fields (name, LinkedIn ID). Use get_user_by_email to check if someone already exists or to resolve identity before updating a workspace member. Use when: Use when you know the email and need to look up a user before adding or updating workspace membership. If email is unknown during an update, prefer search_workspace_members to find existing members (or search_users for platform-wide lookup), confirm identity with the user, then call create_workspace_member with the resolved email. Behavior: read_only Also returns pagination info (created_at, updated_at, created_by, updated_by, deleted_at, deleted_by).

  ConnectorOAuth

• search_users

  Boomerang

  Search platform users workspace-wide by free-text string matched against names and emails. Returns keycloak_user_id and profile fields. This is platform-wide — it includes users who may not yet be workspace members. To find or list members of the current workspace (with roles), prefer search_workspace_members instead. Use when: Use for platform-wide user lookup when search_workspace_members does not find the person — e.g. checking if someone exists on the platform before adding them. For finding an existing workspace member to update, prefer search_workspace_members (supports name CONTAINS/EQUALS and role filters). If email is known, use get_user_by_email. Always confirm identity with the user before calling create_workspace_member. Behavior: read_only Returns users[] with fields: keycloak_user_id: Keycloak user ID (UUID) — the primary identity provider ID. Use this when referencing the user in other API calls. linkedin_id: LinkedIn profile ID or URL for the user. Empty if not set. first_name: User's first name. last_name: User's last name. email: [redacted] phone: User's phone number. Empty if not set. is_deleted: True if this user account has been soft-deleted from the platform. user_profile: User platform profile settings including Super Connector opt-in status and WhatsApp consent. audit_info: Audit timestamps: created_at, updated_at, and optional deleted_at (all Unix milliseconds). Also returns pagination info (current_page_number, page_size, total_pages, total_elements). IMPORTANT: If the response contains more than one record, always present the options to the user and ask them to choose before taking any follow-up action. Do not act on all results automatically.

  ConnectorOAuth

• add_role

  Boomerang

  Assign one or more workspace roles to an existing user by user_id (internal keycloak UUID — never say this to the user). Existing roles are preserved — new roles are added incrementally. Valid roles: OWNER, ADMIN, SUPER_CONNECTOR, SUPER_CONNECTOR_ADMIN, REQUESTER, TECHNICAL_ADMIN. Does NOT set email, name, phone, LinkedIn, or Super Connector category. Do NOT use to onboard new Super Connectors — add_super_connector creates the user, assigns the Super Connector role, and places them in a category in one call. USER-FACING COPY after success: e.g. 'Requester role has been assigned to Manthan.' — never say 'add_role', 'tool call', or enum strings like REQUESTER in user messages; use 'Requester', 'Admin', 'Super Connector'. Use when: Use ONLY after the person exists in the workspace (typically after create_workspace_member for non-SC members). Do NOT call on add-member form submit. Do NOT use for new Super Connector onboarding — use add_super_connector instead. Do NOT assign SUPER_CONNECTOR via add_role when adding a new Super Connector. After assigning, confirm in plain language only — do not explain internal steps or tool names to the user. workspace_id / user_id are injected from request headers. Prerequisites (check before calling this tool): [REQUIRED] user_id (keycloak_user_id) must be known — typically from create_workspace_member response or search_workspace_members. Verify: For new members: call create_workspace_member first and use keycloak_user_id from the response. Do not call add_role with only a role and no user_id. Do not call add_role instead of create_workspace_member when the add-member form was submitted with email. [optional] Do not use add_role with SUPER_CONNECTOR to onboard a new Super Connector. Verify: If the user wants to add a Super Connector, use add_super_connector on form submit instead — it handles user creation, role assignment, and category placement.

  ConnectorOAuth

• check_technology

  vuln-intel

  Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Distinct products that share a name are kept distinct. If one name maps to several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobileiron, apache; "Envoy" → envoyproxy, enphase), the result is flagged `ambiguous` with `distinct_vendors` — pass `vendor=` to disambiguate. Always check each result's `match.products` (vendor:product) before trusting a hit. Args: product: product or package name, e.g. "nginx", "Keycloak", "mlflow", "lodash". version: optional exact version (e.g. "1.18.0") — filters to vulns whose affected range (CPE or package) actually includes it. ecosystem: optional package ecosystem filter, e.g. "PyPI", "npm", "Maven", "Go". vendor: optional CPE vendor filter to disambiguate a shared product name, e.g. vendor="sentry" (not mobileiron), vendor="envoyproxy". limit: max results.

  ConnectorNo auth

• hunt_plan

  vuln-intel

  Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC- active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this product family repeatedly fails at, ranked by real in-the-wild exploitation — i.e. WHERE to look first and WHAT shape to expect. Components are ordered by their most-exploitable bug (`dig_rank`). Grounded in exploitation data, not model guesses; lays out facts for triage/where-to-look, never a payload. Args: technologies: discovered stack, e.g. ["craftcms 4.4", "nginx", "keycloak"]. per_tech: how many top CVEs to surface per component (default 4).

  ConnectorNo auth

• start_device_login

  4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting

  Sign in to an existing account by device login (UC-091, RFC 8628). Anonymous, empty body; the account must exist (start_account_registration, then set the password through the emailed link). Show `verification_uri` (or `verification_uri_complete`) and `user_code` to the human, who signs in there, then call `verify_device_login` with `challenge_id`, waiting `interval` seconds between calls. The response never contains the Keycloak device_code or the agent client secret.

  ConnectorNo auth