Keycloak MCP authentication: known deviations
Realms below 26.6.0 advertise Dynamic Client Registration that MCP clients cannot actually use.
How Keycloak deviates from the MCP authorization spec
- The JWKS lives at the realm's /protocol/openid-connect/certs rather than a root well-known path.
- Dynamic Client Registration was broken for MCP clients before Keycloak 26.6.0 — while the metadata still advertised it.
How to spot it without credentials
authorization_servers is the realm URL, and its metadata advertises a registration_endpoint.
What it breaks in production
A client that trusts the advertised registration_endpoint on an old realm fails registration — the metadata says one thing and the server does another.
Check a Keycloak-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp