Back to Browse
Free
Server data from the Official MCP Registry
Read-only Kafka observability MCP server: cluster health, consumer lag, and replay-readiness.
About
Read-only Kafka observability MCP server: cluster health, consumer lag, and replay-readiness.
Security Report
5.2
Moderate5.2Moderate Riskkafka-sentinel-mcp is a well-designed read-only Kafka observability MCP server with strong security-first architecture. The codebase enforces immutability by design (no admin/producer APIs imported), handles credentials safely via environment variables with no logging of secrets, and implements proper audit logging. Minor code quality observations exist but do not impact security posture. Permissions align appropriately with the server's stated read-only observability purpose. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.
6 files analyzed · 10 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Kafka bootstrap servers, e.g. broker1:9092,broker2:9092
Environment variable: KAFKA_BOOTSTRAP
librdkafka security.protocol, e.g. SASL_SSL
Environment variable: KAFKA_SECURITY_PROTOCOL
librdkafka sasl.mechanism, e.g. PLAIN or SCRAM-SHA-512
Environment variable: KAFKA_SASL_MECHANISM
SASL username
Environment variable: KAFKA_SASL_USERNAME
SASL passwordRequired
Environment variable: KAFKA_SASL_PASSWORD
Path to CA certificate for SSL
Environment variable: KAFKA_SSL_CA_LOCATION
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-sanjay-amu-kafka-sentinel-mcp": {
"env": {
"KAFKA_BOOTSTRAP": "your-kafka-bootstrap-here",
"KAFKA_SASL_PASSWORD": "your-kafka-sasl-password-here",
"KAFKA_SASL_USERNAME": "your-kafka-sasl-username-here",
"KAFKA_SASL_MECHANISM": "your-kafka-sasl-mechanism-here",
"KAFKA_SSL_CA_LOCATION": "your-kafka-ssl-ca-location-here",
"KAFKA_SECURITY_PROTOCOL": "your-kafka-security-protocol-here"
},
"args": [
"kafka-sentinel-mcp"
],
"command": "uvx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
kafka-sentinel-mcp
Give AI agents safe, read-only eyes on your Kafka clusters.
An MCP (Model Context Protocol) server that exposes Kafka cluster health, consumer lag, partition state, and replay-readiness as structured tools — so LLM agents (Claude, or any MCP client) can diagnose streaming incidents without ever being able to break anything.
Built by an engineer who spent a decade running Kafka-based financial messaging at 99.999% availability, and got tired of every "AI + Kafka" demo assuming write access to production.
Why this exists
When a consumer group stalls at 3 a.m., the questions are always the same: Is it lag? A stuck partition? A rebalance storm? An offset reset gone wrong? These are pattern-matching questions — exactly what LLM agents are good at — but no operator will hand an agent admin rights on a production cluster.
kafka-sentinel-mcp draws a hard line: every tool is read-only by design, enforced at the client-config level (no admin operations are even imported). The agent can observe, correlate, and recommend; a human executes.
Tools
| Tool | What it returns |
|---|---|
cluster_health | Broker count, controller status, under-replicated / offline partition counts |
consumer_lag | Per-group, per-topic, per-partition lag with committed vs end offsets |
topic_audit | Replication factor, min.insync.replicas, retention, and flags configs that violate durability best practice |
partition_state | Leaders, ISR shrinkage, skew across brokers |
replay_readiness | For a group + topic: earliest available offsets vs committed, i.e., "can we still replay what we missed?" |
incident_snapshot | One-call bundle of all the above, timestamped — designed for pasting into a postmortem |
Quick start
pip install kafka-sentinel-mcp # (or: uv tool install)
# Run against your cluster (read-only credentials!)
KAFKA_BOOTSTRAP=localhost:9092 kafka-sentinel-mcp
Add to Claude Desktop / any MCP client:
{
"mcpServers": {
"kafka-sentinel": {
"command": "kafka-sentinel-mcp",
"env": { "KAFKA_BOOTSTRAP": "broker1:9092,broker2:9092" }
}
}
}
Then ask your agent: "Why is the payments-consumer group falling behind, and can we still replay from where it stalled?"
Security posture
- Read-only: no produce, no topic/config mutation, no offset commits, no ACL ops.
- Supports SASL/SSL; credentials via env only, never logged.
- Every tool call is logged with caller context for audit.
- Recommended: run with a Kafka principal that has
Describe/ReadACLs only — the server degrades gracefully and reports what it can't see.
Status
Early. See ROADMAP.md. Issues and PRs welcome — especially war stories about what you wish an agent could have told you during an incident.
License
MIT
Reviews
No reviews yet
Be the first to review this server!
More Security MCP Servers
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
137
Stars
553
Installs
8.0
Security
4.8
Local
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
-
Stars
84
Installs
10.0
Security
4.6
Local
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
156.1K
Stars
58
Installs
4.2
Security
5.0
Local