KafDesk

Changelog

0.2.8 2026-11-06

  • Sign in to Kafka with your own account in the browser (OAuth authorization code with PKCE): for OAUTHBEARER, pick “Sign in with my account”, enter the issuer (or the endpoints) and the client ID, and press Sign in. KafDesk keeps only the refresh token, in the keychain, and renews access tokens itself; team members sign in with their own accounts. Standard OAuth for desktop apps (a one-time 127.0.0.1 redirect), tested with Keycloak; the providers that support it, such as Microsoft Entra ID, Okta and Auth0, need a public client with a loopback redirect. Background checks and AI agents never open the browser.
  • Linux: Install update waits for the package lock when Ubuntu is installing its own updates.
  • AWS Glue Schema Registry: give a connection its AWS region and KafDesk decodes Glue-serialized Avro, JSON Schema and Protobuf values (also zlib-compressed), with your usual AWS credentials. The message details show the Glue schema version.
  • Data masking: hide e-mail addresses, payment card numbers, tokens, IBANs, JSON fields by name and your own patterns in shown and exported messages, and optionally in what AI agents read through MCP (Settings → Data masking); while agents get masked data, they cannot filter on message content. Copy to topic and Import still move the original bytes.

0.2.7 2026-11-05

  • OAuth sign-in to Kafka without pasting tokens: for OAUTHBEARER, enter your identity provider's token endpoint, client ID, secret and scope (OAuth 2.0 client credentials) and KafDesk fetches the token itself and renews it before it expires, so long sessions keep working. Works with Keycloak (Strimzi), Microsoft Entra ID (Azure Event Hubs), Okta, Auth0 and Confluent Cloud (SASL extensions logicalCluster and identityPoolId). The secret stays in the keychain, travels only over https and only to the endpoint you saved; the profile's CA file is trusted for it. Importing a Java client.properties or librdkafka config picks these settings up.
  • Throughput charts: messages per second for every topic (a column and a 10-minute sparkline in the topics list), a topic's last hour and each partition's rate on its new Activity tab, with a note when one partition takes most of the writes, and the cluster's total with its busiest topics on the overview. Sampled every 15 s from the end offsets while you are connected; no metrics endpoint needed.
  • Import from file: load an NDJSON or CSV export of KafDesk, JSON Lines (one value per line) or plain text (one message per line) into a topic. The preview counts the records, lists invalid lines with their line numbers and shows the first records; the import sends exactly the previewed file. Keys, headers, partitions and timestamps from the file are kept if you want, values can be encoded with the topic's Avro, Protobuf or JSON Schema. A production topic asks for its name.

0.2.6 2026-11-05

  • Copy to topic: send the messages you are looking at (start position, partitions, text or expression filter) to another topic on this or another connected cluster, for example to replay a dead-letter topic. Keys, values and headers are copied byte for byte, aborted transactions are skipped, records keep their timestamps and can carry their source topic, partition and offset as headers. The preview shows the count, the offsets and the first records, and the copy sends exactly those, even while producers keep writing. A production target asks for the topic name.

0.2.5 2026-11-05

  • Saved connections show online or offline before you connect (a quick network check of their brokers every 20 s) on the welcome screen, in the sidebar and in the cluster strip.
  • The cluster strip on the right edge is wider; offline clusters are dimmed there.
  • AI agents (MCP) is reachable without a connected cluster: on the welcome screen and at the foot of the sidebar.
  • Secondary buttons are volumetric like the primary ones.
  • Background sign-in check: online connections also show whether their credentials work (at most every 5 minutes; a refused login pauses the checks until you edit the connection). Credentials are only sent to settings you have saved or connected with yourself: a changed team file shows “not verified” until you press Connect. Can be turned off in Settings.
  • SSH tunnel and SOCKS5 proxy per connection, for brokers, Schema Registry and Kafka Connect. SSH host keys are checked against ~/.ssh/known_hosts; unknown hosts are refused with their fingerprint.
  • Import connections from kcat/librdkafka, the Confluent CLI, Kafka client .properties, Offset Explorer exports and Strimzi Kafka resources; passwords go to the keychain.
  • Export topic settings from Compare or a topic's Configs: a kafka-topics.sh/kafka-configs.sh script, Terraform (Mongey/kafka), Strimzi KafkaTopic YAML or JSON. Only settings set on the topic are exported; partitions are never reduced, topics never deleted.
  • Why is it lagging? Consumer group pages explain lag: stopped consumers, rebalances, one hot partition, stalled commits, consumers slower than producers.
  • MCP: new read-only tools explain_consumer_lag, find_messages_by_key and compare_schema_versions.
  • Windows and Linux install updates themselves after you click Install update: the release's SHA-256 sums must carry KafDesk's ed25519 signature and the package must match them, then it is installed (Windows installer, apt/dnf/zypper through pkexec, or AppImage) and KafDesk restarts.
  • Hardening from a security review: a refused SOCKS5 or SSH login is not retried until you edit the connection or press Connect (no account lockouts), SSH keepalive, Disconnect also stops live tails, exported kafka-topics.sh --alter quotes the topic name, the importer refuses deeply nested or non-regular files, and MCP tools cap memory and mark cluster data as untrusted.

0.2.4 2026-11-04

  • The new icon everywhere: the full KD-over-streams mark in the sidebar, the site header and from 24 px up; the 16–32 px icon files draw the same grid as cells, so the small icon matches the big one.

0.2.3 2026-11-04

  • New look: Signal Orange on anthracite in both themes, a new app icon (an orange KD disc over streams of messages), Inter and JetBrains Mono. Buttons stay volumetric; healthy and connected clusters are green.
  • Sidebar: the KafDesk card at the bottom opens your licence, the gear next to it opens Settings.
  • The cluster card at the top of the sidebar is labelled Current cluster and says whether it is connected.
  • macOS: the update window shows a short What's new for the version instead of the whole changelog page.

0.2.2 2026-11-04

  • Linux: KafDesk now starts on Ubuntu 23.10 and later (24.04 included). The package installs an AppArmor profile that lets WebKit's sandbox run.
  • macOS: the Dock and Launchpad icon is the right size; macOS 13 Ventura or later is required.
  • Licences: a proxy or captive-portal error during the daily check no longer removes your key; only Polar itself can refuse it.
  • Filter expressions on JSON messages are about 4× faster.
  • License window: Team seats show "Team seat" and the billing email.
  • Discover clusters keeps your place when you come back from Add as connection.

0.2.1 2026-11-01

  • Licences: every feature free for 14 days, then a Personal licence ($79 once, a year of updates, keeps working after) or Team seats ($99 per seat a year). Keys are activated in KafDesk → License… and checked with Polar once a day; KafDesk keeps working offline for 30 days.
  • Teams: shared connection profiles from a file or an https URL, read-only and without passwords; each member keeps their own credentials in the OS keychain. Protected clusters stay protected.
  • Managed deployment: a licence key from the KAFDESK_LICENSE_KEY environment variable or a system-wide license.key file is activated on first start.
  • License window shows your plan, when the key was last checked and a link to the Polar customer portal to manage devices and seats.

0.2.0 2026-11-01

  • First public early-access build for macOS (Apple silicon and Intel), Windows (x64, Arm) and Linux (deb, rpm).
  • Topics and messages: live tail, seek by time or offset, server-side search, Avro, Protobuf and JSON Schema decoding, produce with schemas, NDJSON and CSV export.
  • Filter expressions such as value.amount > 100 and value.status == "PAID", applied to fetched rows and to server-side search; saved filters per topic.
  • Consumer groups: lag per partition with a 15-minute trend, stalled-group alerts, offset resets with a preview, delete committed offsets.
  • Schema Registry: register new versions with a compatibility check first, compatibility levels, version diff, soft and permanent deletes.
  • Kafka Connect: connectors and tasks with failure traces, pause, resume, restart, create and edit with validation; secrets stay masked.
  • Administration: brokers and their configs, ACLs with presets, client quotas, create, delete and empty topics.
  • Compare two clusters: which topics exist where, partitions, replication and configs side by side.
  • Production protection: a red frame, typed confirmations for destructive actions, read-only connections enforced in the app and for AI agents.
  • Built-in MCP server for Claude Code, Cursor and Codex, read-only unless you allow writes.
  • Updates: macOS updates itself; Windows and Linux can check kafdesk.com for new versions when you allow it.

Download the latest version