kafka_reset_offsets · MCP Kafka MCP: Risk & Policy

WHAT IT DOES

What kafka_reset_offsets does on MCP Kafka

AI agents use kafka_reset_offsets to create or update resources in MCP Kafka — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your MCP Kafka environment.

WHY IT NEEDS A POLICY

Why kafka_reset_offsets needs a policy

Resetting consumer group offsets modifies the position from which a consumer group reads messages. This is a Write operation as it changes persistent state in Kafka (the stored offsets), but it is technically reversible since offsets can be reset again.

From the tool's definition Reset consumer group offsets (requires write access, group must be inactive)

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

kafka_reset_offsets Rate-limited

kafka_reset_offsets stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "kafka_reset_offsets": {
      "limits": [
        {
          "counter": "kafka_reset_offsets_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches MCP Kafka, so you can run agents against it safely.

FAQ

Questions about kafka_reset_offsets

What does the kafka_reset_offsets tool do? +

Reset consumer group offsets (requires write access, group must be inactive). It is categorised as a Write tool in the MCP Kafka MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on kafka_reset_offsets? +

Register the MCP Kafka MCP server in PolicyLayer and add a rule for kafka_reset_offsets: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP Kafka. Nothing to install.

What risk level is kafka_reset_offsets? +

kafka_reset_offsets is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit kafka_reset_offsets? +

Yes. Add a rate_limit block to the kafka_reset_offsets rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block kafka_reset_offsets completely? +

Set action: deny in the PolicyLayer policy for kafka_reset_offsets. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides kafka_reset_offsets? +

kafka_reset_offsets is provided by the MCP Kafka MCP server (williajm/mcp_kafka). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.