Authorization is the reason to route through Lenses: the token is granted read, write and delete scopes at consent time, forwarded to the Lenses API, and Lenses runs its own checks on top, so an agent's reach is the reach you approved. execute_sql is the part that changes daily work — a question about what is actually in a topic becomes a query instead of a console consumer and a lot of scrolling.
Lenses' own server for Apache Kafka. It fronts a Lenses instance rather than the brokers, so topics, connectors, consumer groups, SQL and dataset metadata across the environments Lenses manages become tools, under the IAM model Lenses already enforces.
- Topics listed and inspected, with partitions and broker configs, created plain or with a schema, reconfigured, given more partitions, and messages resent
- Kafka Connect worked end to end: connectors listed and inspected, created, paused or resumed, tasks restarted, configuration validated, connectors deleted
- Consumer groups listed overall or per topic, with offsets updated or cleared down to a single topic partition
- SQL executed against the estate, plus SQL processors created, inspected and deleted, with their deployment targets and pod logs
- Datasets and their metadata: message metrics, topic descriptions, topic tags
- Environments listed, inspected, created and health-checked
Python 3.13 and uv, or the lensesio/mcp Docker image. LENSES_URL points at your Lenses instance. OAuth 2.1 is the recommended route: set OAUTH_ENABLED to true and MCP_ADVERTISED_URL to the public URL clients reach this server on, and Lenses HQ must be configured with unauthenticatedIntrospection so tokens can be introspected. A Lenses API key from an IAM service account, in LENSES_API_KEY, is the fallback. TRANSPORT is stdio by default and http once MCP_ADVERTISED_URL is set, listening on PORT 8000 at /mcp. The free Lenses Community Edition runs this server for you against a preconfigured single-broker cluster with demo data.
One command plus a key — docker run --rm -it -e OAUTH_ENABLED=true -e LENSES_URL=https://lenses.example.com -e MCP_ADVERTISED_URL=http://localhost:8000 lensesio/mcp, then supply credentials