Back to Browse

Kafka MCP Server

Data & AnalyticsModerate5.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Apache Kafka monitoring & management for AI agents (with consumer lag) — governed.

About

Apache Kafka monitoring & management for AI agents (with consumer lag) — governed.

Security Report

5.2
Moderate5.2Moderate Risk

This is a well-engineered MCP server for Apache Kafka with a thoughtful security model. The codebase demonstrates strong access control design with layered capabilities (read-only → read-write → admin), topic allowlisting, protected topic enforcement, and destructive operation gating. Code quality is high with proper input validation via Zod, comprehensive audit logging, and no evidence of credential leakage or malicious patterns. The default configuration prioritizes safety (read-only mode, delete disabled). Minor observations: broad error handling could be more specific, and the audit log doesn't capture all operation outcomes, but these are low-severity quality concerns that do not meaningfully impact security. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Comma-separated broker list (host:port).Optional

Environment variable: KAFKA_BROKERS

Access mode: read-only | read-write | admin.Optional

Environment variable: KAFKA_MODE

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-dockndevai-mcp-kafka": {
      "env": {
        "KAFKA_MODE": "your-kafka-mode-here",
        "KAFKA_BROKERS": "your-kafka-brokers-here"
      },
      "args": [
        "-y",
        "@dockndevai/mcp-kafka"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

mcp-kafka

CI License: MIT npm

A Model Context Protocol server for Apache Kafka. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) monitor and manage Kafka clusters — topics, partitions, configs, and consumer groups (including lag) — with behaviour controlled entirely by flags.

Safe by default: it starts read-only, can be scoped to an allowlist of topics, protects internal/critical topics from mutation, and gates destructive operations behind an explicit opt-in.

Features

  • Monitoring — cluster/broker info, topic metadata and offsets, consumer groups, and per-partition + total consumer lag.
  • Management — create topics, add partitions, alter topic configs, reset group offsets; delete topics/groups (admin).
  • Access modesread-onlyread-writeadmin, layered so a mode never exposes tools above its level.
  • Security flags — topic allowlist, protected/internal topics, delete gating, dry-run, and JSON audit logging (see below).
  • Auth — plaintext, TLS, and SASL (PLAIN / SCRAM-SHA-256 / SCRAM-SHA-512).

Security model

ConcernFlagDefaultEffect
What can the server do?KAFKA_MODEread-onlyread-only exposes only monitoring; read-write adds management; admin adds deletes. Tools above the mode are never registered.
Which topics are in scope?KAFKA_TOPIC_ALLOWLIST(all)When set, operations on other topics are refused.
Protect internal topicsKAFKA_PROTECT_INTERNAL_TOPICStrueTopics starting with _ can be read but never mutated.
Protect specific topicsKAFKA_PROTECTED_TOPICS(none)Additional read-only-forever topics.
Can it delete?KAFKA_ALLOW_DELETEfalsedelete_topic / delete_consumer_group need this and admin mode.
Preview without touching the clusterKAFKA_DRY_RUNfalseWrite/admin tools validate + log intent, then return.
Audit trailKAFKA_AUDIT_LOGtrueEmits a JSON line to stderr per guarded operation.

Tools

Read (read-only+): cluster_info, list_topics, describe_topic, topic_offsets, list_consumer_groups, describe_consumer_group (with lag)

Write (read-write+): create_topic, create_partitions, alter_topic_config, reset_consumer_group_offsets

Admin (admin): delete_topic, delete_consumer_group (both need KAFKA_ALLOW_DELETE)

Quickstart — add to your agent

Published on npm as @dockndevai/mcp-kafka. No clone or build needed — your MCP client runs it on demand with npx. Start in read-only mode; see .env.example for every variable and docs/CLIENTS.md for the full per-client guide.

Claude Code (CLI)

claude mcp add kafka -e KAFKA_BROKERS="localhost:9092" -e KAFKA_MODE="read-only" -- npx -y @dockndevai/mcp-kafka

Claude Desktop · Cursor · Windsurf — same block in claude_desktop_config.json, .cursor/mcp.json, or ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "kafka": {
      "command": "npx",
      "args": [
        "-y",
        "@dockndevai/mcp-kafka"
      ],
      "env": {
        "KAFKA_BROKERS": "localhost:9092",
        "KAFKA_MODE": "read-only"
      }
    }
  }
}

OpenAI Codex CLI — in ~/.codex/config.toml:

[mcp_servers.kafka]
command = "npx"
args = ["-y", "@dockndevai/mcp-kafka"]
env = { KAFKA_BROKERS = "localhost:9092", KAFKA_MODE = "read-only" }

VS Code (GitHub Copilot, Agent mode) — in .vscode/mcp.json:

{
  "servers": {
    "kafka": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@dockndevai/mcp-kafka"
      ],
      "env": {
        "KAFKA_BROKERS": "localhost:9092",
        "KAFKA_MODE": "read-only"
      }
    }
  }
}

Example prompts

  • "Which consumer groups have the most lag right now?"
  • "Describe the orders topic and show its offsets."
  • "Create a topic events with 6 partitions and 7-day retention." (needs read-write)

Run from source (development)

Prefer the published package above. To run from a clone:

npm install
npm run build
node dist/index.js   # with the environment variables set

Develop

npm run dev
npm test
npm run typecheck

Publishing

This server ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md for publishing to npm and listing on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.

License

MIT

Reviews

No reviews yet

Be the first to review this server!

Kafka MCP Server - Apache Kafka monitoring & management for AI agents (with | MCP Marketplace