How Keycloak’s scores are calculated

The full audit trail, recomputed from the verdict data at build time through the same code that produced the leaderboard: verdict × quality × story weight per cell, cells sum to dimension scores, dimensions blend into the PA Score. Every number on the product page is reproducible from this page alone; for why the formula looks like this, see the methodology.

verdict factors: full ×1.0 · partial ×0.6 · disputed ×0.3 · none ×0.0 · n/a excluded from both sides · cell points = weight × quality × factor · cell max = weight × 10

PA Score22/100

Agent-ready 27.1 × 0.30 = 8.13

API quality 8.6 × 0.20 = 1.72

Openness 44.4 × 0.20 = 8.88

Built-in AI 0.0 × 0.15 = 0.00

Automation 22.8 × 0.15 = 3.42

(8.13 + 1.72 + 8.88 + 0.00 + 3.42) ÷ (0.30 + 0.20 + 0.20 + 0.15 + 0.15) = 22.15 ÷ 1.00 = 22.2

Scores are stored to 1 decimal; the product page’s pills round to whole numbers for display. Each dimension below shows the stories, verdicts, and cited evidence behind its number.

Agent-ready27.1/100×0.30 of the PA blend

Outside-in: can YOUR agent reach and drive this product — API, MCP, CLI, headless runs, agent docs.

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

[probe] https://www.keycloak.org/llms.txt“PROBE llms.txt: HTTP 404 at https://www.keycloak.org/llms.txt”
[probe] https://www.keycloak.org/documentation.md“PROBE docs-md: HTTP 404 at https://www.keycloak.org/documentation.md”
[probe] https://www.keycloak.org/openapi.json“PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 4 (quality) × 0.3 (disputed) = 2.4 of 20 max

[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“docker run -p 127.0.0.1:8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:26.7.3 start-dev”
[claimed-docs] https://www.keycloak.org/guides“Run Keycloak from a container image.”
[claimed-docs] https://www.keycloak.org/guides“Manage Keycloak OIDC and SAML clients declaratively using the operator.”
[claimed-docs] https://www.keycloak.org/guides“Install Keycloak using the Operator.”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”
[claimed-docs] https://www.keycloak.org/guides“Import and export realms as JSON files.”
[claimed-docs] https://www.keycloak.org/guides“Check if an instance has finished its start up and is ready to serve requests by calling its health REST endpoints.”
[community] https://news.ycombinator.com/item?id=36384636“My biggest problem with Keycloak is its configuration. It stores its configuration in the database. It means that I can't just configure it in some yaml configmaps. There's no easy supported way to test some changes before production.”
[community] https://news.ycombinator.com/item?id=22871180“I use various home made Ansible roles and I find the Keycloak API to be inconsistent... it's very hard to keep an idempotency with the actual state of the API.”
[community] https://hn.algolia.com/api/v1/items/31258469“In my experience, Keycloak is best treated as a 'pet' in the pet v.s. cattle spectrum. It takes a while to warm up, so you don't want to be constantly restarting it... it doesn't play well with infrastructure-as-code ideas.”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Connect an agent via an official MCP serverweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

[probe] https://www.keycloak.org/llms.txt“PROBE llms.txt: HTTP 404 at https://www.keycloak.org/llms.txt”
[probe] https://www.keycloak.org/documentation.md“PROBE docs-md: HTTP 404 at https://www.keycloak.org/documentation.md”
[probe] https://www.keycloak.org/openapi.json“PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)”

Use an official CLIweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”
[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”

Drive the product through a documented public APIweight 3

3 (weight) × 8 (quality) × 1.0 (full) = 24.0 of 30 max

[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“Keycloak exposes a set of endpoints that applications and services can use to authenticate and authorize their users.”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“It lists endpoints and other configuration options relevant to the OpenID Connect implementation in Keycloak.”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“The dynamic client registration endpoint is used to dynamically register clients.”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“The introspection endpoint is used to retrieve the active state of a token. In other words, you can use it to validate an access or refresh token.”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“The token revocation endpoint is used to revoke tokens. Both refresh tokens and access tokens are supported by this endpoint.”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide, "Managing users and groups through SCIM": built-in SCIM endpoints per realm ("Enabling SCIM for a realm", "Obtaining the SCIM API base URL", "Setting up a service account client"), with protected admin users excluded: "resources can only be managed through the Admin Console or the Admin REST API, never through SCIM."”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“OIDC layers reference, "Client credentials": "Client Credentials are used when clients (applications and services) want to obtain access on behalf of themselves rather than on behalf of a user." Clients authenticate via client_id/client_secret or JWT, backing service accounts for machine-to-machine access.”
[community] https://news.ycombinator.com/item?id=22871180“I use various home made Ansible roles and I find the Keycloak API to be inconsistent... it's very hard to keep an idempotency with the actual state of the API.”

Issue scoped/least-privilege API credentials for an agentweight 2

2 (weight) × 7 (quality) × 0.6 (partial) = 8.4 of 20 max

[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“OIDC layers reference, "Client credentials": "Client Credentials are used when clients (applications and services) want to obtain access on behalf of themselves rather than on behalf of a user." Clients authenticate via client_id/client_secret or JWT, backing service accounts for machine-to-machine access.”
[claimed-docs] https://www.keycloak.org/docs/latest/authorization_services/index.html“Authorization Services guide: fine-grained, resource-level authorization — "A resource is part of the assets of an application and the organization... In authorization policy terminology, a resource is the object being protected", with policies evaluated via UMA permission tickets and client-credentials-obtained PATs.”
[claimed-docs] https://www.keycloak.org“Keycloak provides fine-grained authorization services as well. This allows you to manage permissions for all your services from the Keycloak admin console and gives you the power to define exactly the policies you need.”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“The dynamic client registration endpoint is used to dynamically register clients.”

Build against official SDKsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“Keycloak exposes a set of endpoints that applications and services can use to authenticate and authorize their users.”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”
[probe] https://www.keycloak.org/llms.txt“PROBE llms.txt: HTTP 404 at https://www.keycloak.org/llms.txt”
[probe] https://www.keycloak.org/documentation.md“PROBE docs-md: HTTP 404 at https://www.keycloak.org/documentation.md”
[probe] https://www.keycloak.org/openapi.json“PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)”

Subscribe to events via webhooksweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Agent-ready = 48.8 ÷ 180 × 100 = 27.1

API quality8.6/100×0.20 of the PA blend

The programmable surface once an agent is there — machine-readable spec, interactive docs, sandbox, versioning discipline.

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[probe] https://www.keycloak.org/openapi.json“PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)”
[probe] https://www.keycloak.org/llms.txt“PROBE llms.txt: HTTP 404 at https://www.keycloak.org/llms.txt”
[probe] https://www.keycloak.org/documentation.md“PROBE docs-md: HTTP 404 at https://www.keycloak.org/documentation.md”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“/realms/{realm-name}/.well-known/openid-configuration”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“It lists endpoints and other configuration options relevant to the OpenID Connect implementation in Keycloak.”
[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[probe] https://www.keycloak.org/openapi.json“PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)”

Test against a sandbox environment without touching production dataweight 1

1 (weight) × 4 (quality) × 0.3 (disputed) = 1.2 of 10 max

[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“docker run -p 127.0.0.1:8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:26.7.3 start-dev”
[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“A realm in Keycloak is equivalent to a tenant. Each realm allows an administrator to create isolated groups of applications and users.”
[claimed-docs] https://www.keycloak.org/guides“Import and export realms as JSON files.”
[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“Switch to a production ready database such as PostgreSQL.”
[community] https://news.ycombinator.com/item?id=36384636“My biggest problem with Keycloak is its configuration. It stores its configuration in the database. It means that I can't just configure it in some yaml configmaps. There's no easy supported way to test some changes before production.”

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[claimed-docs] https://www.keycloak.org/securing-apps/oidc-layers“Keycloak exposes a set of endpoints that applications and services can use to authenticate and authorize their users.”
[community] https://news.ycombinator.com/item?id=22871180“I use various home made Ansible roles and I find the Keycloak API to be inconsistent... it's very hard to keep an idempotency with the actual state of the API.”

API quality = 6.0 ÷ 70 × 100 = 8.6

Openness44.4/100×0.20 of the PA blend

Can you leave, inspect, or self-host — data export, open source, portability.

Do everything through the API that I can do in the UIweight 2

2 (weight) × 7 (quality) × 0.6 (partial) = 8.4 of 20 max

[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”
[community] https://news.ycombinator.com/item?id=22871180“I use various home made Ansible roles and I find the Keycloak API to be inconsistent... it's very hard to keep an idempotency with the actual state of the API.”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide, "Managing users and groups through SCIM": built-in SCIM endpoints per realm ("Enabling SCIM for a realm", "Obtaining the SCIM API base URL", "Setting up a service account client"), with protected admin users excluded: "resources can only be managed through the Admin Console or the Admin REST API, never through SCIM."”
[probe] https://www.keycloak.org/openapi.json“PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)”

Export all of my data in open formats and leaveweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

[claimed-docs] https://www.keycloak.org/guides“Import and export realms as JSON files.”
[claimed-docs] https://www.keycloak.org“Through the admin console administrators can centrally manage all aspects of the Keycloak server.”
[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”

Read the product's source under an open licenseweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Self-host the core productweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“docker run -p 127.0.0.1:8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:26.7.3 start-dev”
[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“This command starts Keycloak exposed on the local port 8080 and creates an initial admin user with the username `admin` and password `admin`.”
[claimed-docs] https://www.keycloak.org/guides“Run Keycloak from a container image.”
[claimed-docs] https://www.keycloak.org/guides“Install Keycloak using the Operator.”
[claimed-docs] https://www.keycloak.org/getting-started/getting-started-docker“Switch to a production ready database such as PostgreSQL.”
[claimed-docs] https://www.keycloak.org/guides“Configure Keycloak with a reverse proxy, API gateway, or load balancer.”
[community] https://hn.algolia.com/api/v1/items/31258469“We have been using it for 6-7 years now. Have been able to run very stable and integrated a lot of external IdP's to offer proper SSO on multiple of our software stacks.”
[community] https://news.ycombinator.com/item?id=22871180“We've been using Keycloak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective.”
[community] https://news.ycombinator.com/item?id=22871180“I've run keycloak securing internet facing apps with ~1000 users for years. It's so stable, I usually forget it's even there.”
[community] https://news.ycombinator.com/item?id=22871180“After Okta rudely told us, a paying customer, to pay extra or leave, we decided to survey alternatives. Four years ago, we found Keycloak and never looked back. It's stable, customizable, well engineered.”

Openness = 44.4 ÷ 100 × 100 = 44.4

Built-in AI0.0/100×0.15 of the PA blend

Inside-out: how agentic the product itself is for its users — built-in assistants, autonomous features.

Get AI-generated insights and suggestions from my data inside the productweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Set up automations that run autonomously in the backgroundweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Delegate tasks to a built-in AI assistant inside the productweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Operate the product with natural-language commandsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Built-in AI = 0.0 ÷ 30 × 100 = 0.0

Automation22.8/100×0.15 of the PA blend

Depth of automation primitives — rules, scheduling, bulk operations, webhooks.

Perform bulk operations across many items at onceweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide documents the Admin CLI: Keycloak "packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.”
[claimed-docs] https://www.keycloak.org/documentation“Documentation for the Adminstration RESTful API”
[claimed-docs] https://www.keycloak.org/guides“Import and export realms as JSON files.”
[community] https://news.ycombinator.com/item?id=22871180“I use various home made Ansible roles and I find the Keycloak API to be inconsistent... it's very hard to keep an idempotency with the actual state of the API.”

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 3 (quality) × 0.6 (partial) = 5.4 of 30 max

[claimed-docs] https://www.keycloak.org/docs/latest/server_admin/index.html“Server Administration Guide, brute force protection events: "User disabled by permanent lockout — Brute force protection disabled the user account permanently due to too many login failures. User disabled by temporary lockout — Brute force protection disabled the user account temporarily due to too many login failures."”
[claimed-docs] https://www.keycloak.org“Extensible - Customize through code”

Schedule recurring jobs or workflowsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Automation = 11.4 ÷ 50 × 100 = 22.8