kantrip 0.1.0a2

Kantrip securely manages plaintext, TLS, SASL, mTLS, and OAuth Kafka profiles for kcat, the official Kafka CLIs, Kaskade, and compatible applications. This pre-release CLI validates and displays profiles, opens scoped sessions, and checks Kafka and registry connectivity. The typed connection core validates, resolves, and renders PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, mTLS, and OAuth for authenticated command sessions and ACL-independent Kafka connectivity checks.

Features

Kafka profiles

• Schema-validated profiles in a private transactional SQLite database
• Ordered automatic schema migrations with private recovery backups
• Multiple bootstrap servers, descriptions, labels, and independent secure Registry endpoints
• Native Kafka OAuth and Registry Basic, token, mTLS, and OAuth profiles
• Plaintext or verified TLS transport with default client trust or a copied PEM CA bundle
• Typed PLAIN, SCRAM, and mTLS lifecycle with OS-backed secret references
• Canonical Java and librdkafka authentication renderers
• add, edit, remove, label-filtered list, and safe describe commands
• Human, JSON, and YAML profile observations

Local diagnostics

• Profile database, credential backend, permissions, platform, shell, and session checks
• Read-only diagnostics with explicit deterministic repair through doctor --repair
• Explicit Kafka protocol connectivity checks with ping
• Installed-command discovery for Kantrip's supported adapters
• Colored status output with plain-text and NO_COLOR support

Compatible CLI sessions

• kcat and its kafkacat alias
• Apache Kafka .sh commands and equivalent unsuffixed Confluent Platform commands
• Confluent Avro, JSON Schema, and Protobuf console producers and consumers
• Kaskade admin and consumer, including Confluent and native Apicurio decoding
• Private, profile-aware client configuration with connection overrides blocked
• Consistent Bash, Zsh, and Fish subshells plus one-off command execution
• Process-group and PTY supervision with child exit-status preservation
• Crash-safe runtime locks, automatic stale-session recovery, and doctor --repair

Terminal experience

• Rich-based Arcana theme with semantic colors
• Clean stdout/stderr separation
• NO_COLOR, TERM=dumb, non-TTY behavior, and global or command-local --no-color

Roadmap

The MVP roadmap tracks the remaining first-release work, including external input formats, additional clients, readability, a GitHub Pages site, and final documentation cleanup. Current secure Registry and OAuth support is described in Compatibility; first-release manual checks live in Manual Testing as each capability lands. Development contracts may change destructively before the first release; no compatibility with earlier development commits is promised.

Quick start

pipx

pipx install kantrip

First profile session

kantrip add local
kantrip doctor
kantrip list
kantrip describe local
kantrip ping local
kantrip exec local -- kcat -L
kantrip exec local -- kafka-topics --list
kantrip exec local -- kaskade admin

Omit the command to work in a profile-scoped interactive subshell:

kantrip exec local
kantrip current
kcat -L
kafka-topics --list
exit

Command compatibility

See the compatibility guide for supported tools, versions, and limitations.

Usage

See the usage guide.

Development

See the development guide.

Run the valuable exploratory scenarios in the manual testing guide.

Releases

See GitHub Releases for release notes and downloadable artifacts.

Questions

For Q&A, go to GitHub Discussions.

Security

Report suspected vulnerabilities privately by following the Kantrip security policy.

Donations

If Kantrip is useful to you, consider supporting its development on GitHub Sponsors.

AI Assistance

The project uses AI-assisted development. The maintainer reviews and tests all AI-assisted changes before inclusion.

Acknowledgements