Debug a Kafka stream with the Kafka Console plugin

At a glance

Learning objectives

• Inventory topics with /topic-info before touching lag
• Triage per-partition lag and rebalance detection with /lag-triage
• Sample messages through the PII redaction pass

What you need

• A consumer group showing lag
• Kafka SASL read credentials
• [object Object]

Steps

1. Run /topic-info for topic inventory. (from plugin-kafka-console )
2. Run /lag-triage for per-partition lag triage and rebalance detection. (from plugin-kafka-console )
3. Run /sample-topic for the read-only message sampler. (from plugin-kafka-console )
4. Know what the plugin covers — topic inventory, per-partition lag triage, rebalance detection, and a read-only message sampler with a PII redaction pass. (from plugin-kafka-console )
5. Expect the PII redaction pass on every sample — the plugin ships with hook-pii-leak-guard wired in. (from plugin-kafka-console )
6. Stay inside the permission model — filesystem none, network kafka, credentials kafka-sasl-read. (from plugin-kafka-console )

Check yourself

• /lag-triage output distinguishes a skewed partition from uniformly distributed lag before any scaling decision is made.
• /sample-topic output contains no unredacted personal data because the PII leak guard hook runs on the sampling path.

Worked example

amp plugin add de-agent/kafka-console

/lag-triage
/topic-info
/sample-topic

permissions: { filesystem: none, network: kafka, credentials: kafka-sasl-read }
hooks: [hook-pii-leak-guard]
skills: [skill-kafka-lag-triage, skill-kafka-topic-design]

Sourced from

• Kafka Console
• Kafka Consumer Lag Triage

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

• Credentials are kafka-sasl-read only — the plugin cannot and should not mutate the cluster.
• The PII redaction pass (hook-pii-leak-guard) exists because sampling is how personal data leaks into agent contexts.
• Lag triage builds on skill-kafka-lag-triage — the command is only as good as the signature model behind it.

Production considerations

• Keep the plugin on read-only SASL credentials even in debug clusters.
• Pin the plugin's hook-pii-leak-guard so sampling paths can never bypass redaction.

Diagram

kafka console plugin
   |
   |- /topic-info --> topic inventory
   |
   |- /lag-triage --> per-partition lag + rebalance detection
   |
   |- /sample-topic --> read-only sample --> PII redaction pass
   |
   --> permissions: network kafka, sasl read-only

Registry stats