Sign in Start free

Open source Apache 2.0 · one static binary · any Kafka

The Kafka CLI you reach for when you need to look right now

ntk is a fast, friendly command-line tool and terminal UI for Apache Kafka. Inspect clusters, move messages, watch consumer lag and fix things, from one binary that knows your clusters, shows you what will change before it changes it, and treats messages as the bytes they are. No JVM, no librdkafka, works with any Kafka.

Download ntk View on GitHub
  • Linux, macOS, Windows, FreeBSD
  • Works with any Kafka
  • No telemetry
ntk · profile prod
$ ntk topic list                    # what's here?
$ ntk consume orders --from -10     # last 10 per partition
$ ntk produce orders -k k1 -v hello # send one
$ ntk group watch billing           # live lag, ETA to catch up
$ ntk health                        # is the cluster OK?
$ ntk                               # or open the TUI

One binary instead of a toolbox

  • 1Static binary. No JVM, no librdkafka, nothing to install first
  • 19Commands, from topic and consume to acl, tx and health
  • 0Agents on your brokers. Lag, rates and health come from offsets
  • 6Ways to connect: PLAINTEXT, TLS, mTLS, SASL PLAIN, SCRAM-SHA-256 and -512

Instead of kafka-*.sh and kcat

The same jobs, without the stack of scripts

The Kafka distribution ships a dozen shell scripts that each want a JVM, a classpath and --bootstrap-server typed out again. kcat covers two of the jobs. ntk covers all of them, with the cluster saved once as a profile.

Everyday Kafka tasks, with the stock scripts and with ntk
The jobWith the stock toolsWith ntk
List topics with partitions, size and retentionkafka-topics.sh --bootstrap-server … --describe, then kafka-log-dirs.sh for the sizesntk topic list
Read the last 10 messages of every partitionkcat -C -b … -t orders -o -10, or kafka-console-consumer.sh with --max-messages per partitionntk consume orders --from -10
Watch a consumer group's lag, livewatch kafka-consumer-groups.sh --describe --group billing, and do the rate maths yourselfntk group watch billing: rates, time lag, ETA to catch up
Copy an hour of a topic to another clusterMirrorMaker, or a consumer piped into a producer and hope the keys and headers surviventk consume on one cluster, ntk produce on the other, joined by a Unix socket: keys, headers and tombstones intact
Check the cluster is OK before a deploySeveral --describe calls and a script that greps themntk health --fail-on warn, exit 5 if anything is amber
Connect to production safelyThe right CA, keystore and JAAS config on every machine, every timentk -p prod, with a read-only profile that refuses writes

How it works

A few ideas run through the whole tool

  • Profiles, not flags

    Connection details live in one file: bootstrap servers, TLS, mTLS, SASL PLAIN or SCRAM. ntk -p prod is the whole incantation. A profile can be read-only, coloured and labelled prod, so destructive commands make you type the resource name even with -y.

  • Bytes in, bytes out

    ntk never decodes, re-encodes or pretty-prints a message. What it gives you is what's in the log. For JSON, Avro or anything else, pipe it to the tool that understands it, or run one per message with -o 'exec:jq .'.

  • A plan before every change

    Creating, deleting, resetting, granting: you see the exact effect first. --dry-run works on every mutating command, and a plan saved as JSON can be reviewed and applied later with ntk apply.

  • Watch without agents

    Throughput, lag, time lag, stuck consumers and an ETA to catch up are all computed from offsets, so monitoring works on any cluster with nothing installed on the brokers. group lag --threshold turns it into a check.

  • The TUI is the CLI

    Every view in the terminal UI runs the same code as the command line and tells you the command it ran. ? for keys, : to jump between views, m for live sparklines on a topic or group.

  • Built for pipes and pipelines

    Data on stdout, everything else on stderr. -o json, jsonl, name or a Go template on every listing. Specific exit codes: 3 can't connect, 5 a check failed, 7 not authorized. Shell completion that knows your topics and groups.

What it looks like

Answers, not dumps

A health check that reads as a checklist, and a connection test that tells you which step broke.

ntk health
$ ntk health
Cluster abc123 · Kafka 4.3 · 3 brokers
✓ brokers            3/3 reachable
✓ controller         2
✓ offline            0
✓ under-replicated   0
✓ under-min-isr      0
✓ leader-imbalance   0.0% of partitions not on their preferred leader
✓ reassignments      none
✓ log-dirs           3 dirs, no errors
✓ disk               max 31% (broker 1)
✓ transactions       no hanging transactions
Status: OK
ntk profile test
$ ntk profile test prod
✓ DNS         kafka.example.com → 10.0.0.12
✓ TCP         kafka.example.com:9093 (14ms)
✓ TLS         server cert kafka.example.com, issuer Example CA, expires in 212d
✓ SASL        scram-sha-512 as svc-ops
✓ Metadata    cluster abc123 · 6 brokers · controller 2 · Kafka 3.9
✓ Principal   User:svc-ops (derived)

Every command has --help. The guide is ten short chapters: profiles, topics, consuming, producing, consumer groups, mirroring, monitoring, access control and the TUI.

Install

On your PATH in a minute

One self-contained binary for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) and FreeBSD. Every release ships a checksums file.

  • Download the binary

    sha256sum -c --ignore-missing ntk-*-checksums.txt
chmod +x ntk-*-linux-amd64
sudo mv ntk-*-linux-amd64 /usr/local/bin/ntk

    Latest release on GitHub

  • Or Docker

    docker run --rm -it \
  -v ~/.config/ntk:/home/ntk/.config/ntk \
  ghcr.io/ntailio/ntk topic list

    Add --network host to reach a cluster on localhost.

  • Or Go 1.26+

    go install github.com/ntailio/ntk/cmd/ntk@latest

    Then ntk profile create walks you through servers, security and a connection test, or import a Java client.properties with --from-properties.

Built by ntail

Made by a team that runs Kafka for a living

ntk is made and maintained by the team behind ntail, serverless Kafka with no fees for public internet traffic. It's the cluster we build ntk against, but nothing in ntk is specific to ntail: it works with any Kafka, self-hosted or managed.

  • Need a cluster to point it at?

    The free Kafka cluster is a real managed cluster at $0 a month, with no card and no time limit. Create it, copy the client settings from the console, and ntk profile create --from-properties does the rest.

  • Tested against a real cluster on every change

    Every command runs against a real three-broker cluster in CI. The repo ships that sandbox, with plaintext, mTLS and SCRAM listeners, so you can try ntk somewhere safe before pointing it at production.

  • Deliberately small

    Message decoding and schema registry support are intentionally out of scope: ntk moves bytes and tells you the truth about the cluster. Bug reports and feature ideas are welcome as GitHub issues.

FAQ

Common questions about ntk

What is ntk?

ntk is an open-source command-line tool and terminal UI for Apache Kafka. It lists and describes topics, reads and writes messages, watches consumer lag, manages ACLs, SCRAM users and quotas, inspects transactions and runs a cluster health check, all from one static binary with no JVM. It is built by ntail and released under the Apache License 2.0.

Does ntk work with any Kafka cluster?

Yes. ntk speaks to any Apache Kafka cluster or Kafka-compatible service, self-hosted or managed, over PLAINTEXT, TLS, mTLS, SASL PLAIN or SCRAM-SHA-256/512. It is the tool we build against ntail, but nothing in it is specific to ntail.

How is ntk different from the kafka-*.sh scripts and kcat?

The kafka-*.sh scripts need a JVM and a Kafka distribution on the machine, and kcat covers producing and consuming only. ntk is one static binary that covers topics, groups, messages, ACLs, quotas, transactions and health, keeps your clusters in named profiles so you never retype bootstrap servers, shows a plan before every change, and adds a terminal UI that runs the same code as the CLI.

Does ntk decode Avro, Protobuf or JSON messages?

No, by design. ntk never decodes, re-encodes or pretty-prints a message: what you get is exactly the bytes in the log. Pipe the output to the tool that understands your format, or run one command per message with -o 'exec:jq .'. Message decoding and schema registry support are intentionally out of scope.

Does ntk need Java or librdkafka?

No. ntk is a single static Go binary. Download it, put it on your PATH and run it. There is also a Docker image and go install for anyone who prefers them.

Can I use ntk in scripts and CI?

Yes. Every listing command takes -o json, jsonl, name or a Go template; data goes to stdout and everything else to stderr; --no-input never prompts; and the exit codes are specific: 3 cannot connect, 4 not found, 5 a check failed, 6 refused, 7 not authorized. ntk group lag with a threshold and ntk health are built to be one-line checks in a pipeline.

Does ntk send telemetry?

No. ntk never phones home. The only network connections it opens are the ones to the Kafka cluster you point it at.

Is ntk free?

Yes. ntk is open source under the Apache License 2.0 and free to use with any cluster. If you need a cluster to point it at, ntail's free plan gives you a managed Kafka cluster at $0 a month, with no card and no time limit.

One binary, any Kafka

Download ntk and point it at a cluster, or start on the free plan today, no card and no time limit, and point it at ours.

Download ntk Start free