# Keycloak MCP: Authorize AI Agents With OAuth 2.1 Now > Source: > Published: 2026-07-29 08:14:02+00:00 KubeCon Japan 2026 is wrapping up in Yokohama, and three cloud-native milestones got their moment in the spotlight: Kubernetes DRA GA, OpenTelemetry graduation, and — the one most developers should actually care about — **Keycloak’s Model Context Protocol authorization support reaching production maturity**. If you’re shipping AI agents that call MCP tools, pay attention: most of those agents are currently operating without any real authorization layer. ## The Problem With Default MCP Here is what the default MCP setup looks like from a security standpoint: your agent authenticates once to the MCP server and then gets access to every tool that server exposes. No per-tool credential check. No scope enforcement. No unified audit trail linking a user request to the downstream tool calls it triggers. That means a single compromised MCP server yields the union of every tool’s permissions — `database.query` , `database.write` , `files.read` , `files.write` — in one shot. If your agent gets prompt-injected or its session token is stolen, the blast radius is the full tool surface. This is not a theoretical concern. It is how most production MCP deployments work today. ## What Keycloak 26.6 and 26.7 Add Keycloak 26.6 (April 2026) added experimental support for CIMD — the [OAuth Client ID Metadata Document standard that the MCP specification has required since its November 2025 revision](https://modelcontextprotocol.io/docs/tutorials/security/authorization). CIMD enables dynamic client registration: agents do not need to be pre-registered as Keycloak clients. Each agent presents a metadata URL describing itself, Keycloak fetches it, and issues a scoped token. No static client secret. No manual provisioning step for every new agent deployment. Keycloak 26.7, released this month, added official integration documentation for Claude Code and VS Code as MCP clients — both using CIMD with PKCE-secured public client flows and localhost callbacks. The practical result: you can now map each MCP tool to a specific OAuth scope and have Keycloak mint tokens with only the minimum required scope. An agent that needs to query a database never receives a write token. An agent with read-only file access cannot touch the write endpoint. ### Enabling It To use Keycloak as an MCP authorization server, enable the CIMD feature flag at startup: ``` ./kc.sh start --features=cimd ``` Then configure a client policy in the Admin Console: **Realm Settings → Client Policies → Profiles**. Create a new profile and add the `client-id-metadata-document` executor. Define OAuth scopes mapped to your MCP tool surface and configure agents to request only the scopes they need per invocation. The [official Keycloak MCP documentation](https://www.keycloak.org/securing-apps/mcp-authz-server) covers the full setup, including Claude Code and VS Code as public MCP clients. ## The Keyless Pattern: SPIRE and DPoP Keycloak 26.x with CIMD is the baseline. The pattern showcased at [KeycloakCon Japan 2026](https://www.cncf.io/blog/2026/07/14/keycloakcon-japan-2026-navigating-cloud-native-identity-and-the-ai-frontier/) goes further: zero static credentials, zero human-created Keycloak clients, full audit trail. It combines SPIRE and DPoP. SPIRE (the SPIFFE runtime environment) issues SVIDs — short-lived, cryptographically signed workload identity documents — on pod start via Kubernetes attestation. Every agent container gets an SVID automatically, rotating every hour. The agent presents its SVID to Keycloak as a federated client assertion. Keycloak validates the SVID and issues a DPoP-bound access token. DPoP (Demonstrating Proof of Possession) binds the access token cryptographically to the agent’s key pair. A stolen token is useless without the corresponding private key. Token replay is impossible. Combined with per-tool scopes, every tool call is bounded, auditable, and rotation-safe — with no secrets ever written to disk. This is the gold standard for production AI agent security, and it is deployable today with open-source components. ## Why This Is Landing Now According to CNCF survey data, 66% of organizations already run generative AI inference on Kubernetes. Compliance teams are demanding audit trails for agent-triggered actions. MCP has become the de facto standard for tool-calling in agentic systems. The authorization gap — between “agent authenticated” and “agent authorized to call this specific tool with these specific permissions” — is becoming a production blocker. Keycloak fills that gap with an open-source, no-per-MAU-fee implementation that is now officially production-ready per the MCP specification. The [26.7 release](https://www.keycloak.org/2026/07/keycloak-2670-released) with Claude Code integration makes it the most developer-accessible version yet. If you’re shipping MCP agents to production without an authorization layer, you are betting that nothing goes wrong. That bet gets worse every time your agent surface grows.