kantrip

Kantrip: switch kafka profiles like magic

Kantrip securely manages Kafka profiles for kcat, the Apache Kafka and Confluent CLIs, Kaskade, kaf, kcl, and applications you run with kantrip exec, over plaintext, verified TLS, SASL/PLAIN, SCRAM, mTLS, or OAuth where the client supports it. Save a profile once, keep its secrets in Kantrip's own vault in your operating system's credential store, and run your usual clients inside a scoped, supervised session.

pipx install kantrip

latest release on GitHub

Pre-release for macOS and Linux: commands, output, and stored profiles may change before v0.1.0. See Releases.

A session, start to finish

Add a SCRAM profile over verified TLS, check it, create a topic with the Kafka CLIs, and list it from an interactive session. The password prompt shows nothing, and the secret never reaches the profile, the command line, or the output. Inside the session, your own prompt can show the active profile.

❯ kantrip add prod -b kafka.example.com:9093 --ca-file ./ca.pem --auth scram-sha-512 --username app
Kafka password: 
Added profile 'prod': kafka.example.com:9093, tls, scram-sha-512
❯ kantrip ping prod
✅ Kafka transport: verified TLS; authentication: scram-sha-512 authenticated
❯ kantrip exec prod -- kafka-topics --create --topic payments --partitions 1 --replication-factor 1
Created topic payments.
❯ kantrip exec prod
 prod ❯ kafka-topics --list
orders
payments
 prod ❯ exit
❯

Why Kantrip

Supported clients

kcat and kafkacat
Metadata, produce, and consume, including Confluent-compatible Avro.
Apache Kafka and Confluent Platform CLIs
Topics, console producer and consumer, consumer groups, configs, ACLs, and broker API versions, with or without the .sh suffix.
Confluent schema console clients
Avro, JSON Schema, and Protobuf producers and consumers.
Kaskade
admin and consumer, with Confluent and native Apicurio decoding.
kaf
Topics, consumer groups, produce, and consume, with a private one-cluster configuration and Confluent-compatible Avro. No Kafka OAuth.
kcl
Topics, groups, cluster administration, produce, and consume, plus Confluent-compatible Registry administration, decoding, and encoding. No Kafka OAuth.

Kafka connections use plaintext, verified TLS, SASL/PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, mTLS, or OAuth, and authentication always requires verified TLS; registries use Confluent Schema Registry or Apicurio. Interactive sessions support Bash, Zsh, and Fish. The compatibility guide lists versions and limits.

Credential handling and its limits

What Kantrip does

  • Stores secrets only in its own vault, which does not unlock with your login, and rejects other credential stores.
  • Keeps references, never values, in profiles; describe never reads the credential store, and doctor checks that each credential is stored.
  • Requires verified TLS for Kafka authentication; certificate and hostname checks cannot be disabled.
  • Writes client configuration to a private session directory, never to command arguments, and removes it when the session ends.

What it cannot do

  • The client you run receives usable credentials; Kantrip cannot control what it does with them or what it prints.
  • Malware running as your user, or an unlocked or compromised credential store, can read your secrets.
  • kantrip ping proves the connection and authentication, not access to topics, groups, or schemas.
  • A process that daemonizes can escape supervision, and a crash can leave private files until the next cleanup.

Read the threat model and report vulnerabilities privately through the security policy.