keycloak-model-context-protocol 0.0.2 → 1.0.0

package/dist/index.js

@@ -1,178 +1,40 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { ListToolsRequestSchema, CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import KcAdminClient from '@keycloak/keycloak-admin-client';
-import { z } from 'zod';
-const server = new Server({
-    name: "keycloak-admin",
-    version: "0.0.1",
-}, {
-    capabilities: {
-        tools: {},
-    },
-});
-// Initialize Keycloak client
-const kcAdminClient = new KcAdminClient({
-    baseUrl: process.env.KEYCLOAK_URL || 'http://localhost:8080',
-    realmName: 'master'
-});
-// Tool schemas
-const CreateUserSchema = z.object({
-    realm: z.string(),
-    username: z.string(),
-    email: z.string().email(),
-    firstName: z.string(),
-    lastName: z.string()
-});
-const DeleteUserSchema = z.object({
-    realm: z.string(),
-    userId: z.string()
-});
-const ListUsersSchema = z.object({
-    realm: z.string()
-});
-// List available tools
-server.setRequestHandler(ListToolsRequestSchema, async () => {
-    return {
-        tools: [
-            {
-                name: "create-user",
-                description: "Create a new user in a specific realm",
-                inputSchema: {
-                    type: "object",
-                    properties: {
-                        realm: { type: "string" },
-                        username: { type: "string" },
-                        email: { type: "string", format: "email" },
-                        firstName: { type: "string" },
-                        lastName: { type: "string" }
-                    },
-                    required: ["realm", "username", "email", "firstName", "lastName"]
-                }
-            },
-            {
-                name: "delete-user",
-                description: "Delete a user from a specific realm",
-                inputSchema: {
-                    type: "object",
-                    properties: {
-                        realm: { type: "string" },
-                        userId: { type: "string" }
-                    },
-                    required: ["realm", "userId"]
-                }
-            },
-            {
-                name: "list-realms",
-                description: "List all available realms",
-                inputSchema: {
-                    type: "object",
-                    properties: {},
-                    required: []
-                }
-            },
-            {
-                name: "list-users",
-                description: "List users in a specific realm",
-                inputSchema: {
-                    type: "object",
-                    properties: {
-                        realm: { type: "string" }
-                    },
-                    required: ["realm"]
-                }
-            }
-        ]
-    };
-});
-// Handle tool calls
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    // Authenticate before each request
-    await kcAdminClient.auth({
-        username: process.env.KEYCLOAK_ADMIN || 'admin',
-        password: process.env.KEYCLOAK_ADMIN_PASSWORD || 'admin',
-        grantType: 'password',
-        clientId: 'admin-cli',
-    });
-    const { name, arguments: args } = request.params;
+#!/usr/bin/env node
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { ConfigError, collectSecrets, loadConfig } from "./config.js";
+import { KeycloakAdminGateway } from "./keycloak/gateway.js";
+import { createLogger } from "./logging.js";
+import { createServer } from "./server.js";
+import { VERSION } from "./version.js";
+function main() {
+    let config;
     try {
-        switch (name) {
-            case "create-user": {
-                const { realm, username, email, firstName, lastName } = CreateUserSchema.parse(args);
-                kcAdminClient.setConfig({
-                    realmName: realm
-                });
-                const user = await kcAdminClient.users.create({
-                    realm,
-                    username,
-                    email,
-                    firstName,
-                    lastName,
-                    enabled: true
-                });
-                return {
-                    content: [{
-                            type: "text",
-                            text: `User created successfully. User ID: ${user.id}`
-                        }]
-                };
-            }
-            case "delete-user": {
-                const { realm, userId } = DeleteUserSchema.parse(args);
-                kcAdminClient.setConfig({
-                    realmName: realm
-                });
-                await kcAdminClient.users.del({
-                    id: userId,
-                    realm
-                });
-                return {
-                    content: [{
-                            type: "text",
-                            text: `User ${userId} deleted successfully from realm ${realm}`
-                        }]
-                };
-            }
-            case "list-realms": {
-                const realms = await kcAdminClient.realms.find();
-                return {
-                    content: [{
-                            type: "text",
-                            text: `Available realms:\n${realms.map(r => `- ${r.realm}`).join('\n')}`
-                        }]
-                };
-            }
-            case "list-users": {
-                const { realm } = ListUsersSchema.parse(args);
-                kcAdminClient.setConfig({
-                    realmName: realm
-                });
-                const users = await kcAdminClient.users.find();
-                return {
-                    content: [{
-                            type: "text",
-                            text: `Users in realm ${realm}:\n${users.map(u => `- ${u.username} (${u.id})`).join('\n')}`
-                        }]
-                };
-            }
-            default:
-                throw new Error(`Unknown tool: ${name}`);
-        }
+        config = loadConfig();
     }
     catch (error) {
-        if (error instanceof z.ZodError) {
-            return {
-                isError: true,
-                content: [{
-                        type: "text",
-                        text: `Invalid arguments: ${error.errors.map(e => `${e.path.join(".")}: ${e.message}`).join(", ")}`
-                    }]
-            };
-        }
-        throw error;
+        process.stderr.write(`${error instanceof ConfigError ? error.message : "Failed to load configuration."}\n`);
+        process.exit(1);
     }
-});
-// Start the server
-const transport = new StdioServerTransport();
-await server.connect(transport);
-console.error("Keycloak MCP Server running on stdio");
+    const logger = createLogger({ level: config.logLevel, secrets: collectSecrets(config) });
+    for (const warning of config.warnings)
+        logger.warn(warning);
+    // Login happens lazily on the first tool call, so startup needs no reachable Keycloak.
+    const gateway = new KeycloakAdminGateway(config, { logger });
+    const handle = serveStdio(() => createServer({ config, gateway, logger }), {
+        onerror: (error) => logger.error("Transport error", { error: error.message }),
+    });
+    logger.info("keycloak-model-context-protocol started", {
+        version: VERSION,
+        url: config.url,
+        authRealm: config.authRealm,
+        grantType: config.credentials.grantType,
+        readOnly: config.readOnly,
+        toolsets: [...config.toolsets],
+    });
+    const shutdown = () => {
+        handle.close().finally(() => process.exit(0));
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+main();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,SAAS,IAAI;IACX,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,IAAI,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE5D,uFAAuF;IACvF,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;QACzE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;QACrD,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/keycloak/errors.js

@@ -0,0 +1,86 @@
+import { NetworkError } from "@keycloak/keycloak-admin-client";
+/** An error whose message is safe and useful to show to the model/user. */
+export class ToolError extends Error {
+    kind;
+    status;
+    constructor(kind, message, status) {
+        super(message);
+        this.name = "ToolError";
+        this.kind = kind;
+        this.status = status;
+    }
+}
+function detailFrom(data) {
+    if (typeof data === "string" && data.trim() !== "")
+        return data.trim().slice(0, 300);
+    if (data && typeof data === "object") {
+        const record = data;
+        for (const key of ["errorMessage", "error_description", "error", "message"]) {
+            const value = record[key];
+            if (typeof value === "string" && value.trim() !== "")
+                return value.trim().slice(0, 300);
+        }
+    }
+    return undefined;
+}
+function withDetail(message, detail) {
+    return detail ? `${message} Keycloak says: ${detail}` : message;
+}
+export function httpStatusOf(error) {
+    return error instanceof NetworkError ? error.response.status : undefined;
+}
+function isTimeout(error) {
+    return (error instanceof Error &&
+        (error.name === "TimeoutError" ||
+            error.name === "AbortError" ||
+            (error.cause instanceof Error &&
+                (error.cause.name === "TimeoutError" || error.cause.name === "AbortError"))));
+}
+function mapHttp(error, ctx) {
+    const status = error.response.status;
+    const detail = detailFrom(error.responseData);
+    if (ctx.phase === "login") {
+        const realm = ctx.authRealm ?? "master";
+        if (status === 400 || status === 401) {
+            return new ToolError("auth", withDetail(`Authentication against Keycloak realm '${realm}' failed (HTTP ${status}). Check KEYCLOAK_CLIENT_ID/KEYCLOAK_CLIENT_SECRET or KEYCLOAK_USERNAME/KEYCLOAK_PASSWORD and KEYCLOAK_AUTH_REALM.`, detail), status);
+        }
+        if (status === 404) {
+            return new ToolError("auth", `Authentication realm '${realm}' or the token endpoint was not found (HTTP 404). Check KEYCLOAK_URL and KEYCLOAK_AUTH_REALM.`, status);
+        }
+    }
+    switch (status) {
+        case 401:
+            return new ToolError("auth", "Keycloak rejected the access token (HTTP 401). The credentials may be invalid or the token expired.", status);
+        case 403:
+            return new ToolError("forbidden", withDetail("Keycloak denied the operation (HTTP 403). The configured account lacks the required admin permissions (e.g. realm-management roles such as view-users, manage-users, view-realm) in the target realm.", detail), status);
+        case 404:
+            return new ToolError("not_found", withDetail("Not found (HTTP 404). The realm or the requested resource does not exist.", detail), status);
+        case 409:
+            return new ToolError("conflict", withDetail("Conflict (HTTP 409). The resource already exists or is in conflict.", detail), status);
+        case 400:
+        case 422:
+            return new ToolError("bad_request", withDetail(`Keycloak rejected the request as invalid (HTTP ${status}).`, detail), status);
+        default:
+            if (status >= 500) {
+                return new ToolError("server", withDetail(`Keycloak reported a server error (HTTP ${status}).`, detail), status);
+            }
+            return new ToolError("unexpected", withDetail(`Unexpected response from Keycloak (HTTP ${status}).`, detail), status);
+    }
+}
+/** Idempotent: ToolErrors pass through unchanged. Never leaks stack traces or secrets. */
+export function mapKeycloakError(error, ctx = {}) {
+    if (error instanceof ToolError)
+        return error;
+    if (error instanceof NetworkError)
+        return mapHttp(error, ctx);
+    if (isTimeout(error)) {
+        return new ToolError("timeout", `The request to Keycloak timed out${ctx.timeoutMs ? ` after ${ctx.timeoutMs} ms` : ""}. Increase KEYCLOAK_MCP_TIMEOUT_MS or check the server.`);
+    }
+    if (error instanceof TypeError ||
+        (error instanceof Error &&
+            /fetch failed|ECONN|ENOTFOUND|EAI_AGAIN|ETIMEDOUT|certificate/i.test(`${error.message} ${String(error.cause ?? "")}`))) {
+        return new ToolError("network", `Cannot reach Keycloak${ctx.baseUrl ? ` at ${ctx.baseUrl}` : ""}. Check KEYCLOAK_URL, network connectivity and TLS settings.`);
+    }
+    return new ToolError("unexpected", "An unexpected error occurred while talking to Keycloak.");
+}
+//# sourceMappingURL=errors.js.map

package/dist/keycloak/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/keycloak/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAe/D,2EAA2E;AAC3E,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IACpB,MAAM,CAAqB;IAEpC,YAAY,IAAmB,EAAE,OAAe,EAAE,MAAe;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAUD,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrF,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,MAA0B;IAC7D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC5B,KAAK,CAAC,IAAI,KAAK,YAAY;YAC3B,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK;gBAC3B,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB,EAAE,GAAiB;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC;QACxC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,IAAI,SAAS,CAClB,MAAM,EACN,UAAU,CACR,0CAA0C,KAAK,kBAAkB,MAAM,oHAAoH,EAC3L,MAAM,CACP,EACD,MAAM,CACP,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,SAAS,CAClB,MAAM,EACN,yBAAyB,KAAK,+FAA+F,EAC7H,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,SAAS,CAClB,MAAM,EACN,qGAAqG,EACrG,MAAM,CACP,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,SAAS,CAClB,WAAW,EACX,UAAU,CACR,uMAAuM,EACvM,MAAM,CACP,EACD,MAAM,CACP,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,SAAS,CAClB,WAAW,EACX,UAAU,CACR,2EAA2E,EAC3E,MAAM,CACP,EACD,MAAM,CACP,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,SAAS,CAClB,UAAU,EACV,UAAU,CAAC,qEAAqE,EAAE,MAAM,CAAC,EACzF,MAAM,CACP,CAAC;QACJ,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,OAAO,IAAI,SAAS,CAClB,aAAa,EACb,UAAU,CAAC,kDAAkD,MAAM,IAAI,EAAE,MAAM,CAAC,EAChF,MAAM,CACP,CAAC;QACJ;YACE,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAClB,OAAO,IAAI,SAAS,CAClB,QAAQ,EACR,UAAU,CAAC,0CAA0C,MAAM,IAAI,EAAE,MAAM,CAAC,EACxE,MAAM,CACP,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,SAAS,CAClB,YAAY,EACZ,UAAU,CAAC,2CAA2C,MAAM,IAAI,EAAE,MAAM,CAAC,EACzE,MAAM,CACP,CAAC;IACN,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,GAAG,GAAiB,EAAE;IACrE,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,SAAS,CAClB,SAAS,EACT,oCAAoC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,yDAAyD,CAC/I,CAAC;IACJ,CAAC;IACD,IACE,KAAK,YAAY,SAAS;QAC1B,CAAC,KAAK,YAAY,KAAK;YACrB,+DAA+D,CAAC,IAAI,CAClE,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAChD,CAAC,EACJ,CAAC;QACD,OAAO,IAAI,SAAS,CAClB,SAAS,EACT,wBAAwB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,8DAA8D,CAC9H,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,SAAS,CAAC,YAAY,EAAE,yDAAyD,CAAC,CAAC;AAChG,CAAC"}

package/dist/keycloak/gateway.js

@@ -0,0 +1,131 @@
+import KcAdminClient from "@keycloak/keycloak-admin-client";
+import { silentLogger } from "../logging.js";
+import { httpStatusOf, mapKeycloakError } from "./errors.js";
+const DEFAULT_SKEW_MS = 30_000;
+const FALLBACK_LIFETIME_MS = 60_000;
+function tokenExpiryMs(token) {
+    if (!token)
+        return undefined;
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.exp === "number" ? decoded.exp * 1000 : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Owns the admin client and the token lifecycle. The client's realm is the
+ * auth realm for its whole life; target realms travel only in request payloads
+ * (never via setConfig), so tokens can never be requested from a target realm.
+ */
+export class KeycloakAdminGateway {
+    kc;
+    config;
+    now;
+    logger;
+    skewMs;
+    expiresAtMs = 0;
+    inflight;
+    constructor(config, options = {}) {
+        this.config = config;
+        this.now = options.now ?? Date.now;
+        this.logger = options.logger ?? silentLogger;
+        this.skewMs = options.refreshSkewMs ?? DEFAULT_SKEW_MS;
+        this.kc =
+            options.client ??
+                new KcAdminClient({
+                    baseUrl: config.url,
+                    realmName: config.authRealm,
+                    timeout: config.timeoutMs,
+                });
+    }
+    get errorContext() {
+        return {
+            baseUrl: this.config.url,
+            authRealm: this.config.authRealm,
+            timeoutMs: this.config.timeoutMs,
+        };
+    }
+    async run(fn) {
+        await this.ensureToken();
+        try {
+            return await fn(this.kc);
+        }
+        catch (error) {
+            if (httpStatusOf(error) !== 401)
+                throw mapKeycloakError(error, this.errorContext);
+            // Token revoked or expired server-side: re-authenticate once and retry.
+            this.logger.debug("Keycloak returned 401; re-authenticating once");
+            this.expiresAtMs = 0;
+            await this.ensureToken();
+            try {
+                return await fn(this.kc);
+            }
+            catch (retryError) {
+                throw mapKeycloakError(retryError, this.errorContext);
+            }
+        }
+    }
+    tokenIsFresh() {
+        return this.kc.accessToken !== undefined && this.now() < this.expiresAtMs - this.skewMs;
+    }
+    /** Single-flight: concurrent callers share one login/refresh. */
+    async ensureToken() {
+        if (this.tokenIsFresh())
+            return;
+        this.inflight ??= this.authenticate().finally(() => {
+            this.inflight = undefined;
+        });
+        await this.inflight;
+    }
+    async authenticate() {
+        const { credentials } = this.config;
+        try {
+            if (this.kc.refreshToken && this.kc.accessToken) {
+                try {
+                    await this.kc.auth({
+                        grantType: "refresh_token",
+                        clientId: credentials.clientId,
+                        ...(credentials.clientSecret !== undefined && {
+                            clientSecret: credentials.clientSecret,
+                        }),
+                        refreshToken: this.kc.refreshToken,
+                    });
+                    this.recordExpiry();
+                    return;
+                }
+                catch {
+                    this.logger.debug("Token refresh failed; falling back to full login");
+                }
+            }
+            await this.kc.auth(credentials.grantType === "client_credentials"
+                ? {
+                    grantType: "client_credentials",
+                    clientId: credentials.clientId,
+                    clientSecret: credentials.clientSecret,
+                }
+                : {
+                    grantType: "password",
+                    clientId: credentials.clientId,
+                    ...(credentials.clientSecret !== undefined && {
+                        clientSecret: credentials.clientSecret,
+                    }),
+                    username: credentials.username,
+                    password: credentials.password,
+                });
+            this.recordExpiry();
+        }
+        catch (error) {
+            this.expiresAtMs = 0;
+            throw mapKeycloakError(error, { ...this.errorContext, phase: "login" });
+        }
+    }
+    recordExpiry() {
+        this.expiresAtMs = tokenExpiryMs(this.kc.accessToken) ?? this.now() + FALLBACK_LIFETIME_MS;
+    }
+}
+//# sourceMappingURL=gateway.js.map

package/dist/keycloak/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/keycloak/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,iCAAiC,CAAC;AAE5D,OAAO,EAAe,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAqB,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAsBhF,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACd,EAAE,CAAgB;IAClB,MAAM,CAAgB;IACtB,GAAG,CAAe;IAClB,MAAM,CAAS;IACf,MAAM,CAAS;IACxB,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAA4B;IAE5C,YAAY,MAAqB,EAAE,OAAO,GAAmB,EAAE;QAC7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC;QACvD,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,MAAM;gBACd,IAAI,aAAa,CAAC;oBAChB,OAAO,EAAE,MAAM,CAAC,GAAG;oBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,SAAS;iBAC1B,CAAC,CAAC;IACP,CAAC;IAED,IAAY,YAAY;QACtB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,EAAqC;QAChD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAClF,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1F,CAAC;IAED,iEAAiE;IACzD,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QAChC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;wBACjB,SAAS,EAAE,eAAe;wBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,IAAI;4BAC5C,YAAY,EAAE,WAAW,CAAC,YAAY;yBACvC,CAAC;wBACF,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY;qBACnC,CAAC,CAAC;oBACH,IAAI,CAAC,YAAY,EAAE,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAChB,WAAW,CAAC,SAAS,KAAK,oBAAoB;gBAC5C,CAAC,CAAC;oBACE,SAAS,EAAE,oBAAoB;oBAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;iBACvC;gBACH,CAAC,CAAC;oBACE,SAAS,EAAE,UAAU;oBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,IAAI;wBAC5C,YAAY,EAAE,WAAW,CAAC,YAAY;qBACvC,CAAC;oBACF,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;iBAC/B,CACN,CAAC;YACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IAC7F,CAAC;CACF"}

package/dist/logging.js

@@ -0,0 +1,49 @@
+export const LOG_LEVELS = ["debug", "info", "warn", "error"];
+const SENSITIVE_KEY = /secret|password|token|authorization|credential/i;
+const MASK = "***";
+function maskSecrets(text, secrets) {
+    let result = text;
+    for (const secret of secrets) {
+        if (secret.length > 0)
+            result = result.split(secret).join(MASK);
+    }
+    return result;
+}
+function serializeFields(fields) {
+    if (!fields)
+        return "";
+    const safe = {};
+    for (const [key, value] of Object.entries(fields)) {
+        safe[key] = SENSITIVE_KEY.test(key) ? "[REDACTED]" : value;
+    }
+    try {
+        return ` ${JSON.stringify(safe)}`;
+    }
+    catch {
+        return " [unserializable fields]";
+    }
+}
+export function createLogger(options) {
+    const threshold = LOG_LEVELS.indexOf(options.level);
+    const secrets = options.secrets ?? [];
+    const write = options.write ?? ((line) => process.stderr.write(`${line}\n`));
+    const emit = (level, message, fields) => {
+        if (LOG_LEVELS.indexOf(level) < threshold)
+            return;
+        const line = `${new Date().toISOString()} ${level.toUpperCase()} ${message}${serializeFields(fields)}`;
+        write(maskSecrets(line, secrets));
+    };
+    return {
+        debug: (message, fields) => emit("debug", message, fields),
+        info: (message, fields) => emit("info", message, fields),
+        warn: (message, fields) => emit("warn", message, fields),
+        error: (message, fields) => emit("error", message, fields),
+    };
+}
+export const silentLogger = {
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};
+//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAkBtE,MAAM,aAAa,GAAG,iDAAiD,CAAC;AACxE,MAAM,IAAI,GAAG,KAAK,CAAC;AAEnB,SAAS,WAAW,CAAC,IAAY,EAAE,OAA0B;IAC3D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,0BAA0B,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,MAAgC,EAAE,EAAE;QAClF,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS;YAAE,OAAO;QAClD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACvG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC1D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;QACxD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;QACxD,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAW;IAClC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAChB,CAAC"}

package/dist/prompts/audit-realm-security.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { DATA_NOTICE, guardRealm, missingToolHint, promptResult, q, realmArg } from "./shared.js";
+export function registerAuditRealmSecurity(server, ctx) {
+    server.registerPrompt("audit_realm_security", {
+        title: "Audit realm security",
+        description: "Read-only security review of a realm (policies, admin roles, clients, events) that produces a prioritized list of findings.",
+        argsSchema: z.object({ realm: realmArg(ctx) }),
+    }, ({ realm }) => {
+        guardRealm(ctx, realm, false);
+        const text = `Perform a read-only security audit of the Keycloak realm ${q(realm)}. Do not change anything.
+
+${DATA_NOTICE}
+${missingToolHint("any tool named below", "core, roles, clients, events")} Report which checks you could not perform because of this.
+
+Always pass realm ${q(realm)} explicitly. Collect evidence with:
+
+1. realm_get: sslRequired (should be 'all' or at least 'external'), bruteForceProtected, passwordPolicy (length, complexity, history), registrationAllowed, verifyEmail, token and session lifespans (long access-token or SSO lifespans), eventsEnabled and adminEventsEnabled.
+2. role_list and user_roles_list: who holds administrative or realm-management roles; flag many or unexpected admins and disabled-but-privileged accounts.
+3. client_list (page through all results): public clients, clients with directAccessGrantsEnabled, bearer-only or service-account clients with broad access, suspicious redirect or wildcard configuration (use client_get for details of risky ones). Never request or reveal client secrets.
+4. event_list and admin_event_list: recent LOGIN_ERROR spikes and unusual admin changes (if events are disabled, that itself is a finding).
+
+Present the result as a prioritized findings list: for each finding give severity (critical, high, medium, low, info), evidence (tool and values), risk, and a concrete recommendation. End with a short summary of what is in good shape. Suggest fixes but do not apply them.`;
+        return promptResult(`Security audit of realm ${realm}`, text);
+    });
+}
+//# sourceMappingURL=audit-realm-security.js.map

package/dist/prompts/audit-realm-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-realm-security.js","sourceRoot":"","sources":["../../src/prompts/audit-realm-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAElG,MAAM,UAAU,0BAA0B,CAAC,MAAiB,EAAE,GAAgB;IAC5E,MAAM,CAAC,cAAc,CACnB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,6HAA6H;QAC/H,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;KAC/C,EACD,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACZ,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,4DAA4D,CAAC,CAAC,KAAK,CAAC;;EAErF,WAAW;EACX,eAAe,CAAC,sBAAsB,EAAE,8BAA8B,CAAC;;oBAErD,CAAC,CAAC,KAAK,CAAC;;;;;;;gRAOoP,CAAC;QAC3Q,OAAO,YAAY,CAAC,2BAA2B,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/prompts/index.js

@@ -0,0 +1,12 @@
+import { registerAuditRealmSecurity } from "./audit-realm-security.js";
+import { registerInvestigateFailedLogins } from "./investigate-failed-logins.js";
+import { registerOffboardEmployee } from "./offboard-employee.js";
+import { registerOnboardEmployee } from "./onboard-employee.js";
+/** Registers MCP prompts (guided multi-step workflows built on the existing tools). */
+export function registerPrompts(server, ctx) {
+    registerOnboardEmployee(server, ctx);
+    registerOffboardEmployee(server, ctx);
+    registerAuditRealmSecurity(server, ctx);
+    registerInvestigateFailedLogins(server, ctx);
+}
+//# sourceMappingURL=index.js.map

package/dist/prompts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,GAAgB;IACjE,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,+BAA+B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/prompts/investigate-failed-logins.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import { DATA_NOTICE, guardRealm, missingToolHint, promptResult, q, realmArg } from "./shared.js";
+export const DEFAULT_DAYS = 7;
+export function registerInvestigateFailedLogins(server, ctx) {
+    server.registerPrompt("investigate_failed_logins", {
+        title: "Investigate failed logins",
+        description: "Analyze failed login events in a realm (optionally for one user), check lockout status and summarize patterns without changing anything.",
+        argsSchema: z.object({
+            realm: realmArg(ctx),
+            username: z.string().optional().describe("Limit the analysis to this username."),
+            days: z.string().optional().describe(`Look-back window in days (default ${DEFAULT_DAYS}).`),
+        }),
+    }, ({ realm, username, days }) => {
+        guardRealm(ctx, realm, false);
+        const parsed = Number.parseInt(days ?? "", 10);
+        const window = Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, 365) : DEFAULT_DAYS;
+        const text = `Investigate failed logins in the Keycloak realm ${q(realm)} over the last ${window} day(s)${username ? ` for the user ${q(username)}` : ""}.
+
+${DATA_NOTICE}
+${missingToolHint("event_list or user_brute_force_status", "events, security")} Also note that login events must be enabled in the realm (check realm_get eventsEnabled).
+
+Always pass realm ${q(realm)} explicitly. Steps:
+
+1. Compute dateFrom as today minus ${window} day(s) (format yyyy-MM-dd).${username ? ` Resolve the user ID with user_search (exact username ${q(username)}).` : ""}
+2. Call event_list with types ['LOGIN_ERROR'] (also 'CODE_TO_TOKEN_ERROR' and 'CLIENT_LOGIN_ERROR' if relevant), dateFrom${username ? ", and the user filter" : ""}. Page through results.
+3. Summarize patterns: count by error reason, by username, by source IP address and by client; time clustering (bursts, off-hours); many users from one IP (spraying) versus many attempts on one user (brute force).
+4. For the most affected users call user_brute_force_status and report whether they are currently locked out.
+5. Conclude with likely causes (forgotten password, misconfigured client, attack) and recommendations.
+
+This is an investigation only. Do NOT unlock users or change any setting automatically; if unlocking (user_brute_force_unlock) seems appropriate, propose it and wait for explicit confirmation from the human.`;
+        return promptResult(`Failed-login investigation for realm ${realm}`, text);
+    });
+}
+//# sourceMappingURL=investigate-failed-logins.js.map

package/dist/prompts/investigate-failed-logins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"investigate-failed-logins.js","sourceRoot":"","sources":["../../src/prompts/investigate-failed-logins.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAElG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B,MAAM,UAAU,+BAA+B,CAAC,MAAiB,EAAE,GAAgB;IACjF,MAAM,CAAC,cAAc,CACnB,2BAA2B,EAC3B;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,0IAA0I;QAC5I,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,YAAY,IAAI,CAAC;SAC5F,CAAC;KACH,EACD,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QAC5B,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5F,MAAM,IAAI,GAAG,mDAAmD,CAAC,CAAC,KAAK,CAAC,kBAAkB,MAAM,UAAU,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;;EAE5J,WAAW;EACX,eAAe,CAAC,uCAAuC,EAAE,kBAAkB,CAAC;;oBAE1D,CAAC,CAAC,KAAK,CAAC;;qCAES,MAAM,+BAA+B,QAAQ,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;2HACvC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE;;;;;gNAK8C,CAAC;QAC3M,OAAO,YAAY,CAAC,wCAAwC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/prompts/offboard-employee.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { DATA_NOTICE, guardRealm, missingToolHint, promptResult, q, realmArg } from "./shared.js";
+export function registerOffboardEmployee(server, ctx) {
+    server.registerPrompt("offboard_employee", {
+        title: "Offboard employee",
+        description: "Guided workflow to safely deactivate a departing employee: review the account, end sessions and disable it (without deleting).",
+        argsSchema: z.object({
+            realm: realmArg(ctx),
+            username: z.string().min(1).describe("Username of the departing employee."),
+        }),
+    }, ({ realm, username }) => {
+        guardRealm(ctx, realm, true);
+        const text = `You are offboarding the user ${q(username)} in the Keycloak realm ${q(realm)}.
+
+${DATA_NOTICE}
+${missingToolHint("a tool named below", "core, sessions (user_sessions_list, user_logout)")}
+
+Always pass realm ${q(realm)} explicitly. Steps:
+
+1. Find the user with user_search (exact username). If there is no match or more than one, stop and ask the user.
+2. Call user_get with the ID and show the user the identity (username, name, e-mail, enabled state) so they can confirm it is the right person.
+3. Call user_sessions_list to show active sessions and the clients involved.
+4. Ask for explicit confirmation, then end all sessions with user_logout (this is destructive; it needs confirm: true only after the human approved).
+5. Disable the account with user_update and enabled=false. Summarize before doing it.
+6. Verify with user_get that enabled is false and report the result.
+
+Do NOT delete the user (no user_delete) unless the human explicitly asks for deletion in this conversation; disabling preserves audit trails and allows rollback. Do not change group or role memberships unless asked.`;
+        return promptResult(`Offboard ${username} in realm ${realm}`, text);
+    });
+}
+//# sourceMappingURL=offboard-employee.js.map

package/dist/prompts/offboard-employee.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"offboard-employee.js","sourceRoot":"","sources":["../../src/prompts/offboard-employee.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAElG,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,GAAgB;IAC1E,MAAM,CAAC,cAAc,CACnB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,gIAAgI;QAClI,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;SAC5E,CAAC;KACH,EACD,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,gCAAgC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC;;EAE9F,WAAW;EACX,eAAe,CAAC,oBAAoB,EAAE,kDAAkD,CAAC;;oBAEvE,CAAC,CAAC,KAAK,CAAC;;;;;;;;;wNAS4L,CAAC;QACnN,OAAO,YAAY,CAAC,YAAY,QAAQ,aAAa,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC,CACF,CAAC;AACJ,CAAC"}