Is Keycloak agent-ready?

Keycloak scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.

Does Keycloak publish an OpenAPI spec?

No published OpenAPI specification was found when Keycloak was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is Keycloak's Headless Index score?

Keycloak scores 66/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

Keycloak

Headless Index

66/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Keycloak earns Band B in the Auth & Identity category of The Headless Index, with a thesis-fit score of 66/100. Its strongest dimension is API-first design intent (18/20); its weakest scored dimension is MCP and agent posture (4/20). No public OpenAPI specification was found when Keycloak was scored, which limits how far an agent can go without human integration work.

Editorial verdict

Keycloak is solidly built for programmatic consumption. The Headless Index thesis-fit score of 66/100 lands it in the upper-middle of the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where Keycloak lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Keycloak is the de-facto open-source identity server, with a REST Admin API plus the keycloak-admin-client libraries in Node, Java, Python, and others. The Authentication API supports OIDC, OAuth 2.0, SAML 2.0, and several custom flows. Realms, clients, users, roles, identity providers, authentication flows, and policies are all addressable via REST.^[1] Schema observability is the related test: can an agent introspect the contract from cold, or does it have to read prose documentation to do so? The Admin REST API is documented in fine detail and an OpenAPI specification ships in the keycloak/keycloak repository for several major versions. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: Every Admin Console action has a REST equivalent. Realm import and export via JSON, the kcadm.sh CLI, and the Keycloak Operator for Kubernetes all give infrastructure-as-code paths. Provider extensibility via Java SPIs adds a customisation layer that is itself code-first. Among the most operationally complete IdPs available.^[2] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No official Keycloak MCP server has been published by the upstream project, although several community implementations exist. Red Hat (which sponsors Keycloak) has not yet authored an MCP integration for the product, which is unusual given the active downstream ecosystem.^[3] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Webhook support is provided via the keycloak-event-listener SPI rather than as a first-party webhook product; this requires Java SPI implementation. Several community plugins fill the gap. The eventing story is therefore more open-source DIY than out-of-the-box. Net assessment: Keycloak can be operated by agents for the majority of practical workflows. The closest thing to a gap is MCP posture^[4], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent18/20

scored

Keycloak is the de-facto open-source identity server, with a REST Admin API plus the keycloak-admin-client libraries in Node, Java, Python, and others. The Authentication API supports OIDC, OAuth 2.0, SAML 2.0, and several custom flows. Realms, clients, users, roles, identity providers, authentication flows, and policies are all addressable via REST.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-05-20
−OpenAPI specNot found across 17 probe paths
·GraphQL endpointDiscovered at https://www.keycloak.org/graphql, introspection disabled or scoped
·SDKs maintained1 (java); top by stars: keycloak/keycloak-client (57 stars)

cite (1)

github.sdks@2026-05-19

Headless operation16/20

scored

Every Admin Console action has a REST equivalent. Realm import and export via JSON, the kcadm.sh CLI, and the Keycloak Operator for Kubernetes all give infrastructure-as-code paths. Provider extensibility via Java SPIs adds a customisation layer that is itself code-first. Among the most operationally complete IdPs available.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-05-20
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

github.sdks@2026-05-19

MCP & agent posture4/20

scored

No official Keycloak MCP server has been published by the upstream project, although several community implementations exist. Red Hat (which sponsors Keycloak) has not yet authored an MCP integration for the product, which is unusual given the active downstream ecosystem.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-05-20
−Official MCP serverNone found in vendor's GitHub org or the official MCP registry
−Community MCP serversNone found
−Agent-friendly SDKsNo TypeScript/JavaScript SDK published (agents commonly run in TS/JS)

cite (1)

github.sdks@2026-05-19

Schema observability16/20

scored

The Admin REST API is documented in fine detail and an OpenAPI specification ships in the keycloak/keycloak repository for several major versions. Agents can fetch and use the spec without writing custom integration code.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-05-20
−OpenAPINot discovered across 17 standard probe paths
·GraphQL introspectionGraphQL endpoint at https://www.keycloak.org/graphql but introspection is disabled, scoped, or behind authentication

cite (1)

github.sdks@2026-05-19

Webhooks & events12/20

scored

Webhook support is provided via the keycloak-event-listener SPI rather than as a first-party webhook product; this requires Java SPI implementation. Several community plugins fill the gap. The eventing story is therefore more open-source DIY than out-of-the-box.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-05-20
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

github.sdks@2026-05-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:B band: JAIRF=N/A HeadlessIndex=66

04 / Embed

Show Keycloak's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Auth & Identity

Amazon CognitoB

Headless Index 66/100

Ping IdentityB

Headless Index 64/100

authentikB

Headless Index 68/100

See full Auth & Identity ranking →

FAQ

Keycloak and agent readiness

Is Keycloak agent-ready?: Keycloak scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.
Does Keycloak publish an OpenAPI spec?: No published OpenAPI specification was found when Keycloak was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is Keycloak's Headless Index score?: Keycloak scores 66/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.