DE//AGENT
Explore
Tutorial Lesson 2 of 10 · The Streaming Series community beginner

Inspect Kafka topics and groups with the Kafka MCP server

Connect an agent to a Kafka cluster through the Kafka MCP server and work through its four tools: list_topics for inventory, describe_topic for a single topic, describe_consumer_group for lag, and consume_messages for sampling — stream debugging from an agent, with the sampling risks called out up front.

At a glance

When An agent needs read access to topic inventory, lag, and message samples; Stream debugging should happen from the agent's context instead of ad hoc CLI sessions
Where Kafka
Why The server puts topic inventory, consumer-group lag, and message sampling behind four tools, so an agent can debug a stream without cluster write access.

Learning objectives

  • Configure the Kafka MCP server against a broker list
  • Inventory topics and read group lag with the four tools
  • Sample messages without leaking production PII

What you need

  • KAFKA_BROKERS (comma-separated broker list), optionally SASL credentials
  • An agent host with kafka-mcp-server installed
  • A read-only principal scoped to an allow-listed topic

Steps

  1. Point the server at the cluster — KAFKA_BROKERS holds the comma-separated broker list, and KAFKA_SASL_USER / KAFKA_SASL_PASSWORD are set if the cluster requires it. (from mcp-kafka )
  2. Run list_topics for a topic inventory. (from mcp-kafka )
  3. Run describe_topic and describe_consumer_group to inspect one topic and its consumer-group lag. (from mcp-kafka )
  4. Use consume_messages to sample messages when the debugging needs content, not just offsets. (from mcp-kafka )
  5. Before sampling, know the risk — it can expose production PII in the agent's context; grant a read-only principal, prefer a topic allow-list, and never sample topics containing personal data without masking. (from mcp-kafka )

Check yourself

  • describe_consumer_group on the suspect group returns the same per-partition offsets the CLI kafka-consumer-groups describe shows.
  • consume_messages runs only against an allow-listed topic with a read-only principal, and no personal data reaches the agent context unmasked.

Worked example

Register the server with the agent — from mcp-kafka 

mcpServers:
  kafka:
    command: kafka-mcp-server
    args: []
    env:
      KAFKA_BROKERS: localhost:9092
      KAFKA_CLIENT_ID: kafka-mcp-server
      MCP_TRANSPORT: stdio

Server environment variables — from mcp-kafka 

KAFKA_BROKERS       (required) Comma-separated broker list.
KAFKA_CLIENT_ID     (optional) Kafka client id for connections.
KAFKA_SASL_USER     (optional) SASL user, if the cluster requires it.
KAFKA_SASL_PASSWORD (optional) SASL password, if required.

Sampling risk — security requirements — from mcp-kafka 

Sampling messages can expose production PII in the agent's context. Grant a
read-only principal, prefer a topic allow-list, and never sample topics
containing personal data without masking.

Sourced from

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

  • consume_messages can expose production PII in the agent's context — never sample topics containing personal data without masking.
  • Grant a read-only principal and prefer a topic allow-list before handing the server to an agent.
  • The server's licensing is ambiguous — MIT badge in the README but no LICENSE file — verify before commercial use.

Production considerations

  • Give the server its own KAFKA_CLIENT_ID and stdio transport so its connections are identifiable.
  • Keep SASL credentials in the environment, scoped to a read-only principal.

Diagram

kafka mcp exploration
   |
   |- KAFKA_BROKERS + optional SASL --> server connects (stdio)
   |
   |- list_topics --> topic inventory
   |
   |- describe_topic + describe_consumer_group --> topic detail + lag
   |
    |- consume_messages --> samples (read-only principal, allow-list, mask PII)

Registry stats

Verification community · Oct 21, 2026
Completeness 81
Trust multiplier ×1.25
Composite 34.15 · adequate
Freshness 3 days since last source check
Difficulty beginner
Version 0.1.0
License CC-BY-4.0
Security flags none