ntk - ntail kafka management tool

A fast, friendly CLI and TUI for Apache Kafka.
Inspect clusters, move messages, watch lag, and fix things, from one binary.
Getting Started · About · Install · Documentation · Contributing · Status · ntail.io

Built by ntail, serverless Kafka without the bandwidth bill. Free tier, no card required.

ntk topic list                       # what's here?
ntk consume orders --from -10        # the last 10 messages per partition
ntk produce orders -k k1 -v hello    # send one
ntk group watch billing              # live lag, rates, time to catch up
ntk                                  # or open the TUI

ntk is the tool you reach for when you need to look at a Kafka cluster, right now, from a terminal. It replaces the stack of kafka-*.sh scripts and a kcat with one binary that knows your clusters, shows you what will change before it changes it, and treats messages as the bytes they are.

A few ideas run through the whole tool:

• Profiles, not flags. Connection details live in one file, with PLAINTEXT, TLS, mTLS, SASL PLAIN, SCRAM, OAUTHBEARER and AWS MSK IAM. ntk -p prod is the whole incantation, and a read-only profile makes mistakes hard.
• Bytes in, bytes out. ntk never decodes, re-encodes or pretty-prints a message. What it gives you is what's in the log. For JSON, Avro or anything else, pipe it to the tool that understands it, or run one per message with -o 'exec:jq .'.
• A plan before every change. Creating, deleting, resetting, granting: you see the exact effect first. --dry-run works on every mutating command, and a saved plan can be applied later.
• Watch without agents. Throughput, lag, time lag and stuck consumers are computed from offsets, so monitoring works on any cluster, with nothing installed on the brokers.
• The TUI is the CLI. Every view in the terminal UI runs the same code as the command line, and will tell you the command it ran.

ntk is a single static Go binary with no JVM and no librdkafka. It sends no telemetry.

ntk is made and maintained by the team behind ntail, serverless Kafka without the bandwidth bill: nothing to size, no fees for public internet traffic, encrypted by default, and run on our own infrastructure in the EU rather than rented from a hyperscaler. Standard Kafka clients and tooling work unchanged, and so does ntk; it's the cluster we build ntk against, but it works with any Kafka.

If you need somewhere to point it at, ntail has a free tier with no card required, and ntk profile create does the rest.

Download the latest release →

One self-contained binary for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) or FreeBSD (amd64). Download the one for your platform, put it on your PATH, and you're done. Each binary has a .sha256 file next to it to verify the download.

Prefer Docker or Go?

# Docker, with your profiles mounted
docker run --rm -it -v ~/.config/ntk:/home/ntk/.config/ntk ghcr.io/ntailio/ntk topic list

# Go 1.26+
go install github.com/ntailio/ntk/cmd/ntk@latest

Linux, macOS and Windows are fully supported. On Windows, named pipes (npipe:) take the place of Unix sockets.

Then connect to a cluster and have a look around:

ntk profile create          # a short wizard: servers, security, test, save
ntk topic list
ntk                         # the TUI

Shell completion knows your topics, groups and principals:

ntk completion bash > ~/.local/share/bash-completion/completions/ntk    # zsh, fish, powershell too

Want somewhere safe to try it? The repo includes a 3-broker Kafka sandbox with plaintext, mTLS, SCRAM and OAuth listeners: docker compose up -d --wait, then export NTK_PROFILE_PATH=$PWD/sandbox/profiles.json.

The guide is a set of short chapters:

Getting started · Profiles · Topics · Consuming · Producing · Consumer groups · Mirroring · Monitoring · Access control · The TUI

Every command has --help, and ntk help <command> works too.

Bug reports and feature ideas are very welcome as GitHub issues. ntk doesn't accept external pull requests at the moment; CONTRIBUTING.md explains why, and how to write an issue we can act on quickly.

ntk is young and under active development. It's in use against real clusters, and every command is tested against a real 3-broker cluster on every change. Expect occasional breaking changes to flags until a 1.0.

Message decoding and Schema Registry support are intentionally not on the roadmap.

One side listens on a Unix datagram socket, the other sends one datagram per message:

ntk -p staging produce orders --in unix:/tmp/orders.sock -m
ntk -p prod consume orders --from -1h -m -o unix:/tmp/orders.sock --unix-wait

That's a topic mirror between two clusters with keys, headers and tombstones intact, and it stops cleanly on ctrl-c. The same socket works for any program that isn't a Kafka client. On Windows, a named pipe does the same: npipe:orders in place of unix:/tmp/orders.sock, and --npipe-wait. For continuous production replication you still want MirrorMaker; the mirroring chapter explains when to use which.

ntk consume orders --from -1h -o 'exec:jq -c "select(.status == \"FAILED\")"'

-o exec:<command> runs the command once per message, with the bytes on stdin and the key, offset and partition in NTK_* environment variables. It's the escape hatch for decoding, filtering and anything else ntk deliberately doesn't do itself.

topic watch and group watch give you live per-partition rates, lag trends and an ETA to catch up. ntk health runs a dozen checks in one go and exits non-zero when something's wrong, which makes it a one-line readiness probe.

Profiles can be read-only, and deletion_prevention decides what destructive commands do: refuse them (always), ask first (prompt, the default), or just run them (never). Either way they show the plan first. ntk profile test checks DNS, TCP, TLS, SASL and metadata one step at a time and tells you which one broke.

ntk is released under the Apache License 2.0. Copyright Factual Tech AB, the company behind ntail, serverless Kafka.