KlagSAFE
new kafka lag exporter: lightweight and extendable.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[![License][license-badge]][license] [![Release][release-badge]][release] [![CI][ci-badge]][ci]
[![Docker Pulls][docker-badge]][docker] [![Artifact Hub][artifacthub-badge]][artifacthub] [![Ask DeepWiki][deepwiki-badge]][deepwiki]
[license]: https://github.com/themoah/klag/blob/main/LICENSE [license-badge]: https://img.shields.io/badge/License-Apache%202.0-blue.svg [release]: https://github.com/themoah/klag/releases/latest [release-badge]: https://img.shields.io/github/v/release/themoah/klag?logo=github [ci]: https://github.com/themoah/klag/actions/workflows/build-and-push.yml [ci-badge]: https://github.com/themoah/klag/actions/workflows/build-and-push.yml/badge.svg [docker]: https://hub.docker.com/r/themoah/klag [docker-badge]: https://img.shields.io/docker/pulls/themoah/klag?logo=docker [artifacthub]: https://artifacthub.io/packages/helm/klag/klag [artifacthub-badge]: https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/klag [deepwiki]: https://deepwiki.com/themoah/klag [deepwiki-badge]: https://deepwiki.com/badge.svg
Kafka Consumer Lag Exporter — Know when your consumers fall behind, before it becomes a problem.
Inspired by kafka-lag-exporter (archived 2024). Built with Vert.x and Micrometer.
Migrating from kafka-lag-exporter? See the [migration guide](https://klag.dev/migration) (metric/label/config mapping + drop-in dashboard tips).
### 📖 Documentation lives at [klag.dev](https://klag.dev) Full guides — configuration, Kafka ACLs, Helm/Strimzi deployment, integrations, metrics reference, and development — are at [klag.dev](https://klag.dev). AI agents: a machine-readable corpus is at klag.dev/llms.txt. The docs source lives in website/ (Astro + Starlight).### 🤖 Install with your AI agent In Claude Code:/plugin marketplace add themoah/klag→/plugin install klag@klag→/klag:install. It detects
634d677e312dOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add klag-website --env CF_ANALYTICS_TOKEN=${CF_ANALYTICS_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"klag-website": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CF_ANALYTICS_TOKEN": "${CF_ANALYTICS_TOKEN}"
}
}
}
}Exposed tools (7)
5 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_klag_config | read | Look up Klag environment variables: name, default value, and what they do |
get_klag_doc | read | Return the full markdown of a single klag.dev page by its URL path, e.g. |
get_klag_metric | read | Look up the metrics Klag exports (klag.consumer.lag, klag.consumer.lag.velocity, |
klag | write | Agent skills for Klag, the Kafka consumer lag exporter: install it against a |
klag-llms-full | read | The full text of every klag.dev page in one document. |
klag-llms-index | write | Project summary, quick start, key metrics, and a linked index of every page. |
search_klag_docs | read | Full-text search across klag.dev, the documentation for Klag (the Kafka consumer |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (13)
.node-version
.convert_v2_to_v1.py
.node-version
.assetsignore
parse: (str) => yaml.load(str) ?? {},parse: (str) => yaml.load(str) ?? {},refresh_discovery(){ rm -rf "${HOME}/.kube/cache/discovery" "${HOME}/.kube/cache/http" 2>/dev/null || true; }src: 'https://static.cloudflareinsights.com/beacon.min.js',
'data-cf-beacon': JSON.stringify({ token: cfToken }),endpoint = URI.create("http://127.0.0.1:" + server.actualPort() + "/mcp");@astrojs/sitemap, @astrojs/starlight, astro, gray-matter, js-yaml, sharp, @astrojs/check, typescript
read-only credentials, and it does nothing else — it never produces, consumes, or commits
settings such as `DD_*`, `OTLP_*`, and `OTEL_*` read environment variables directly and
Gates applied: no_behavioural_pass.
634d677e312dfull audit observations/trust-audit/mcp-server/themoah__klag.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 634d677e312d | SAFE | B | 89 | first audit |
Questions
What is the Klag MCP server?
new kafka lag exporter: lightweight and extendable.
What tools does Klag expose?
7 in total: 5 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Klag safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Klag need?
It reads CF_ANALYTICS_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (634d677e312d), read on 2026-10-07. The repository is watched and re-audited when it changes.