Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?


Failed to load latest commit information.
Latest commit message
Commit time
October 23, 2018 16:17
February 2, 2020 06:58
October 29, 2022 02:43
March 9, 2021 04:49
October 12, 2019 06:06
September 19, 2021 15:56
October 23, 2018 18:20
April 7, 2023 04:37
December 5, 2021 03:55
April 26, 2023 14:36
September 18, 2018 17:40
April 7, 2023 04:37


Maintenance Slack Status master

A responsive Plex plugin web frontend

If you like this, buy me a beer:
or become a Patreon starting at 1 $ / month


What is Kitana?

Kitana exposes your Plex plugin interfaces "to the outside world". It does that by authenticating against Plex.TV, then connecting to the Plex Media Server you tell it to, and essentially proxying the plugin UI. It has full PMS connection awareness and allows you to connect locally, remotely, or even via relay.

It does that in a responsive way, so your Plugins are easily managable from your mobile phones for example, as well.

Running one instance of Kitana can serve infinite amounts of servers and plugins - you can even expose your Kitana instance to your friends, so they can manage their plugins as well, so they don't have to run their own Kitana instance.

Kitana was built for Sub-Zero originally, but handles other plugins just as well.

Isn't that a security concern?

Not at all. Without a valid Plex.TV authentication, Kitana can do nothing. All authentication data is stored serverside inside the current user's session storage (which is long running), so unwanted third party access to your server is virtually impossible.

The Plex plugin UIs still suck, though!

Yes, they do. Kitana does little to improve that, besides adding responsiveness to the whole situation.

Also, it isn't designed to. Kitana is an intermediate solution to the recent problem posed by Plex Inc. and their plans to phase out all UI-based plugins from the Plex Media Server environment.


  • small footprint by using the CherryPy framework
  • heavy caching for faster plugin handling
  • full PMS connection awareness and automatic fallback in case the configured connection is lost
  • fully responsive (CSS3)
  • made to run behind reverse proxies (it doesn't provide its own HTTPS interface)
  • fully cross-platform


Imgur Gallery


Docker (the easy way, Windows included)

Install Docker


This launches Kitana on port 31337:

  • docker run --name kitana --restart unless-stopped -v kitana_data:/app/data -d -p pannal/kitana:latest -B

Mount behind a reverse proxy (example: NGINX)

  • docker run --name kitana --restart unless-stopped -v kitana_data:/app/data -d -p pannal/kitana:latest -B -P

Mount on /kitana and behind a reverse proxy (example: NGINX)

  • docker run --name kitana --restart unless-stopped -v kitana_data:/app/data -d -p pannal/kitana:latest -B -p /kitana -P


  • docker stop kitana && docker rm kitana && docker pull pannal/kitana:latest, then re-run it with the command above


    image: pannal/kitana:latest
    container_name: kitana
      - /FOLDER/TO/KITANA_DATA:/app/data
      - 31337:31337
    #  - plex
    command: -B -P
    restart: unless-stopped

Manual installation


  • Python3.7


  • go to the Kitana folder
  • pip3.7 install -r requirements.txt


  • python3.7


  • install Python 3.7 (preferrably ActivePython)
  • pip3.7 install -r requirements_win32.txt


  • python3.7 (Note: asset proxying seems slow on win32, adding --shadow-assets=False is advised)

Running behind IIS:

  • %windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/proxy -preserveHostHeader:true /commit:apphost (Stackoverflow)


I've included sample configs for running Kitana using supervisord, and an NGINX reverse-proxy sample config you can use.



  • run kitana (see above)
  • open your browser and visit your Kitana instance (standalone: http://your-ip:31337)
  • authenticate against Plex.TV
  • select your server (non-owned may not work; local connections are preferred)
  • profit

Command line options (python --help)

usage: [-h] [-B HOST:PORT] [-a [BOOL]] [-i PLUGIN_IDENTIFIER]
                 [-l LANGUAGE] [-p PREFIX] [-P [BOOL]] [-PH [PROXY_HOST_VAR] |
                 -PB PROXY_BASE] [--shadow-assets [BOOL]] [-t TIMEOUT]
                 [-pt PLEXTV_TIMEOUT]

optional arguments:
  -h, --help            show this help message and exit
                        Listen on address:port (default:
  -a [BOOL], --autoreload [BOOL]
                        Watch project files for changes and auto-reload?
                        (default: False)
                        The default plugin/channel to view on a server
                        (default: com.plexapp.agents.subzero)
  -l LANGUAGE, --plugin-language LANGUAGE
                        The language to request when interacting with plugins
                        (default: en)
  -p PREFIX, --prefix PREFIX
                        Prefix to handle; used for reverse proxies normally
                        (default: "/")
  -P [BOOL], --behind-proxy [BOOL]
                        Assume being ran behind a reverse proxy (default:
                        Token to access Plex. Can be the name of an
                        environment variable containing the token. Overrides
                        and disables any and all authentication. Effectively
                        enables local mode.
  -PH [PROXY_HOST_VAR], --proxy-host-var [PROXY_HOST_VAR]
                        When behind reverse proxy, get host from this var
                        (NGINX: "Host", Squid: "Origin", Lighty/Apache:
                        "X-Forwarded-Host", IIS: "Host" (see README))
                        (default: "Host")
  -PB PROXY_BASE, --proxy-base PROXY_BASE
                        When behind a reverse proxy, assume this base URI
                        instead of the bound address (e.g.:;
                        no slash at the end). Do *not* include the :prefix:
                        here. (default: "Host (NGINX)")
  --shadow-assets [BOOL]
                        Pass PMS assets through the app to avoid exposing the
                        plex token? (default: True)
  -t TIMEOUT, --timeout TIMEOUT
                        Connection timeout to the PMS (default: 5)
  -pt PLEXTV_TIMEOUT, --plextv-timeout PLEXTV_TIMEOUT
                        Connection timeout to the Plex.TV API (default: 15)
  --allow-not-owned [BOOL]
                        Allow access to not-owned servers? (default: False)

BOOL can be:
True: "y, yes, t, true, True, on, 1"
False: "n, no, f, false, False, off, 0".

[BOOL] indicates that when the switch but no value is given, True is used.


  • use proper logging interface (as of now, print() is used)
  • add verbosity options
  • add HTTPS option
  • allow the use of config files instead of the command line options
  • add an auto update mechanism for everything but Docker
  • (implement a video player for video plugins?)
  • add theming engine
  • add service for win32