connect

Wire the user's running Klag into their AI client over MCP. URL hint: $ARGUMENTS.

Klag's MCP is read-only and served from an in-memory snapshot — it never queries Kafka on demand. Tools: list_consumer_groups, get_consumer_group_lag, find_lagging_groups, diagnose.

1. Find the endpoint

If $ARGUMENTS has a URL, use it. Otherwise look for a running Klag. Export the result as KLAG_URL (and NS for the namespace) so the commands below stay quoted and copy-pasteable:

docker ps --filter ancestor=themoah/klag --format '{{.Names}} {{.Ports}}'
kubectl get deploy -A -l app.kubernetes.io/name=klag 2>/dev/null

For a cluster install, start a port-forward (confirm first) and use http://localhost:18888:

kubectl -n "$NS" port-forward svc/klag 18888:8888

A port-forward dies with the shell — tell the user the registration points at a tunnel they must keep open, and that a real setup should expose Klag through a Service/Ingress and register that URL instead.

2. Check the prerequisites

curl -s -o /dev/null -w '%{http_code}\n' "$KLAG_URL/readyz"
# Drop the Authorization line when MCP_AUTH_TOKEN is unset — do not send the literal placeholder.
curl -s -X POST "$KLAG_URL/mcp" -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $KLAG_MCP_TOKEN" \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

• 404 on /mcp → MCP_ENABLED is not true. Offer to enable it (mcp.enabled=true in the chart, -e MCP_ENABLED=true for docker) and redeploy.
• 401 → MCP_AUTH_TOKEN is set; get the token from the user or read it from the Secret with their confirmation. Never print it back.
• 405 → that was a GET; MCP here is POST only.
• Empty snapshot → the collector has nothing to publish. Check in this order: METRICS_REPORTER is set (default none means no collection at all), /metrics actually has klag_consumer_lag series, METRICS_GROUP_FILTER / METRICS_GROUP_EXCLUDE do not exclude every group, and the cluster really does have groups with committed offsets. Only the first needs a redeploy.