Two things on one base. We set up and run Keycloak with you: SSO, upgrades, migrations, extensions and hardening. On top of it we build identity for AI agents and MCP servers, so each agent has its own identity, permissions per tool and a record of what it did.
Let’s talk about your productFor founders and teams running Keycloak or about to, whether for their applications, their AI agents or both.
Keycloak is quick to start and hard to change later. More applications, more roles and an upgrade that changes behavior you relied on, while settings get copied between environments by hand. Agents make it harder. The quick way to connect one is a service account or a user’s own token: it can then do everything that person can, in every tool, and the logs show the user, not the agent. Agent identity is a non-human identity problem, and it only holds if the Keycloak underneath is sound.
We go through your realms, clients, roles and flows with you, and the agents, MCP servers and tools you run or plan. We write down what’s risky, what’s inconsistent and what will get in the way of the next upgrade.
We connect your applications through SSO, write custom extensions (SPIs) where the built-in features don’t reach, harden the configuration and keep it in code so every environment matches. Upgrades and migrations get their own plan, so sign-in keeps working.
Each agent gets its own client with scopes per tool. With token exchange it acts on behalf of a user and gets only the part of their rights the task needs. Your MCP servers check those tokens through OAuth, so MCP authentication works like it does for any other API.
Risky agent actions wait until a person approves them, and every call records which agent acted, for which user and with which scope. We train you, or the engineers you work with, to run all of it, and stay available on a retainer if you want.
Tell us how you use Keycloak today, which agents you run or plan, and what’s getting in the way. Together we agree the work, who is responsible for what, and the outcome, whether that’s advice on a single question, a scoped project or ongoing Keycloak support on a retainer.
Let’s talk about your product
Work with a team at Zurich University of Applied Sciences.
“Our work with Zone2 has covered APIs, web applications and identity management within our existing systems. They work independently, take ownership of the technical details and involve us when decisions need our input. They also provide practical training that helps our team build its own skills.”
Yes. With Keycloak token exchange the agent trades the user’s token for a new one limited to the scopes the task needs. The agent never holds the user’s full rights, and the token shows both who the user is and which agent acted.
Yes, that’s half the work. Setup, SSO, custom extensions, hardening, upgrades and migrations from another identity system, plus ongoing Keycloak support as a monthly retainer and practical training on your own setup.
For the agent work, it works best if you already run Keycloak or are open to it, because that’s what we build on. If you’re committed to another identity provider, we’re likely not the right fit.
No. Keycloak runs in your infrastructure or with the hosting provider you choose. We help you set it up, change it and keep it up to date, and we have no hosting plan to sell you.
Tell us which agents you’re building and how sign-in works today. That’s enough for a first conversation.
A message commits you to nothing. By sending it you confirm you’ve read the privacy policy.