Wanaku client usage in local deployment

[anand-ravipati]

Env:

• Macbook M1
• Docker Desktop for Mac 4.92.0 (240144)
• Wanaku CLI version 0.2.0
• Wanaku 0.3.0

I followed the instructions in the README.md and am using Quick Start (Docker Compose).

I added Postgres to docker-compose-auth.yml.

All the services start up fine using docker compose up -d.

Created a test user in wanaku realm using KeyCloak UI. (Instruction missing in the doc)

I am able to login to http://localhost:4181/admin with my test user.

Next, I went to CLI Usage section.

Here I couldn't get a token because of this error:

2026-09-22 06:38:17,352 WARN  [org.keycloak.events] (executor-thread-24) type="LOGIN_ERROR", realmId="bd06421e-905a-4998-b620-21d16e53c3bd", realmName="wanaku", clientId="wanaku-mcp-router", userId="null", ipAddress="192.168.65.1", error="not_allowed", reason="Client not allowed for direct access grants", auth_method="oauth_credentials", grant_type="password", client_auth_method="client-secret"

So I enabled Direct access grants for wanaku-mcp-router client using KeyCloak UI. (Instruction missing in the doc)

After this I got a token using.

TOKEN=$(curl -s -X POST http://localhost:8543/realms/wanaku/protocol/openid-connect/token \
  -d grant_type=password \
  -d client_id=wanaku-mcp-router \
  -d client_secret=<your-secret> \
  -d username=wanaku \
  -d password=wanaku | jq -r .access_token)

However the following command fails.

wanaku tools list --host http://localhost:4181 --token $TOKEN
Error (status: 401, reason: Unauthorized)
Details: {}

I enabled client authentication, direct access grants and added an audience mapper to mcp-client.

(Notice that I switched to mcp-client instead of wanaku-mcp-router as the former feels more appropriate.)

Without the audience mapper we get the following error in the oauth proxy logs:

oauth2-proxy-mgmt-1  | [2026/09/22 07:30:56] [jwt_session.go:54] Error retrieving session from token in Authorization header: [unable to verify bearer token, could not create session from token: audience from claim aud with value [account] does not match with any of allowed audiences map[mcp-client:{} wanaku-mcp-client:{} wanaku-mcp-router:{}]]
oauth2-proxy-mgmt-1  | [2026/09/22 07:30:56] [oauthproxy.go:1024] No valid authentication in request. Access Denied.
oauth2-proxy-mgmt-1  | 192.168.65.1:25138 - 6ae407d2-3627-4298-a384-48dd39f20de0 - - [2026/09/22 07:30:56] localhost:4181 GET - "/api/v1/tools" HTTP/1.1 "Quarkus REST Client" 401 2 0.002

The commands in the README work after this.

TOKEN=$(curl -s -X POST http://localhost:8543/realms/wanaku/protocol/openid-connect/token \
  -d grant_type=password \
  -d client_id=mcp-client \
  -d client_secret=mypassword \
  -d username=wanaku \
  -d password=wanaku | jq -r .access_token)

wanaku tools list --host http://localhost:4181 --token $TOKEN

curl -H "Authorization: Bearer $TOKEN" http://localhost:4180/default/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
{"jsonrpc":"2.0","id":1,"result":{"tools":[]}}

Thanks.
Anand

[orpiske]

Hey @claudio4j, can you take a look at this one, please?

[orpiske]

Maybe this one: #2023

[orpiske]

🤖 Note: This is an AI-generated analysis and needs human verification.

Thanks for the detailed report. This looks like an authentication bootstrap and documentation mismatch, rather than a Wanaku CLI or management API defect.

The documented CLI flow uses the Keycloak password grant with wanaku-mcp-router, but the bundled realm disables Direct Access Grants for that client. After it is enabled manually, Keycloak issues a token with aud: ["account"], while oauth2-proxy accepts wanaku-mcp-router, mcp-client, or wanaku-mcp-client. That explains the 401 before the request reaches Wanaku.

Your workaround repairs both gaps: enabling Direct Access Grants and adding an accepted audience for mcp-client. We should make the local/demo realm and CLI documentation self-consistent, or replace the password-grant example with the intended authorization-code/PKCE or device flow. Also, an empty tools list is expected until an MCP tool forward is registered; adding PostgreSQL alone does not register a tool.

I am currently on PTO, so I cannot verify and prepare a fix quickly. Thank you for your consideration and patience while we follow up.

[orpiske]

Today I took a look at the code and the guides and I found several additional problems on this (some of the issues have been logged as part of this). I already fixed a few minor issues and have a draft in progress, but full resolution is likely only by the end of the next week.

[claudio4j]

When using the wanaku tools list --host http://localhost:4181 --token $TOKEN this host is the wanaku management one, not the mcp router, so I think you should use the 4180 port for oauth2-proxy to route traffic to wanaku mcp endpoint.
However it is still failing to me, WIP.

[claudio4j]

#147 is going to fix
wanaku-barn contains two cli (wanaku-cli and wanaku-keycloak-admin)

aliases

alias wanakuk='java -jar apps/wanaku-keycloak-admin/target/quarkus-app/quarkus-run.jar'
alias wanaku='java -jar apps/wanaku-cli/target/quarkus-app/quarkus-run.jar'

the cli workflow is

# generate a new secret for wanaku-mcp-router if empty
wanakuk credentials regenerate --show-secret --keycloak-url http://localhost:8543 --admin-username=admin --admin-password=admin --client-id=wanaku-mcp-router

# get the wanaku-mcp-router client secret and set in a env var
export MCPSECRET=`wanakuk credentials show --show-secret --keycloak-url http://localhost:8543 --admin-username=admin --admin-password=admin --client-id=wanaku-mcp-router --plain|grep Secret|awk '{print $3}'|sed 's/\r//g'`;

# cli login using the wanaku-mcp-router client
wanaku auth login --auth-server=http://localhost:8543  --username=utest1 --password=admin --realm=wanaku --verbose --plain --client-id=wanaku-mcp-router --client-secret=$MCPSECRET

# tools list with no token / note the 4180 port is the mcp endpoint in oauth2-proxy
wanaku tools list --host http://localhost:4180

If you want to use curl and not wanaku login, note I use wanaku-mcp-router and the 4180 port to route to the mcp router (not the management endpoint at 4181)

export TOKEN=$(curl -s -X POST http://localhost:8543/realms/wanaku/protocol/openid-connect/token \
  -d grant_type=password \
  -d client_id=wanaku-mcp-router \
  -d client_secret=$MCPSECRET \
  -d username=utest1 \
  -d password=admin| jq -r .access_token);
wanaku tools list --host http://localhost:4180 --token $TOKEN

[claudio4j]

@anand-ravipati can you try with this approach ? You have to build wanaku-cli and wanaku-keycloak-admin from source since there were a couple of fixes recently. Thanks for reporting the issue.

[claudio4j]

I 'm will review the docs and provide additional fixes for both wanaku and wanaku-barn

[orpiske]

@claudio4j I got it working with these 2 PRs:

• On Wanaku, mainly adjust the docs to use the CLI clients, with some minor changes (still pending review) on the router: Fix authenticated Compose setup #2028
• On the Wanaku Barn, applies multiple fixes to the CLI clients: Fix authenticated CLI workflows wanaku-barn#146

If you have a chance, please try both ...