Mercek — a desktop IDE for Amazon ECS

mercek Watches your services in the background Mercek is a desktop app for working with Amazon ECS. It uses the AWS credentials already on your machine and shows your services across every account and region. It talks to AWS directly and collects no telemetry. Uses your existing ~/.aws profiles. Read-only until you approve a change. Talks to AWS directly. Nothing runs inside your account. ECS Fargate CloudWatch ALB / target groups Application Auto Scaling ECR scans IAM / STS identity Discovery All your clusters in one window Mercek reads the profiles in your ~/.aws config, including SSO, assume-role, and MFA setups. Pick the accounts and regions you want to work with and it lists their clusters, services, and tasks in a single tree. Accounts you don't pick are never read. Works with the AWS credentials you already have Browse several accounts and regions at the same time Discovery runs in parallel and stays responsive on large setups Deployments Track a deploy, roll it back Mercek shows the current rollout state, the deployment circuit breaker, and how many tasks have failed. If a deploy goes wrong, you can roll back to an earlier task definition from the same screen. You can also compare a service to the same one in another environment. Live rollout state and circuit-breaker status Roll back to a previous task definition Compare a service across environments or regions Metrics CPU, memory, and traffic CPU and memory come from Container Insights, with a fallback to AWS/ECS metrics when Insights is turned off. For load-balanced services you also get request count, latency, and 5xx, on the same screen as the service. Pick a window from one hour to seven days, and Mercek marks each deploy on the charts so a shift lines up with the rollout behind it.

Container Insights with an AWS/ECS fallback Request count, latency, and 5xx for ALB services Selectable 1h–7d window, with deploys marked on the charts Right on the service, no console hop Cost & sizing What each service costs, and whether it's right-sized Mercek estimates the monthly Fargate cost of a service from its requested CPU and memory and how many tasks it runs. It compares that against peak usage and tells you whether the service looks over- or under-provisioned. Monthly Fargate cost estimate per service Over- or under-provisioned verdict from peak usage Spot vs on-demand accounted for Inspect Logs, a shell, and task details Open a service to tail its CloudWatch logs in the bottom panel — every task at once or just one — with a text filter, log-level highlighting, and copy or download of what you're looking at. Drop into an interactive shell on a running container when you need one. You can also read a task's full environment, with secrets shown as ARNs instead of values, and its network details: the ENI, IP addresses, security groups, subnet, and VPC. Tail every task at once, filter and highlight by level, copy or download Open an interactive shell on a running container (ECS Exec) Full environment with secrets masked to ARNs ENI, IP addresses, security groups, subnet, and VPC Topology An automatic dependency map Mercek builds a dependency graph from data that's already in AWS.

It maps the path from the internet through your load balancer to each service, and it infers links between services from the environment variables in their task definitions. Internet to target group to service Service links inferred from task-definition env vars Agent panel Connect your own coding agent You can connect a coding agent such as Claude Code through the Agent Client Protocol. It can read your ECS state, explain what it finds, and open screens in the app. It cannot change anything in AWS. If it suggests a change, Mercek shows that change as a diff for you to approve. Read-only to AWS It can describe and correlate your state, but never change it. Opens screens for you Ask it to show a service or task and it navigates there. Suggests, never applies A change becomes a diff plus the matching AWS CLI command. History stays local Chat threads are saved on your machine, not on a server. Sentinel A background watch on your services While Mercek is open, it checks your services in the background and raises an observation when something looks off. You can hand any observation to the agent to look into it. There's nothing to set up. Drift running count below desired Stalled deploys a rollout stuck or failed Flapping tasks restarting over and over OOM kills a container exited with 137 The rest of the day to day Smaller things that keep you out of the AWS console. Local-first Runs on your machine Mercek is a desktop app, not a hosted service. It connects to AWS from your computer with credentials you already have, so there's no extra system that needs access to your account. No server in between Mercek calls AWS from your machine. There's no backend that sees your data. No telemetry It has no analytics and doesn't phone home. It connects to AWS and nothing else. No stored secrets Credentials come from your existing chain. Resolved secrets show as ARNs and aren't written to disk. Get Mercek Mercek runs on macOS, on both Apple Silicon and Intel. Download it, open it, choose the AWS profiles you want, and your clusters show up. Uses the AWS credentials already in your ~/.aws config.

Mercek is open source. View it on GitHub → On the roadmap Scheduled tasks and load-balancer routing in the topology map Sentinel alerts outside the app, to desktop, Slack, or PagerDuty Linux and Windows builds Questions Where do my AWS credentials go? + They stay on your machine. Mercek uses the same ~/.aws profiles and SSO sessions as the AWS CLI. There's no account to create and no server in between, and Mercek doesn't write your credentials or resolved secrets to disk. Can it change my infrastructure? + Only when you ask, and only after you confirm. Reading is automatic. Any write, like scaling, deploying, stopping a task, or updating a service, shows you a diff first and waits for your approval. What does the agent do, and is it safe? + You connect your own coding agent, such as Claude Code. It can read your ECS state, explain it, and open screens in the app. It cannot change anything in AWS. If it suggests a change, that change opens the same diff dialog you'd use by hand, so you decide whether to apply it. Does Mercek phone home? + No. It has no telemetry and no analytics. The only thing it connects to is AWS. Which platforms are supported? + macOS for now. Linux and Windows are planned.