Kantrip: switch kafka profiles like magic
Kantrip securely manages plaintext, TLS, SASL, mTLS, and OAuth Kafka profiles for kcat, the official Kafka CLIs, Kaskade, kaf, and compatible applications. Save a profile once, keep its secrets in your operating system's credential store, and run your usual clients inside a scoped, supervised session.
pipx install kantriplatest release on GitHub
Pre-release for macOS and Linux: commands, output, and stored profiles may change before v0.1.0. See Releases.
A session, start to finish
Add a SCRAM profile over verified TLS, check it, create a topic with the Kafka CLIs, and list it from an interactive session. The password prompt shows nothing, and the secret never reaches the profile, the command line, or the output. Inside the session, your own prompt can show the active profile.
❯ kantrip add prod -b kafka.example.com:9093 --ca-file ./ca.pem --auth scram-sha-512 --username app
Kafka password:
Added profile 'prod': kafka.example.com:9093, tls, scram-sha-512
❯ kantrip ping prod
✅ Kafka transport: verified TLS; authentication: scram-sha-512 authenticated
❯ kantrip exec prod -- kafka-topics --create --topic payments --partitions 1 --replication-factor 1
Created topic payments.
❯ kantrip exec prod
prod ❯ kafka-topics --list
orders
payments
prod ❯ exit
❯ Why Kantrip
-
Secrets stay in the OS store
Passwords, private keys, and client secrets are collected without echo and stored in macOS Keychain or Linux Secret Service. They never appear in profile documents, command arguments, or
describeoutput. -
One profile for every client
kcat, the Apache Kafka and Confluent CLIs, Confluent's schema console clients, Kaskade, and kaf each receive private configuration generated from the same profile, with connection overrides blocked.
-
Supervised, self-cleaning sessions
Commands and Bash, Zsh, or Fish subshells run supervised, with signals forwarded and exit codes preserved. Private session files are cleaned up, and stale sessions are recovered automatically or with
kantrip doctor --repair.
Supported clients
kcatandkafkacat- Metadata, produce, and consume, including Confluent-compatible Avro.
- Apache Kafka and Confluent Platform CLIs
- Topics, console producer and consumer, consumer groups, configs, ACLs, and broker
API versions, with or without the
.shsuffix. - Confluent schema console clients
- Avro, JSON Schema, and Protobuf producers and consumers.
- Kaskade
adminandconsumer, with Confluent and native Apicurio decoding.kaf- Topics, consumer groups, produce, and consume, with a private one-cluster configuration and Confluent Avro decoding.
Kafka connections use plaintext, verified TLS, SASL/PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, mTLS, or OAuth; registries use Confluent Schema Registry or Apicurio. Interactive sessions support Bash, Zsh, and Fish. The compatibility guide lists versions and limits.
Credential handling and its limits
What Kantrip does
- Stores secrets only in macOS Keychain or Linux Secret Service and rejects other keyring backends.
- Keeps references, never values, in profiles;
describenever reads the credential store, anddoctorchecks that each credential is stored. - Requires verified TLS for Kafka authentication; certificate and hostname checks cannot be disabled.
- Writes client configuration to a private session directory, never to command arguments, and removes it when the session ends.
What it cannot do
- The client you run receives usable credentials; Kantrip cannot control what it does with them or what it prints.
- Malware running as your user, or an unlocked or compromised credential store, can read your secrets.
kantrip pingproves the connection and authentication, not access to topics, groups, or schemas.- A process that daemonizes can escape supervision, and a crash can leave private files until the next cleanup.
Read the threat model and report vulnerabilities privately through the security policy.