The Kafka CLI is the set of shell scripts in the bin/ directory of every Apache Kafka distribution, such as kafka-topics.sh and kafka-consumer-groups.sh. The main alternatives are kcat, kafkactl, kaf, kcl, rpk, the Confluent CLI, Zoe, kt and the Kpow CLI, fh. On Amazon MSK, the AWS CLI adds topic commands to the cluster control plane.
They differ on six things: how much of the admin job they cover, whether they can hold contexts for several clusters, which authentication they support, whether their output and defaults are safe for scripts and AI agents, whether anyone still maintains them, and what a year of running them costs. The complete Kafka guide covers the wider tooling picture.
At a glance
Ten options are scored here on this page's six weighted criteria, 100 points in all. The rubric is weighted: Auth and access control counts three times, Annual cost, modelled counts three times, and Coverage of the admin job, Multi-cluster contexts, Scripting and agent safety and Maintenance status count once. The five listed first, of ten, each out of 100: Kpow CLI (fh) 80, which takes its best score on Multi-cluster contexts (9 out of 10) and its lowest on Coverage of the admin job (6 out of 10), Kpow licence: $13,500/yr, 3 clusters, 100 users; kafkactl 79, Licence: Apache-2.0, $0 licence; kcl 77, Licence: BSD-3-Clause, $0 licence; Confluent CLI 69, Licence: Confluent Community License, $0 licence; rpk 67, Licence: Source-available (BSL), $0 licence.
What the Kafka CLI is
Apache Kafka ships its administration tools as scripts under bin/. The Apache Kafka operations documentation puts it this way: “All of the tools reviewed in this section are available under the bin/ directory of the Kafka distribution and each tool will print details on all possible commandline options if it is run with no arguments.” Each script is a thin wrapper that starts a JVM and calls the official Java Admin, Producer or Consumer client, so the scripts support a new protocol feature on the day it is released.
Since Kafka 4.0 the admin tools connect through --bootstrap-server, because ZooKeeper mode has been removed. A command copied from an older blog post with --zookeeper in it will not run against a 4.x cluster.
The built-in tools
Five scripts do most of the day-to-day work:
kafka-topics.shcreates, lists, describes, alters and deletes topics.kafka-console-producer.shwrites lines from stdin to a topic.kafka-console-consumer.shreads a topic to stdout.kafka-consumer-groups.shlists and describes groups, shows lag per partition and resets offsets.kafka-configs.shdescribes and alters topic, broker, client and user configs.
Behind them sit kafka-acls.sh, kafka-reassign-partitions.sh, kafka-leader-election.sh, kafka-metadata-quorum.sh and a dozen more. The commands themselves, grouped by the job you are doing and checked against the Kafka 4.3 tool sources, are in Kafka CLI commands for day-2 operations. This page is about choosing the tool that runs them.
Where the built-in scripts fall short
The scripts are complete and they are awkward. A solution architect at a foodservice distributor described life before they adopted any tooling in Factor House’s published case study: “I remember needing to move an offset and thinking, okay, somebody dig out that shell script and let’s CLI this.” Their Kafka use had grown to a dozen product teams and roughly 130 developers, which CLI scripts and open-source tooling could not keep pace with.
The friction comes from four places:
- Authentication is a properties file (
--command-config) holding the principal’s credentials, passed on every call, and whoever holds that file holds that principal’s access. - The output is a human-formatted table.
kafka-topics.sh,kafka-consumer-groups.sh,kafka-configs.shandkafka-acls.shhave no JSON mode, so scripts parse whitespace. - Each invocation targets one cluster. There is no notion of a named context, so the difference between staging and production is one flag value in your shell history.
- Access control is Kafka ACLs on the principal and nothing else. There is no approval step, no staged change and no record of who ran what beyond the broker’s view of the client.
Kafka CLI tools compared
| Rank | Tool | Coverage | Multi-cluster contexts | Auth | Scripting and agent safety | Maintained | Licence and annual cost | Source |
|---|---|---|---|---|---|---|---|---|
| 1 | Kpow CLI (fh) |
Topics, brokers, groups and offset resets, Connect, schemas, quotas, reassignments, transactions. No produce, consume or ACLs | Named contexts, tenant and cluster switching | Kpow’s single sign-on (OIDC), RBAC and tenancy, or basic auth | --output json or yaml on every command, staged writes reported as staged. No dry run stated |
Released 22 Sep 2026 | Needs Kpow: $13,500/yr for 3 clusters, about $16,380 all in on this page’s estimate | Demo page |
| 2 | kcl | Everything, plus transactions, quotas, share groups and a schema registry client | Named profiles | TLS, SASL PLAIN, SCRAM and AWS_MSK_IAM | Stable --format json, --help-json, prompts answer no without a terminal, --dry-run |
Last commit 18 Sep 2026 | BSD-3-Clause, $0 licence, about $20,160/yr on this page’s estimate | GitHub: twmb/kcl |
| 3 | kafkactl | Topics, groups, offsets, ACLs, broker configs, SCRAM users, produce and consume with Avro, JSON Schema and Protobuf | Named contexts, project config files, Kubernetes | TLS, SASL including OAuth token providers for Azure and AWS, OS keyring | -o json or yaml on describe and consume, offset reset previews until --execute |
Last commit 30 Jul 2026 | Apache-2.0, $0 licence, about $21,600/yr on this page’s estimate | GitHub: deviceinsight/kafkactl |
| 4 | Confluent CLI | Confluent Cloud and Platform: clusters, topics, API keys, produce and consume, Flink | --context |
Confluent Cloud login and API keys, REST Proxy credentials on-premises | -o json or yaml |
Last commit 21 Sep 2026 | Confluent Community License, $0 licence, about $23,040/yr on this page’s estimate | Confluent’s documentation, “Confluent CLI Overview” |
| 5 | rpk | Topics, ACLs, produce and consume, cluster config, framed for Redpanda | Profiles | SASL, TLS | --format json or yaml |
Last commit 20 Aug 2026 | Source-available (BSL), $0 licence, about $23,040/yr on this page’s estimate | Redpanda’s documentation, “Introduction to rpk” |
| 6 | Apache Kafka bundled scripts | Everything: topics, groups, offsets, ACLs, configs, reassignment, quorum, produce and consume | None, one --bootstrap-server per call |
Every mechanism the Java client supports, through a properties file | No JSON output. Offset reset is a dry run until --execute, ACL removal prompts unless --force |
Yes, ships with each release | Apache-2.0, $0 licence, about $28,800/yr on this page’s estimate | Apache Kafka docs |
| 7 | kaf | Topics, groups, produce and consume, offset commits | Named clusters | Configured per cluster, see its examples | JSON lines for consume only, offset commits apply immediately | Last commit 19 Apr 2026 | Apache-2.0, $0 licence, about $24,480/yr on this page’s estimate | GitHub: birdayz/kaf |
| 8 | Zoe | Filtered consume, group offsets, Avro schema upload | Cluster aliases in config | Not documented in its README | Table output shown | Last commit 1 Dec 2024 | MIT, $0 licence, about $17,280/yr on this page’s estimate | GitHub: adevinta/zoe |
| 9 | kcat | Produce, consume, metadata. No admin | One config file | Any librdkafka property | -J JSON for consume and metadata |
Last commit 17 Nov 2022 | BSD-style, $0 licence, about $25,920/yr on this page’s estimate | GitHub: edenhill/kcat |
| 10 | kt | Produce, consume, topic info, offsets, topic create and delete | Environment variables | TLS only | JSON in and out | Last commit 26 Oct 2023 | MIT, $0 licence, about $27,360/yr on this page’s estimate | GitHub: fgeller/kt |
The rank column runs in the order of the cards further down the page: the Kpow CLI first because Factor House publishes this page, then every other tool by total, highest first. The annual figures are this page’s estimate of what a year of running each tool costs at 100 engineers across three clusters, built from the model in criterion 6, and not a price any vendor charges.
How the options score
Totals out of 60: kcl 51, kafkactl 49, the Kpow CLI 46, the Confluent CLI 45, rpk 43, the bundled scripts 37, kaf 34, Zoe 32, kcat 27 and kt 25. The Kpow CLI sits third on total because it gives up coverage points for the strongest access control on the list. The cards below list the Kpow CLI first because Factor House publishes this page, then every other tool by total, highest first. No total has been adjusted to put it there.
On coverage, the bundled scripts and kcl are the only two tools that do the whole job, and kafkactl comes close. kcat, kt and Zoe are message tools with little or no administration. The Kpow CLI covers the administration but not message data yet. As Chad Harris said in the demo, “The only thing we don’t support at the moment is data consumption and data production”. It also has no ACL command.
On contexts, kafkactl leads, with named contexts, config files that live in a project repository, and a mode that runs inside Kubernetes. kcl, rpk and the Kpow CLI all hold named contexts or profiles. The bundled scripts and kcat have none.
On auth and access control, every client-side tool is only as safe as the credentials in its config file. The Kpow CLI works differently: a server-side policy in Kpow’s RBAC decides what each signed-in person can do, rather than whichever Kafka principal a file holds. On Amazon MSK, the AWS CLI’s topic commands are governed by IAM policy in a similar way.
On maintenance, kcat, kt and Zoe have gone quiet. kcat is still everywhere and still useful for a quick consume, but it has had no commits since November 2022.
On annual cost, the Kpow CLI comes out lowest at about $16,380 a year on this page’s estimate, in spite of being the only option with a licence to pay for, because the 300 per-engineer Kafka principals and the hand-kept record of who ran what that every client-side CLI needs at this size are already in the deployment. Zoe is next at about $17,280, and that figure buys searching records with no administration at all. kcl is about $20,160, and the bundled scripts are the most expensive on the page at about $28,800, because nothing they print is machine readable. The web UIs that do the same jobs are scored the same way in the best Kafka management tools, and the free tiers on their own in the best free Kafka UI tools.
Which Kafka CLIs are safe to hand to an AI agent
An agent with shell access runs whatever the CLI and its credentials allow. Three properties decide whether that is acceptable:
- Structured output, so the agent reads JSON instead of guessing at column boundaries. kcl, kafkactl, rpk, the Confluent CLI, kt and the Kpow CLI all provide it. The bundled scripts do not.
- Safe defaults on destructive commands. kcl is the strongest: its README says that “When stdin is not a terminal the prompt answers no and the command prints the plan it would have carried out and exits 0”. The bundled
kafka-consumer-groups.sh --reset-offsetsand kafkactl’sreset offsetboth preview until told to execute. - Permissions that belong to the person, not the file. A client-side CLI acts as whichever principal its config holds, so the only control is a least-privilege Kafka principal, and Kafka’s own ACL documentation is explicit that a resource with no matching ACL is restricted to super users. The Kafka ACL page covers designing that principal. The Kpow CLI calls the Kpow API as the signed-in user, so an RBAC policy can allow, deny or stage each action for that user.
No single tool wins all three. kcl has the best client-side safety, the Kpow CLI has the only server-side approval step on this list, and the bundled scripts have neither structured output nor per-user control. For an agent on a production cluster, pick either a read-only Kafka principal with kcl, or the Kpow CLI with an RBAC policy that stages writes. The rest of an agent’s setup, from its identity to its audit trail, is in how to let an AI agent operate Kafka safely. The best tools to control destructive Kafka operations compares approval workflows beyond the CLI.
1. Kpow CLI (fh)
The Kpow CLI, fh, is a client for the Kpow API rather than a Kafka client of its own, so it needs a Kpow deployment and inherits that deployment’s single sign-on, RBAC and tenancy. Version 0.7.0 was published on 22 September 2026, and it scores 46 out of 60 on the rubric explained under how these tools were scored, third on total and the lowest annual cost on the page at about $16,380.
Rank 1 Kpow CLI (fh)
80 out of 100 Total
Try Kpow in the live demo No signup needed.
- Kpow licence
- $13,500/yr, 3 clusters, 100 users
- Total cost, modelled
- About $16,380/yr
- Released
- 0.7.0, 22 Sep 2026
- Coverage of the admin job
- 6 out of 10
- Multi-cluster contexts
- 9 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 9 out of 10
- Scripting and agent safety
- 8 out of 10
- Maintenance status
- 6 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 8 out of 10
Why these scores for Kpow CLI (fh)
- Coverage of the admin job 6 out of 10
- Its help output lists topics, brokers, groups incl. reset-offsets, Connect, schemas, quotas, reassignments and transactions, with no produce/consume (Chad: “coming soon”) and no ACL command, and reset takes explicit topic:partition:offset only.
- Multi-cluster contexts 9 out of 10
- Named contexts, one per deployment, plus fh config switch tenant|cluster; one Kpow deployment spans several clusters.
- Auth and access control 9 out of 10
- OIDC sign-in (authorization code + PKCE), basic or bearer; runs under the deployment’s SSO, RBAC and tenancy per the demo. Needs Kpow, not a direct Kafka client.
- Scripting and agent safety 8 out of 10
- Every command takes --output json|yaml, and the project’s README says writes that need approval report ‘Mutation staged for admin approval’. No dry-run or confirmation prompt stated, so kcl is ahead on client-side safety.
- Maintenance status 6 out of 10
- Version 0.7.0, released 22 September 2026, is the first public release, so there is no cadence to judge yet.
- Annual cost, modelled 8 out of 10
- Kpow Enterprise $13,500 for 3 clusters with 100 users included (the Kpow pricing page) plus about 2 engineer-hours a month, about $16,380 a year on this page’s model, band $15,000 to $17,499. Lowest figure on the page, because the 12 hours a month of per-engineer principals and hand-kept command records that every client-side CLI needs are $0 here. This page’s estimate.
What it covers. The Factor House CLI, fh, is a single binary that calls the Kpow API. Version 0.7.0 covers clusters, brokers and broker configs, topics and topic configs, consumer groups and offset resets, Kafka Connect, Confluent and AWS Glue schema registries, quotas, partition reassignments and producer transactions. It also launches a terminal UI with fh tui.
Where it wins. Every command runs as the signed-in user, under the single sign-on, RBAC and tenancy the Kpow deployment already enforces, and a write that an RBAC policy stages is reported as staged for admin approval rather than applied. Output is a table for people and JSON or YAML for scripts and agents.
Where it falls short. It cannot produce or consume messages yet, it has no ACL commands, and offset resets need explicit topic, partition and offset values rather than shortcuts such as earliest or a timestamp. It needs a running Kpow deployment, so it is no use on a laptop against a bare cluster, and the access control it inherits is Kpow Enterprise RBAC and tenancy rather than anything the binary enforces by itself.
What it costs a year. Kpow Enterprise is $4,500 per cluster per year with 100 users included, so three clusters for 100 engineers are $13,500, and the CLI is not priced separately. On this page’s estimate add about 2 engineer-hours a month to keep contexts and RBAC policies current, which is $2,880 at $120 an hour, for about $16,380 a year. The 12 engineer-hours a month that every client-side CLI on this page needs, for 300 least-privilege principals and a hand-kept record of who ran what, is $0 here, because each engineer signs in through the deployment’s OIDC provider and the mutation record and the approval step live in Kpow. Community Edition is free for 3 clusters and 10 users, and the RBAC and tenancy this page credits are Enterprise, so the figure prices Enterprise.
Staying patched. Kpow’s release notes name the CVEs each release remediates, and the 96.4 image built on 5 August 2026 bundles 311 dependencies of which one carries a high or critical advisory, none of them published before that release. That is not a claim to patch faster than a community project: Kpow’s own dependency remediation has run from 14 to 128 days, and the current image still ships CVE-2026-75595 in netty, a 9.1 critical public since 19 August 2026, unpatched. What a licence buys here is not a different deployment model, because Kpow is self-hosted too. It is a company contracted to ship the fix. Every dependency figure on this page was read on 24 September 2026 from the published artefacts and from nvd.nist.gov.
2. kcl
kcl tops the rubric at 51 out of 60, with full marks for coverage and the highest score on this page for scripting and agent safety. It is the tool to reach for when a script or an AI agent will be running the commands rather than a person.
77 out of 100 Total
- Licence
- BSD-3-Clause, $0 licence
- Last commit
- 18 Sep 2026
- Total cost, modelled
- About $20,160/yr
- Coverage of the admin job
- 10 out of 10
- Multi-cluster contexts
- 9 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 7 out of 10
- Scripting and agent safety
- 10 out of 10
- Maintenance status
- 9 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
Why these scores for kcl
- Coverage of the admin job 10 out of 10
- The project’s README covers produce, consume, full admin incl. ACLs, configs, quotas, reassignment, transactions, share groups and schema registry.
- Multi-cluster contexts 9 out of 10
- Named profiles in config.toml, kcl profile use, -C for one command.
- Auth and access control 7 out of 10
- It supports TLS and SASL PLAIN, SCRAM-SHA-256/512 and AWS_MSK_IAM, and OAUTHBEARER is not listed.
- Scripting and agent safety 10 out of 10
- Global --format json with a stable envelope, --help-json for the whole command tree, destructive commands answer no without a TTY and print the plan, --dry-run, documented exit codes.
- Maintenance status 9 out of 10
- Last commit 18 Sep 2026.
- Annual cost, modelled 6 out of 10
- The licence is $0 plus about 2 engineer-hours a month, the lightest glue here, plus the 12 hours a month every client-side CLI needs for per-engineer principals and a hand-kept command record, which is about $20,160 a year on this page’s model, band $20,000 to $22,499. This page’s estimate, not a price anyone charges.
What it covers. A complete command-line Kafka client in one Go binary: producing and consuming, topic, group, config, ACL, quota and reassignment administration, transactions, share groups, a schema registry client and an in-process fake cluster for testing.
Where it wins. It is the most agent-aware CLI on this list. JSON output is stable and documented, the whole command tree is available as JSON with --help-json, and destructive commands such as group seek, config alter and acl delete prompt, then answer no and print the plan when stdin is not a terminal.
Where it falls short. It is a small project, 232 GitHub stars against kafkactl’s 1,070, so there is less community material when something goes wrong. OAUTHBEARER is not among the listed SASL mechanisms.
What it costs a year. There is no licence fee. On this page’s estimate kcl itself takes about 2 engineer-hours a month at 100 engineers across three clusters, the lightest on this page, because coverage is complete and --format json is one documented contract rather than a flag on some commands. What it does not do is decide who may run what, so the same model adds 12 engineer-hours a month for the 300 least-privilege principals that 100 engineers across three clusters need, issued, rotated and revoked, and for the record of who ran which command that no client-side CLI keeps. At $120 an hour that is $2,880 plus $17,280, about $20,160 a year.
Staying patched. kcl is BSD-3-Clause and actively developed, with its last commit on 18 September 2026. Nobody is contracted to patch it, so an advisory against a library it links reaches you when a maintainer cuts a release and you rebuild.
3. kafkactl
kafkactl follows at 49 out of 60 and takes the best score here on multi-cluster contexts. It suits engineers who move between many clusters, Kubernetes networks and Avro or Protobuf payloads in the same afternoon.
kafkactl
79 out of 100 Total
- Licence
- Apache-2.0, $0 licence
- Last commit
- 30 Jul 2026
- Total cost, modelled
- About $21,600/yr
- Coverage of the admin job
- 9 out of 10
- Multi-cluster contexts
- 10 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 9 out of 10
- Scripting and agent safety
- 7 out of 10
- Maintenance status
- 8 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
Why these scores for kafkactl
- Coverage of the admin job 9 out of 10
- It covers topics, groups, offset reset, ACLs, broker configs, SCRAM users, produce/consume with Avro, JSON Schema and Protobuf, in the project’s README.
- Multi-cluster contexts 10 out of 10
- Named contexts, current-context file, per-repo project config files, Kubernetes pod access.
- Auth and access control 9 out of 10
- It handles TLS and SASL plaintext/SCRAM/OAuth with token-provider plugins for Azure and AWS, and an OS keyring for passwords.
- Scripting and agent safety 7 out of 10
- Output takes -o json|yaml on describe and consume, offset reset prints results until --execute, and --validate-only applies on alter topic, with no confirmation on deletes stated.
- Maintenance status 8 out of 10
- Last commit 30 Jul 2026.
- Annual cost, modelled 6 out of 10
- Its licence is $0 plus about 3 engineer-hours a month, because JSON is documented on describe and consume rather than across the command tree, plus the 12 hours a month for per-engineer principals and a command record, which is about $21,600 a year on this page’s model, band $20,000 to $22,499. This page’s estimate, not a vendor price.
What it covers. Topic, consumer group, ACL, broker and SCRAM user management, offset resets, and producing and consuming with Avro, JSON Schema and Protobuf support.
Where it wins. The best context handling on this list: named contexts, a project config file that lives in a git repository, OS keyring integration for passwords, and a mode that runs the client inside a Kubernetes cluster when the brokers are not reachable from your machine. Offset resets print the plan and only apply with --execute.
Where it falls short. JSON output is documented for describe and consume commands rather than as a global contract, and no confirmation prompt is documented for deletes.
What it costs a year. There is no licence fee. On this page’s estimate kafkactl takes about 3 engineer-hours a month, a little more than kcl, because JSON is documented on describe and consume rather than across the whole command tree, so some scripts still read tables. The credentials sit in the context file, so the same 12 engineer-hours a month for 300 per-engineer principals and a hand-kept record of who ran what applies. At $120 an hour that is $4,320 plus $17,280, about $21,600 a year.
Staying patched. kafkactl is Apache-2.0 with its last commit on 30 July 2026. It is community-maintained, which means its release cadence is also its patching cadence and the rebuild is yours to schedule.
4. Confluent CLI
The Confluent CLI scores 45 out of 60, on continuous maintenance and structured output against a narrower coverage score and the work of running it next to a cluster it was not built for. It is the right tool on Confluent Cloud and the wrong one on a plain Apache Kafka cluster with no REST Proxy in front of it.
Rank 4 Confluent CLI
69 out of 100 Total
- Licence
- Confluent Community License, $0 licence
- Last commit
- 21 Sep 2026
- Total cost, modelled
- About $23,040/yr
- Coverage of the admin job
- 7 out of 10
- Multi-cluster contexts
- 8 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 7 out of 10
- Scripting and agent safety
- 8 out of 10
- Maintenance status
- 10 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
Why these scores for Confluent CLI
- Coverage of the admin job 7 out of 10
- It covers Confluent Cloud and Confluent Platform, clusters, topics, API keys, produce/consume and Flink, and on-premises topic commands go through a REST Proxy endpoint.
- Multi-cluster contexts 8 out of 10
- The --context flag names a CLI context per command.
- Auth and access control 7 out of 10
- It takes a Confluent Cloud login and API keys, or on-premises mTLS or credentials to the REST Proxy.
- Scripting and agent safety 8 out of 10
- Commands take -o human|json|yaml, with no safety defaults stated.
- Maintenance status 10 out of 10
- Last commit 21 Sep 2026.
- Annual cost, modelled 5 out of 10
- No fee for the CLI itself, plus about 4 engineer-hours a month because on-premises topic commands need a REST Proxy endpoint, plus the 12 hours a month for per-engineer principals and a command record: about $23,040 a year on this page’s model, band $22,500 to $24,999. Excludes what Confluent Cloud or Platform costs. This page’s estimate.
What it covers. Confluent’s CLI manages Confluent Cloud and Confluent Platform: environments, clusters, topics, API keys, producing and consuming, and Flink. Its command reference shows on-premises topic commands taking a --url for a REST Proxy endpoint.
Where it wins. The natural choice on Confluent Cloud, where it also handles environments, service accounts and API keys that no generic Kafka CLI knows about. Output is human, JSON or YAML.
Where it falls short. It is built for Confluent’s platforms. Against a plain Apache Kafka cluster without a REST Proxy it is the wrong tool, and it is source-available under the Confluent Community License.
What it costs a year. The CLI carries no fee of its own under the Confluent Community License, and what it costs is the work of running it beside a cluster it was not built for: on this page’s estimate about 4 engineer-hours a month, because on-premises topic commands go through a REST Proxy endpoint, so a cluster without one needs something else. The same 12 engineer-hours a month for per-engineer principals and a record of who ran what applies. At $120 an hour that is $5,760 plus $17,280, about $23,040 a year, and none of that counts what Confluent Cloud or Confluent Platform costs.
5. rpk
rpk scores 43 out of 60. Its coverage score is capped because its documentation does not state general Apache Kafka support, so the total says more about fit than about quality.
67 out of 100 Total
- Licence
- Source-available (BSL), $0 licence
- Last commit
- 20 Aug 2026
- Total cost, modelled
- About $23,040/yr
- Coverage of the admin job
- 6 out of 10
- Multi-cluster contexts
- 9 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 7 out of 10
- Scripting and agent safety
- 7 out of 10
- Maintenance status
- 9 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
Why these scores for rpk
- Coverage of the admin job 6 out of 10
- Its documentation gives topics, produce/consume, ACLs, cluster config, Connect and Cloud, framed around Redpanda clusters, with Apache Kafka support not stated, so capped.
- Multi-cluster contexts 9 out of 10
- rpk profile create/use/list.
- Auth and access control 7 out of 10
- It supports SASL and TLS, with rpk cloud login.
- Scripting and agent safety 7 out of 10
- Topic list takes --format json|yaml|text|wide, with no safety defaults stated.
- Maintenance status 9 out of 10
- Repo last commit 20 Aug 2026.
- Annual cost, modelled 5 out of 10
- No fee, plus about 4 engineer-hours a month because its documentation does not state general Apache Kafka support, so a second tool covers the gaps, plus the 12 hours a month for per-engineer principals and a command record: about $23,040 a year on this page’s model, band $22,500 to $24,999. This page’s estimate.
What it covers. Redpanda’s CLI manages Redpanda clusters end to end: configuration and health, tuning, ACLs, topics, producing and consuming, Connect and Redpanda Cloud. Redpanda’s documentation describes it as a tool to manage a Redpanda cluster without a separate script for each function.
Where it wins. One binary with profiles for each cluster and structured output formats, for teams running Redpanda.
Where it falls short. Its documentation frames it around Redpanda and does not state general Apache Kafka support, and the licence is source-available rather than open source.
What it costs a year. There is no fee under the Business Source License. On this page’s estimate rpk takes about 4 engineer-hours a month on an Apache Kafka cluster, because its documentation is framed around Redpanda and does not state general Apache Kafka support, so a second tool covers whatever it will not do. The same 12 engineer-hours a month for per-engineer principals and a record of who ran what applies. At $120 an hour that is $5,760 plus $17,280, about $23,040 a year.
6. Apache Kafka bundled scripts
The scripts under bin/ score 37 out of 60, with full marks on coverage and maintenance, the lowest score on this page for contexts, and the highest annual cost of any option here at about $28,800 on this page’s estimate. They are already present on most brokers and jump hosts, which is why the rest of this page is measured against them.
Rank 6 Apache Kafka bundled scripts
59 out of 100 Total
- Licence
- Apache-2.0, $0 licence
- Last commit
- 22 Sep 2026
- Total cost, modelled
- About $28,800/yr
- Coverage of the admin job
- 10 out of 10
- Multi-cluster contexts
- 2 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 8 out of 10
- Scripting and agent safety
- 4 out of 10
- Maintenance status
- 10 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 3 out of 10
Why these scores for Apache Kafka bundled scripts
- Coverage of the admin job 10 out of 10
- They cover the full admin surface, topics, configs, groups and offsets, ACLs, reassignment, quorum and produce/consume, which is the reference every other tool is measured against.
- Multi-cluster contexts 2 out of 10
- One --bootstrap-server and one --command-config per invocation; no named contexts.
- Auth and access control 8 out of 10
- Every mechanism the Java client supports (SASL GSSAPI, PLAIN, SCRAM, OAUTHBEARER, TLS) via a properties file. Access control is the principal’s Kafka ACLs.
- Scripting and agent safety 4 out of 10
- No JSON output on kafka-topics, kafka-consumer-groups, kafka-configs or kafka-acls. Offset reset is a dry run until --execute and ACL removal prompts unless --force, which are real safety defaults.
- Maintenance status 10 out of 10
- The last commit to apache/kafka was 22 Sep 2026, and they ship with every release.
- Annual cost, modelled 3 out of 10
- They carry a $0 licence and the most upkeep on the page, about 8 engineer-hours a month for whitespace parsing, a properties file per call and a JVM per command, plus the 12 hours a month for per-engineer principals and a command record, which is about $28,800 a year on this page’s model, band $27,500 to $29,999. This page’s estimate, not a vendor price.
What it covers. The bin/ directory of the Kafka distribution: kafka-topics.sh, kafka-consumer-groups.sh, kafka-configs.sh, kafka-acls.sh, the console producer and consumer, kafka-reassign-partitions.sh, kafka-metadata-quorum.sh and more. One script per job.
Where it wins. It is always there, it tracks every protocol feature on release day, and it supports every authentication mechanism Kafka does. The offset reset tool previews by default and only applies with --execute.
Where it falls short. Output is human-formatted tables with no JSON mode, credentials live in properties files you pass on every call, and switching clusters means switching flags. It starts a JVM per command.
What it costs a year. The scripts cost nothing to license and the most to run. On this page’s estimate they take about 8 engineer-hours a month at this size, because no admin script has a JSON mode, so anything automated parses whitespace, the credentials travel in a properties file passed on every call, and each command starts a JVM. Add the same 12 engineer-hours a month for 300 least-privilege principals and a record of who ran what, and at $120 an hour that is $11,520 plus $17,280, about $28,800 a year, the highest total on this page.
Compare Kafka consumer groups
7. kaf
kaf scores 34 out of 60, and at 2,442 GitHub stars it is the most starred of the community Go CLIs here, ahead of kafkactl’s 1,070 and kcl’s 232, which matters when you are searching for help with one of them. Its gaps are on the administration side rather than in everyday inspection.
54 out of 100 Total
- Licence
- Apache-2.0, $0 licence
- Last commit
- 19 Apr 2026
- Total cost, modelled
- About $24,480/yr
- Coverage of the admin job
- 5 out of 10
- Multi-cluster contexts
- 8 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
- Scripting and agent safety
- 4 out of 10
- Maintenance status
- 7 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
Why these scores for kaf
- Coverage of the admin job 5 out of 10
- It covers nodes, topics, groups, produce/consume and group offset commits, with no ACL or config commands documented.
- Multi-cluster contexts 8 out of 10
- kaf config add-cluster and select-cluster.
- Auth and access control 5 out of 10
- The project’s README points to an examples folder for cluster auth config, and the mechanisms are not listed in the README.
- Scripting and agent safety 4 out of 10
- JSON only for consume (--output json-each-row). group commit applies immediately, no dry run documented.
- Maintenance status 7 out of 10
- Last commit 19 Apr 2026.
- Annual cost, modelled 5 out of 10
- A $0 licence sits alongside about 5 engineer-hours a month, because no ACL or config commands are documented and JSON covers consume only, plus the 12 hours a month for per-engineer principals and a command record, which is about $24,480 a year on this page’s model, band $22,500 to $24,999. This page’s estimate.
What it covers. A kubectl-style CLI for nodes, topics, consumer groups, producing and consuming, and setting group offsets.
Where it wins. The most popular of the Go CLIs by GitHub stars, with a friendly cluster switcher and JSON lines output for piping one topic into another.
Where it falls short. Offset commits apply immediately, with no preview documented, and the README documents no ACL or config commands.
What it costs a year. There is no licence fee. On this page’s estimate kaf takes about 5 engineer-hours a month, because the README documents no ACL or config commands, so those jobs go back to bin/, and JSON output covers consume only. With the same 12 engineer-hours a month for per-engineer principals and a record of who ran what, at $120 an hour that is $7,200 plus $17,280, about $24,480 a year.
Staying patched. kaf is Apache-2.0 and its last commit is from 19 April 2026. A gap of that length is not abandonment, but it is the window in which an advisory against something it bundles would sit unshipped.
8. Zoe
Zoe scores 32 out of 60, with its highest marks on cost and contexts, because it does not attempt cluster administration at all, and the cost score reflects a tool that reads records and nothing more. Its last commit was on 1 December 2024.
56 out of 100 Total
- Licence
- MIT, $0 licence
- Last commit
- 1 Dec 2024
- Total cost, modelled
- About $17,280/yr
- Coverage of the admin job
- 4 out of 10
- Multi-cluster contexts
- 7 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 4 out of 10
- Scripting and agent safety
- 5 out of 10
- Maintenance status
- 4 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 8 out of 10
Why these scores for Zoe
- Coverage of the admin job 4 out of 10
- It handles consume with time and content filters, group offset monitoring and Avro schema upload, with no admin commands.
- Multi-cluster contexts 7 out of 10
- Clusters and topic aliases sit in config, with --cluster per command.
- Auth and access control 4 out of 10
- Not documented in the README beyond the config file.
- Scripting and agent safety 5 out of 10
- Output shows -o table, with other output formats not documented in the README.
- Maintenance status 4 out of 10
- Last commit 1 Dec 2024.
- Annual cost, modelled 8 out of 10
- It holds a $0 licence plus about 7 engineer-hours a month, because nothing has been committed since December 2024 and neither admin commands nor auth are documented, plus 5 hours a month rather than 12 for governance, since a consume-only tool needs a read-only principal and no change record, which is about $17,280 a year on this page’s model, band $15,000 to $17,499. That figure buys reading records, not administration. This page’s estimate.
What it covers. Consuming with filters on content, metadata and headers from a point in time, monitoring group offsets, and uploading Avro schemas.
Where it wins. It can offload consumption to Kubernetes pods or Lambda functions, which is useful for searching a large topic on a cloud cluster from a laptop.
Where it falls short. It is a search and consume tool rather than an admin CLI, and it has not had a commit since December 2024.
What it costs a year. There is no licence fee. On this page’s estimate Zoe takes about 7 engineer-hours a month, because there have been no commits since December 2024 and the README documents neither admin commands nor its authentication, so the gaps and the fixes are both yours. Its governance line is lighter than the rest of this page, about 5 engineer-hours a month rather than 12, because a consume-only tool needs a read-only principal per engineer and keeps no change to record. At $120 an hour that is $10,080 plus $7,200, about $17,280 a year, and what that buys is searching and reading records with no administration at all.
Staying patched. Zoe is MIT and its last commit is from 1 December 2024. Nothing has shipped in nearly two years, so anything published since then against what it bundles is still in the binary you would install today.
9. kcat
kcat scores 27 out of 60, with the lowest maintenance score on this page and one of the highest on authentication, because any librdkafka property works and nobody has committed to it since November 2022.
51 out of 100 Total
- Licence
- BSD-style, $0 licence
- Last commit
- 17 Nov 2022
- Total cost, modelled
- About $25,920/yr
- Coverage of the admin job
- 3 out of 10
- Multi-cluster contexts
- 3 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 8 out of 10
- Scripting and agent safety
- 7 out of 10
- Maintenance status
- 2 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 4 out of 10
Why these scores for kcat
- Coverage of the admin job 3 out of 10
- It offers produce, consume, metadata listing, offset lookup by timestamp and Avro via Schema Registry, with no admin commands.
- Multi-cluster contexts 3 out of 10
- One config file via -F or $KCAT_CONFIG; no named contexts.
- Auth and access control 8 out of 10
- Any librdkafka property via -X, so SASL and SSL are covered.
- Scripting and agent safety 7 out of 10
- It gives -J JSON envelopes for consume and -L metadata, and produce is its only write, with no prompt.
- Maintenance status 2 out of 10
- Last commit 17 Nov 2022.
- Annual cost, modelled 4 out of 10
- The $0 licence comes with about 6 engineer-hours a month, because there are no admin commands and no commits since November 2022, plus the full 12 hours a month for principals and a write record, since it can produce, which is about $25,920 a year on this page’s model, band $25,000 to $27,499. This page’s estimate.
What it covers. A netcat for Kafka, in its README’s words: producing, consuming and listing metadata, with Avro decoding through a schema registry.
Where it wins. It is tiny, fast, and speaks librdkafka, so every client property and authentication mechanism librdkafka supports is one -X flag away. -J wraps consumed messages and metadata in JSON.
Where it falls short. It has no admin commands, and there have been no commits since November 2022.
What it costs a year. There is no licence fee. On this page’s estimate kcat takes about 6 engineer-hours a month, because it has no admin commands, so every administrative job runs somewhere else, and nobody has committed to it since November 2022. It can produce, so the full 12 engineer-hours a month for per-engineer principals and a record of who wrote what applies. At $120 an hour that is $8,640 plus $17,280, about $25,920 a year.
Staying patched. kcat is BSD-style licensed and its last release, 1.7.0, is from August 2021. Nothing in it is being patched, so every advisory published since against librdkafka and its other dependencies is one you carry yourself.
10. kt
kt is last on the rubric at 25 out of 60, on TLS-only authentication, no named contexts and a maintenance score of 3. Its JSON contract is the reason it is still worth knowing.
41 out of 100 Total
- Licence
- MIT, $0 licence
- Last commit
- 26 Oct 2023
- Total cost, modelled
- About $27,360/yr
- Coverage of the admin job
- 5 out of 10
- Multi-cluster contexts
- 3 out of 10
- Auth and access control ×3 weight, this criterion counts 3 times toward the total
- 4 out of 10
- Scripting and agent safety
- 6 out of 10
- Maintenance status
- 3 out of 10
- Annual cost, modelled ×3 weight, this criterion counts 3 times toward the total
- 4 out of 10
Why these scores for kt
- Coverage of the admin job 5 out of 10
- It covers consume/produce, topic info, group offset changes, create and delete topics.
- Multi-cluster contexts 3 out of 10
- Environment variables (KT_BROKERS, KT_AUTH), no named contexts.
- Auth and access control 4 out of 10
- It has TLS and one-way TLS modes, with other modes by issue request.
- Scripting and agent safety 6 out of 10
- JSON output and JSON input by design, but create and delete topic run with no prompt or dry run documented.
- Maintenance status 3 out of 10
- Last commit 26 Oct 2023; maintainer says he no longer uses it actively.
- Annual cost, modelled 4 out of 10
- Licensing is $0, plus about 7 engineer-hours a month, because authentication is TLS only, there are no named contexts and the maintainer has stepped back, plus the full 12 hours a month for principals and a change record, which is about $27,360 a year on this page’s model, band $25,000 to $27,499. This page’s estimate.
What it covers. A JSON-first client for consuming and producing, topic information, group offset changes and topic creation and deletion.
Where it wins. Everything goes in and comes out as JSON, which made it a scripting favourite.
Where it falls short. Authentication is TLS only, and its maintainer writes that he is not using it actively any more.
What it costs a year. There is no licence fee. On this page’s estimate kt takes about 7 engineer-hours a month, because authentication is TLS only, there are no named contexts, and the maintainer writes that he no longer uses it, so a cluster on SASL needs another tool beside it. It creates and deletes topics, so the full 12 engineer-hours a month for per-engineer principals and a change record applies. At $120 an hour that is $10,080 plus $17,280, about $27,360 a year.
Staying patched. kt is MIT, its last commit is from 26 October 2023, and its maintainer says he no longer uses it actively. Nothing is being patched, so a dependency advisory against it stays open for as long as you run it.
Other Kafka CLIs worth knowing
A few more tools come up in the same searches. They are narrower, so they are listed rather than scored:
- kcctl manages Kafka Connect connectors with kubectl-style commands. Last commit 26 June 2025.
- Strimzi Kafka CLI (
kfk) gives kafka-script-style commands for Strimzi resources on Kubernetes. - plumber reads, writes and relays messages across Kafka, RabbitMQ, GCP Pub/Sub and others. Last commit 24 December 2024.
- Trubka consumes and publishes Protobuf and plain text. Last commit 18 April 2025.
- Conduktor CLI applies Conduktor Console and Gateway resources declaratively, so it needs Conduktor.
- The AWS CLI’s
aws kafkacommands manage Amazon MSK clusters and, throughlist-topics,describe-topic,create-topic,update-topicanddelete-topic, MSK topics. It has no consumer group, offset, ACL or message commands, so it sits beside a Kafka client rather than replacing one.
If you would rather have a keyboard-driven view than a command line, the Kpow CLI also launches a terminal UI with fh tui, which the best Kafka terminal UIs scores against the open-source ones. For the web UI side of the same decision, see the best Kafka management tools.
How Factor House approaches the CLI
The Kpow CLI, fh, is a client for the Kpow API rather than a Kafka client of its own. “The CLI uses the Kpow API to let you access almost anything you can do from the Kpow web application,” as Chad Harris put it in the CLI and agentic skills demo. Version 0.7.0 was published on 22 September 2026 as a Homebrew cask in the factorhouse/homebrew-tap repository and as archives for macOS, Linux and Windows.
The design choice that matters is identity. From the demo: “it runs with your existing single sign-on (OIDC) setup, your existing RBAC rules, and your existing tenancy configuration, if you have one set up. So your CLI users, terminal UI users, and agentic users all get the same control and governance in place”. Kpow’s RBAC documentation shows the effect options a policy can take: allow, deny or stage. A write that a policy stages comes back from the CLI as “Mutation staged for admin approval” instead of being applied. That puts the approval step on the server, where the person or agent running the command cannot switch it off.
The trade-offs are the ones in the scores. It needs a Kpow deployment, it cannot produce or consume messages yet, it has no ACL commands, and offset resets take explicit offsets per partition. For those jobs, the bundled scripts or kcl sit alongside it. The per-job comparisons for resetting consumer group offsets and managing Kafka ACLs go deeper on each.
Product demo · 11 min
Kpow CLI, terminal UI, and agentic skills
Chad Harris previews Kpow's new CLI and terminal UI for Apache Kafka, plus the agentic skills that let an AI assistant query, diagnose, and operate Kafka through Kpow under your own SSO and RBAC.
Kpow live demo
Watch the Kpow CLI and terminal UI
See the fh CLI inspect brokers and topic assignments, switch to JSON output for scripts and agents, and sign in through the same single sign-on as the Kpow web UI.
Built for platform engineers who run Kafka from a terminal.
Watch the demoWhich one to choose
- On any Apache Kafka cluster, for one-off admin with nothing to install beyond Kafka: the bundled scripts.
- For scripts and AI agents on a client-side CLI: kcl, for its JSON contract and its refusal to run destructive commands without a terminal.
- For engineers juggling many clusters, Kubernetes access and Avro or Protobuf data: kafkactl.
- For a quick consume or metadata check: kcat, accepting that it is unmaintained.
- On Confluent Cloud: the Confluent CLI. On Redpanda: rpk. On Amazon MSK, for cluster and topic control: the AWS CLI, with one of the Kafka clients above for groups and data.
- When the people or agents running commands should be governed by the same single sign-on, RBAC and approval rules as your Kafka UI: the Kpow CLI, alongside a message tool until produce and consume arrive.
FAQ
What is the Kafka CLI command to list topics?
bin/kafka-topics.sh --bootstrap-server localhost:9092 --list lists every topic the principal can describe. Add --exclude-internal to hide internal topics such as __consumer_offsets. The equivalents are kafkactl get topics, kcl topic list and fh kafka topic list.
Is there a GUI for Kafka?
Yes. Web UIs such as Kpow, AKHQ and Kafbat UI, and desktop tools such as Offset Explorer, cover the same jobs as the CLI with a browser or desktop interface. The best Kafka management tools compares them, and the top Kafka UI tools for engineering teams scores the wider field on governance and deployment.
What are Kafka tools?
Kafka tools are the programs used to operate a cluster: the command-line scripts that ship with Kafka, third-party CLIs such as kcat, kafkactl and kcl, and UIs and monitoring tools built on the Admin API. The CLI tools are compared on this page.
How do I install the Kafka CLI?
Download an Apache Kafka binary release, extract it, and run the scripts from its bin/ directory. They need a Java runtime, and they only need network access to a broker, not a local Kafka server. Most third-party CLIs install as a single binary through Homebrew or a release download.
How these tools were scored
Each tool is scored 0 to 10 on six criteria. The first five come from the tool’s own documentation or README, read on 22 September 2026. The sixth is this page’s own cost model, set out below.
1. Coverage of the admin job
Coverage means topics, consumer groups and their offsets, ACLs, configs, and producing and consuming test messages, all from one tool. In Chad Harris’s talk on Kafka operational incidents two of the recurring fixes were CLI jobs: making offset resets “a deliberate, manual operation”, and auditing running broker configs because “some environments keep a break-glass option for emergency config changes that never quite makes it back into GitOps”. A CLI that covers only produce and consume leaves you back in bin/ for both.
2. Multi-cluster contexts
A context stores a cluster’s address, credentials and defaults under a name, so switching from staging to production is an explicit act rather than an edited flag. Tools that support contexts make the target visible and the credentials reusable without copying them into every command. The same problem in a web UI is covered by the best tools to manage multiple Kafka clusters.
3. Auth and access control
The CLI has to speak the cluster’s authentication: SASL SCRAM, OAUTHBEARER, mutual TLS or AWS IAM. The harder question is what the person or process at the keyboard is then allowed to do. Factor House’s team has heard it from prospects directly: letting users create and manage topics took CLI and API workarounds, and what they wanted was the same capability with guardrails. The foodservice team solved it by giving only their two solution architects delete access and everyone else scoped, self-service permissions. The best tools for Kafka RBAC compares how each product enforces that kind of split.
4. Scripting and agent safety
Scripts and AI agents need structured output and safe defaults. When Chad Harris demonstrated the Kpow CLI, he pointed at the --output json flag and said “that’s what your agents will use”, and the same logic applies to every tool here. Safe defaults matter as much: a destructive command that previews before it applies, or refuses when nobody is at the terminal, stops an agent that misread its instructions. OWASP names the risk Excessive Agency and advises: “Avoid the use of open-ended extensions where possible (e.g., run a shell command, fetch a URL, etc.) and use extensions with more granular functionality.”
5. Maintenance status
Kafka keeps changing its tooling contract. Kafka 4.0 removed ZooKeeper mode, and Kafka 4.2 renamed a set of tool options for consistency (KIP-1147). Share groups are production-ready in 4.2. A CLI with no commits in years will not know about any of it. Last commit dates are from the GitHub API on 22 September 2026.
6. Annual cost, modelled
An open-source licence costs nothing to hold, which is why the licence column below still matters, and a licence is only one line of what a CLI costs. The figure on each card is this page’s own estimate rather than any vendor’s quote, for one scenario: 100 engineers across three clusters, engineer time at $120 an hour. It adds three lines.
The licence: $0 for the open-source and source-available CLIs, and $13,500 a year for three clusters of Kpow Enterprise at the published $4,500 per cluster with 100 users included.
The tool’s own upkeep, in engineer-hours a month: the glue that turns its output into something a script can read, the work a missing command pushes back into bin/, and what it costs when nobody has committed to the project in years.
The governance a client-side CLI leaves to you, which is 12 engineer-hours a month, or $17,280 a year, for every tool here that holds broker credentials in a local file. That covers one least-privilege principal per engineer per cluster, 300 of them at this size, issued, rotated and revoked, and a record of who ran what, because the CLI keeps none. A consume-only tool carries 5 engineer-hours a month instead, since a read-only principal still has to be issued and there is no change to record.
Two results are worth stating plainly. At six engineers the same sum favours the free tools, because the governance line shrinks with headcount and a licence does not. And a low figure can mean a tool that does less: Zoe’s $17,280 buys searching and reading records, not administration. The score follows the figure mechanically, 10 below $12,500 and one point lower for each $2,500 band above that.
Every option is scored from 0 to 10 on each criterion, from the evidence and sources this page cites, and the reason for each score is on its card. The criteria are weighted: Coverage of the admin job counts once, Multi-cluster contexts counts once, Auth and access control counts three times, Scripting and agent safety counts once, Maintenance status counts once and Annual cost, modelled counts three times, for a total out of 100. Auth and access control and Annual cost count three times here, because a CLI holds cluster credentials on somebody's laptop, and the two questions that outlast the choice are whose credentials those are and what the tool costs a team over a year on this page's cost model. Coverage of the admin job, multi-cluster contexts, scripting and agent safety and maintenance status count once. This page is published by Factor House, which makes Kpow CLI. Every option is scored on the same rubric and the same sources: Kpow CLI's per-criterion scores are set the same way as every other option's and are not adjusted, and the weights apply to every option alike. Kpow CLI ranks first on its total of 80 out of 100. The other options follow by total.