Mercek
A Desktop IDE for AWS ECS
Last verified:
What is Mercek?
Mercek is a desktop IDE application designed specifically for working with Amazon ECS (Elastic Container Service). It uses the AWS credentials already configured on your machine (from ~/.aws profiles) and displays your services across every AWS account and region in a single unified interface. The application talks directly to AWS services without running anything inside your account, and it collects no telemetry or analytics data.
Key features include: real-time rollout tracking with rollback capabilities, CPU/memory/traffic metrics from Container Insights with ALB metrics (request count, latency, 5xx errors), monthly Fargate cost estimates per service, automatic dependency topology mapping from internet to service, CloudWatch log tailing with filtering and highlighting, interactive shell access via ECS Exec, background Sentinel monitoring for service issues, and integration with coding agents through Agent Client Protocol. The app also includes a command palette (⌘K), diff-before-write for all changes, target group health monitoring, autoscaling management, and environment comparison tools.
Mercek is designed for developers, DevOps engineers, and anyone who manages Amazon ECS services who wants to avoid constantly switching between AWS console tabs and accounts. It's local-first (runs on your machine, not hosted), supports macOS (Apple Silicon & Intel) and Linux, is open source, and updates itself in place. The application is read-only until you explicitly approve changes, showing a diff before any infrastructure modification.
Mercek pricing
Pricing model: Freemium
Mercek is free and open source. There is no paid tier or subscription mentioned. The application is available for download on macOS (Apple Silicon & Intel) and Linux, with Windows planned for the future. No account creation is required.
Mercek pros
- Uses existing ~/.aws AWS credentials without requiring new account setup
- Shows services across all accounts and regions in one window
- No telemetry or analytics - completely private
- Read-only by default until you approve any change
- Talks directly to AWS with nothing running inside your account
- Live rollout state with circuit-breaker status monitoring
- Roll back to previous task definition from same screen
- Container Insights metrics with AWS/ECS fallback when Insights off
- ALB metrics (request count, latency, 5xx) on same screen as service
- Monthly Fargate cost estimate per service with over/under-provisioned verdict
- Tail CloudWatch logs for every task at once with filter and highlighting
- Interactive shell on running container via ECS Exec
- Full environment view with secrets masked as ARNs
- Automatic dependency topology map from internet to service
- Agent integration through Claude Code via Agent Client Protocol
- Background Sentinel watch raises observations when services look off
- Command palette (⌘K) to open any cluster/service/task from keyboard
- Diff shown before every write operation (scaling, deploys, stops)
- Environment compare to diff service across accounts or regions
- Open source with GitHub repository available
- Self-updating in place when new version ships
- Light and dark themes available
- CSV export and saved table columns supported
Mercek cons
- No Windows build yet (only macOS and Linux supported)
- No signed/notarized macOS builds (shows Gatekeeper warning)
- Sentinel alerts only inside app, no desktop/Slack/PagerDuty notifications yet
- Scheduled tasks not shown in topology map yet
- Load-balancer routing not shown in topology map yet
- Agent cannot change anything in AWS (read-only only)
- Chat history stays local only, not synced to server
- Requires AWS credentials to be pre-configured in ~/.aws
Frequently asked questions about Mercek
Where do my AWS credentials go?
They stay on your machine. Mercek uses the same ~/.aws profiles and SSO sessions as the AWS CLI. There is no account to create and no server in between, and Mercek doesn't write your credentials or resolved secrets to disk.
Can it change my infrastructure?
Only when you ask, and only after you confirm. Reading is automatic. Any write operation like scaling, deploying, stopping a task, or updating a service shows you a diff first and waits for your approval.
What does the agent do, and is it safe?
You connect your own coding agent such as Claude Code. It can read your ECS state, explain it, and open screens in the app. It cannot change anything in AWS. If it suggests a change, that change opens the same diff dialog you'd use by hand, so you decide whether to apply it.
Does Mercek phone home?
No. It has no telemetry and no analytics. The only thing it connects to is AWS.
Which platforms are supported?
macOS (Apple Silicon & Intel) and Linux. Windows is planned for the roadmap.
How does Mercek estimate Fargate costs?
Mercek estimates the monthly Fargate cost of a service from its requested CPU and memory and how many tasks it runs. It compares that against peak usage and tells you whether the service looks over- or under-provisioned. Spot vs on-demand is accounted for.
What does Sentinel monitor in the background?
While Mercek is open, it checks your services in the background and raises an observation when something looks off: drift (running count below desired), stalled deploys (rollout stuck or failed), flapping tasks (restarting over and over), and OOM kills (container exited with 137).
How does the topology map work?
Mercek builds a dependency graph from data that's already in AWS. It maps the path from the internet through your load balancer to each service, and infers links between services from the environment variables in their task definitions.
What metrics are available for services?
CPU and memory come from Container Insights, with a fallback to AWS/ECS metrics when Insights is turned off. For load-balanced services you also get request count, latency, and 5xx. You can pick a window from one hour to seven days, and Mercek marks each deploy on the charts.
How do I log into a container?
You can open an interactive shell on a running container when you need one using ECS Exec. This is available from the Inspect panel where you can also tail CloudWatch logs, view the full environment with secrets masked to ARNs, and see network details including ENI, IP addresses, security groups, subnet, and VPC.