blog: launch post for keycloak-skills and the Phase Two MCP server

[xgp]

Launch post for p2-inc/keycloak-skills and the Phase Two Keycloak MCP server.

blog/2026-08-28-keycloak-skills-mcp-launch.md — ~1,750 words. Covers: why a general model gets Keycloak wrong (concrete silent-failure list), install from the Claude plugin marketplace, that the skills work against any Keycloak while the MCP server is the Phase Two multiplier, the 158-tool surface by domain, that our own support desk runs on it across the fleet, the guardrails (deletion refusal, read-back verification, caller-scoped auth), the skillsbench verification story, the full list of covered use cases, and a call to file issues for gaps.

Facts came from the source rather than the READMEs — the phasetwo-mcp README feature table is out of date and undercounts the tool surface badly (it lists only identity/orgs/clusters, omitting auth flows, IdPs, clients, users, realm settings and webhooks). Worth fixing separately.

Before merging

Four image placeholders are marked TODO(image) in the post, each with its <figure> markup written and commented out so the build stays clean. static/blog/keycloak_skills_mcp/README.md is the checklist — delete it once the images are in.

• session-hero.png — a session mid-task (the one that sells the post)
• plugin-install.png — the /plugin browser, or claude plugin details phasetwo
• deletion-refused.png — the skill declining a realm deletion
• benchmark-run.png — optional, skillsbench verifier output

Also confirm the publish date, and that the agent-skills / claude / ai tags are wanted in the tag list.

[cloudflare-workers-and-pages]

Deploying phasetwo-docs with    Cloudflare Pages

Latest commit:	132c4cd
Status:	🚫  Build failed.

View logs

[xgp]

Pushed 20f2ffd:

• Benchmark link fixed. github.com/anthropics/skillsbench 404s (it is not a public repo), so the link now points at the benchmarks/ directory in keycloak-skills itself. Removed the two other "skillsbench" mentions in the image placeholder.
• Added the adoption ladder. The "Any Keycloak" section is now three rungs: (1) any Keycloak — the stock-only intents, (2) quay.io/phasetwo/phasetwo-keycloak, which unlocks magic link, email OTP, organizations and domain-routed SSO, (3) hosted, which adds the MCP server and cluster tooling. Rung 2 also makes the argument for why the skills matter most there — the ext-* authenticator orderings are load-bearing and undocumented anywhere outside our own heads. Note added under the use-case list marking which rows need the extensions, and the distribution is now in the closing CTA.

All seven new links verified 200. Confirmed ext-auth-home-idp-discovery does ship in keycloak-orgs (HomeIdpDiscoveryAuthenticatorFactory) before naming it.

---

Blocker for publishing, not for merging: p2-inc/keycloak-skills and p2-inc/phasetwo-mcp are both still private. Every install instruction in the post (claude plugin marketplace add p2-inc/keycloak-skills) fails until the skills repo is public, and the four repo links in the post 404. Needs to go public before this goes live.

[xgp]

Pushed f834899:

• skillsbench link corrected to benchflow-ai/skillsbench (verified 200), kept alongside the pointer to our own benchmarks/ directory.

• New subsection: "No Keycloak at all? Ask the agent for one." Walks the real provisioning path from cluster-setup-mcp.md — identity, owning org, regions, name check, createCluster on the Starter tier, the Stripe checkout link handed to a human, poll to ACTIVE, then first deployment and custom domain. Closes on the thing that actually sells it: same session, same agent, "now add passwordless login by magic link" against the cluster it just built. Backed by a :::info callout, an above-the-fold teaser in the intro (so it shows on the blog index), and a rewritten closing CTA.

  Worth noting I leaned into the payment guardrail as a feature rather than a caveat — the skill's explicit rule is that it never enters payment details and always hands off the checkout link. That reads as trustworthy for anyone nervous about pointing an agent at a billing API.

• Fifth image placeholder added for the provisioning flow (cluster-provisioning.png) — the strongest visual for this section. Checklist in static/blog/keycloak_skills_mcp/README.md updated.

Two fixes found along the way: the Starter post's slug is starter-tier-launch, not starter-tier (the obvious guess 404s), and I normalized my post to the repo's US spelling (behaviour/favourite/recognise/judgement).

Prose is ~2,300 words. All links verified 200 except the four p2-inc/keycloak-skills ones, which resolve once the repo goes public before publish, as you confirmed. Dropping the visibility blocker from my earlier comment.

[pnzrr]

What about the demo video? Should we put that on the YT channel and then embed here?

[xgp]

Pushed 099962e — new "Watch it work" section between Install it and the adoption rungs, so the demo lands right after the reader knows how to get the plugin.

Two-sentence intro plus the YouTube <iframe> in the same shape the other posts use (2024-04-10-keycloak-orgs-presentation.md), and a short bullet list of the arc so the section is scannable without watching.

Needs the video id — the src is https://www.youtube.com/embed/VIDEO_ID, flagged with a TODO(video) comment right above it.

One accuracy note on the bullets. In the recording Rasvan narrates the plugin install and the existing cluster/realm as prerequisites he did ahead of time ("this can also be done through the plugin, but for the sake of speed I did it like this"), so I wrote them as prerequisites rather than as steps shown on screen. The TODO(video) comment says to promote them into the shown-steps list if the final cut actually includes them.

Also retargeted the hero image placeholder: a still frame from this video would serve, and it is cheaper than staging a separate capture — worth knowing since that image is also the blog index thumbnail and the social card. Checklist README updated with that and with the video id.

[xgp]

What about the demo video? Should we put that on the YT channel and then embed here?

Added. We need to upload it to Youtube and update the embed link.

[xgp]

@rtufisi will you make and add the recommended screenshots?

[rtufisi]

Done