Lenses Mcp For Apache Kafka

by lensesio

255 downloads Not rated yet
GitHub Website

About

Manage, explore, transform and join data across multiple clusters using different flavours of Apache Kafka via Lenses.io (including the free Community Edition)

Explore

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

  1. Download and install Highlight from highlightai.com/download
  2. Navigate to the plugins tab and select "Add Custom Plugin"
  3. Configure the plugin with the settings below
    Plugin Name Lenses Mcp For Apache Kafka
    Command (node, npx, python, etc.)

    Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.

  4. Enable "Start Automatically" if you want the plugin to start when Highlight launches

From the repository

OAuth 2.1 is the recommended authentication method for all Lenses MCP deployments. It provides secure, scope-based authorization without sharing static API keys.

OAuth 2.1 uses bearer tokens that are validated via](https://docs.astral.sh/uv/getting-started/installation/)RFC 7662 Token Introspection. The flow involves three participants:
- MCP Client— Your AI tool (Claude, Cursor, etc.)
- Authorization Server— Lenses HQ atLENSES_ADVERTISED_URL
- MCP Server— This server (the resource server)

When you connect, the client automatically:
- Discovers OAuth metadata from this server (/.well-known/oauth-protected-resource/mcp)
- Registers itself with the authorization server
- Initiates OAuth authorization (with PKCE) and gets an access token
- Uses the token to authenticate requests to this MCP server

This server then validates the token with Lenses HQ before allowing access to Kafka resources.

To use OAuth, you should setOAUTH_ENABLEDtotrue, then you only need to set two environment variables:

OAUTH_ENABLED=true LENSES_URL=https://lenses.example.com MCP_ADVERTISED_URL=http://localhost:8000

- LENSES_URL— Your Lenses instance (used internally and as the OAuth authorization server)
- MCP_ADVERTISED_URL— The public URL where this MCP server is reachable by clients

TRANSPORTautomatically defaults tohttpwhenMCP_ADVERTISED_URLis set.

If the MCP server reaches Lenses on an internal address but clients reach it on a public URL:

OAUTH_ENABLED=true LENSES_URL=http://lenses-hq.internal:9991 LENSES_ADVERTISED_URL=https://lenses.example.com MCP_ADVERTISED_URL=https://mcp.example.com

When you authenticate, you'll be prompted to grant these scopes. Your token will only grant the scopes you select.

Lenses HQ must support OAuth 2.0 and token introspection. Ensure your Lenses HQ config includes:

oauth2: authorizationServer: unauthenticatedIntrospection: true

This allows the MCP server to validate tokens without client credentials.

For backward compatibility and testing, you can use a static API key instead of OAuth. This is not recommended for production but may be useful for local development or legacy systems.

Create a Lenses API key by provisioning anIAM Service Accountin Lenses. Add the API key to.env:

LENSES_URL=https://lenses.example.com LENSES_API_KEY=<YOUR_LENSES_API_KEY>

When using API key authentication,TRANSPORTdefaults tostdio(local only) unless you explicitly setMCP_ADVERTISED_URL.

Run with stdio transport (for local AI tools):

OAUTH_ENABLED=true \ LENSES_URL=https://lenses.example.com \ MCP_ADVERTISED_URL=http://localhost:8000 \ uv run src/lenses_mcp/server.py

Or run with HTTP transport (for remote clients):

OAUTH_ENABLED=true \ LENSES_URL=https://lenses.example.com \ MCP_ADVERTISED_URL=http://localhost:8000 \ uv run fastmcp run src/lenses_mcp/server.py --transport=http --port=8000

To configure in Claude Desktop, Cursor, or similar tools:

{ "mcpServers": { "Lenses": { "command": "uv", "args": [ "run", "--project", "<ABSOLUTE_PATH_TO_THIS_REPO>", "--with", "fastmcp", "fastmcp", "run", "<ABSOLUTE_PATH_TO_THIS_REPO>/src/lenses_mcp/server.py" ], "env": { "OAUTH_ENABLED": "true", "LENSES_URL": "https://lenses.example.com", "MCP_ADVERTISED_URL": "http://localhost:8000" }, "transport": "stdio" } } }

LENSES_URL=https://lenses.example.com \ LENSES_API_KEY=<YOUR_LENSES_API_KEY> \ uv run src/lenses_mcp/server.py

LENSES_URL=https://lenses.example.com \ LENSES_API_KEY=<YOUR_LENSES_API_KEY> \ uv run fastmcp run src/lenses_mcp/server.py --transport=http --port=8000

To configure in Claude Desktop, Cursor, or similar tools:

{ "mcpServers": { "Lenses.io": { "command": "uv", "args": [ "run", "--project", "<ABSOLUTE_PATH_TO_THIS_REPO>", "--with", "fastmcp", "fastmcp", "run", "<ABSOLUTE_PATH_TO_THIS_REPO>/src/lenses_mcp/server.py" ], "env": { "LENSES_URL": "https://lenses.example.com", "LENSES_API_KEY": "<YOUR_LENSES_API_KEY>" }, "transport": "stdio" } } }

Note: Some clients may require the absolute path touvin the command.

The Lenses MCP server is available as a Docker image atlensesio/mcp. You can run it with OAuth (recommended) or API key authentication.

docker run --rm -it \ -e OAUTH_ENABLED=true \ -e LENSES_URL=https://lenses.example.com \ -e MCP_ADVERTISED_URL=http://localhost:8000 \ lensesio/mcp

HTTP transport(for remote clients, listens onhttp://0.0.0.0:8000/mcp):

docker run --rm -it -p 8000:8000 \ -e OAUTH_ENABLED=true \ -e LENSES_URL=https://lenses.example.com \ -e MCP_ADVERTISED_URL=http://localhost:8000 \ -e TRANSPORT=http \ lensesio/mcp

For split-plane deployments where the MCP server reaches Lenses internally but clients use a public URL:

docker run --rm -it -p 8000:8000 \ -e OAUTH_ENABLED=true \ -e LENSES_URL=http://lenses-hq.internal:9991 \ -e LENSES_ADVERTISED_URL=https://lenses.example.com \ -e MCP_ADVERTISED_URL=https://mcp.example.com \ -e TRANSPORT=http \ lensesio/mcp

docker run --rm -it \ -e LENSES_API_KEY=<YOUR_API_KEY> \ -e LENSES_URL=https://lenses.example.com \ lensesio/mcp

HTTP transport(for remote clients, listens onhttp://0.0.0.0:8000/mcp):

docker run --rm -it -p 8000:8000 \ -e LENSES_API_KEY=<YOUR_API_KEY> \ -e LENSES_URL=https://lenses.example.com \ -e TRANSPORT=http \ lensesio/mcp

Legacy environment variables(for backward compatibility):

- LENSES_API_HTTP_URL,LENSES_API_HTTP_PORT
- LENSES_API_WEBSOCKET_URL,LENSES_API_WEBSOCKET_PORT

These are automatically derived fromLENSES_URLbut can be explicitly set to override.

- stdio: Standard input/output (no network endpoint)
- http: HTTP endpoint at/mcp
- sse: Server-Sent Events endpoint at/sse

Lenses documentation is available onContext7. It is optional but highly recommended to use theContext7 MCP Serverand adjust your prompts withuse context7to ensure the documentation available to the LLM is up to date.

The MCP server validates bearer tokens using the following sequence:
-

Protected Resource Metadata(RFC 9728) —RemoteAuthProviderserves/.well-known/oauth-protected-resource/mcpso clients can discover which authorization server to use and what scopes are available.

Auto-Discovery— On the first incoming request, theDiscoveryTokenVerifierlazily fetches{LENSES_ADVERTISED_URL}/.well-known/oauth-authorization-serverto discover theintrospection_endpoint. The endpoint URL can also be set explicitly viaINTROSPECTION_URL.

Token Introspection(RFC 7662) — For each incoming bearer token, the verifier POSTs to the introspection endpoint (/oauth2/introspect) without client authentication. The authorization server responds with:

- active— whether the token is valid
- scope— granted scopes (e.g.read write)
- client_id— the token's owner
- exp— expiration timestamp

Inactive or expired tokens are rejected before reaching the Lenses API.

Token Forwarding— Valid tokens are forwarded to the Lenses API viaAuthorization: Bearer <token>so Lenses can perform its own authorization checks.

The server advertises three scopes in its protected-resource metadata:

Scopes are not enforced globally at the introspection level — a token with any subset of these scopes is accepted. Per-tool scope enforcement can be added using FastMCP'srequire_scopesdecorator.

In a simple deployment, only two environment variables are required:

LENSES_URL=https://lenses.example.com MCP_ADVERTISED_URL=http://localhost:8000

Forsplit-plane deploymentswhere the MCP server reaches Lenses on an internal address but clients use a public URL, set:

LENSES_URL=http://lenses-hq.internal:9991 LENSES_ADVERTISED_URL=https://lenses.example.com MCP_ADVERTISED_URL=https://mcp.example.com

- OAuth 2.0 Authorization Server Metadata(RFC 8414) at/.well-known/oauth-authorization-server
- Token Introspection(RFC 7662) at theintrospection_endpoint, with client authenticationdisabled
- PKCE with S256(RFC 7636) for client authorization flows

The MCP server does not send client credentials when introspecting. Lenses HQ must be configured with:

oauth2: authorizationServer: unauthenticatedIntrospection: true

Without this setting, every bearer token will be rejected as invalid.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

connect a read-only replica, analytics database, or staging database. Keep credentials on your machine while the tool discovers schema, generates safe SQL, previews it for approval, runs the query, and summarizes the result.

Official MCP server for dbt (data build tool) providing integration with dbt Core/Cloud CLI, project metadata discovery, model information, and semantic layer querying capabilities.

Query and analyze data with MotherDuck and local DuckDB

A collection of tools for managing the platform, addressing data quality and reading and writing to Teradata Database.

A read-only MCP server for Avro data sources, powered by the CData JDBC Driver.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "lenses mcp for apache kafka": {
            "Lenses.io": {
                "command": "uv",
                "args": [
                    "run",
                    "--project",
                    "<ABSOLUTE_PATH_TO_THIS_REPO>",
                    "--with",
                    "fastmcp",
                    "fastmcp",
                    "run",
                    "<ABSOLUTE_PATH_TO_THIS_REPO>/src/lenses_mcp/server.py"
                ],
                "env": {
                    "LENSES_API_KEY": "<YOUR_LENSES_API_KEY>"
                },
                "transport": "stdio"
            }
        }
    }
}

McpServers

{
    "Lenses.io": {
        "command": "uv",
        "args": [
            "run",
            "--project",
            "<ABSOLUTE_PATH_TO_THIS_REPO>",
            "--with",
            "fastmcp",
            "fastmcp",
            "run",
            "<ABSOLUTE_PATH_TO_THIS_REPO>/src/lenses_mcp/server.py"
        ],
        "env": {
            "LENSES_API_KEY": "<YOUR_LENSES_API_KEY>"
        },
        "transport": "stdio"
    }
}

This is theLensesMCP (Model Context Protocol) server for Apache Kafka. Lenses offers a developer experience solution for engineers building real-time applications connected to Kafka. It's built for the enterprise and backed by a powerful IAM and governance model.

With Lenses, you can find, explore, transform, integrate and replicate data across a multi-Kafka and vendor estate. Now, all this power is accessible through your AI tools and AI Agents via MCP, bringing real-time context into your agentic engineering workflows.

The quickest way to try the MCP server is with the freeLenses Community Edition, which runs Lenses MCP Server as a remote MCP server and comes with a pre-configured single broker Kafka cluster with demo data, ideal for local development or evaluation (steps here).

- 1. Install uv and Python
- 2. Configure Environment Variables
- 3. OAuth 2.1 Authentication (Recommended)
- 4. Lenses API Key (Fallback)
- 5. Running the Server Locally
- 6. Running with Docker
- 7. Optional Context7 MCP Server
- Appendix: OAuth Flow Details

We useuvfor dependency management and project setup. If you don't haveuvinstalled, follow the[official installation guide.

This project has been built usingPython 3.12and to make sure Python is correctly installed, run the following command to check the version.

Copy the example environment file and configure it based on your authentication method:

Required variablesdepend on your authentication choice:

- For OAuth(recommended):LENSES_URLandMCP_ADVERTISED_URL
- For API Key(fallback):LENSES_URLandLENSES_API_KEY

No reviews yet — be the first

Sign in to leave a review

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

More like this

Similar MCP servers you might find useful

Browse category

Sequential Thinking

Sequential Thinking is an MCP server that provides a tool for dynamic and reflective problem-solving through a structured, step-by-step thinking process. It is…

— 88.2k 508.3k dl
Other

Redis

Redis MCP Server connects compatible AI clients with Redis databases, allowing models and agents to inspect and interact with Redis-backed data through Model…

5.0 88.2k 6.6k dl
Database

Sentry

Sentry MCP Server connects compatible AI clients with Sentry error monitoring, allowing models and agents to inspect issues and event data through Model…

— 88.1k 4.3k dl
Developer Tools

Github

GitHub MCP Server connects compatible AI clients with GitHub repositories, issues, and pull requests, allowing models and agents to read and act on project…

— 88.1k 9.9k dl
Developer Tools