mcpField
J
JWT Tools

JWT Tools

Local
basitalisandhu.github.ioSecurity1Updated today
RepositoryVisit website

About JWT Tools

JWT Tools is an MCP server for inspecting, verifying, and signing JSON Web Tokens, intended for developers testing or reviewing tokens. It distinguishes unverified decoding from checks performed with a supplied key.

Key features

  1. 01Decode tokens and flag risky claims
  2. 02Verify HS* and RS* signatures
  3. 03Sign tokens for test fixtures
  4. 04Report claim and signature validity

Use cases

  1. 01Review token claims without verification
  2. 02Check a token using a supplied key
  3. 03Create signed tokens for tests

MCP support

The MCP server exposes tools to decode, verify, and sign JWTs to MCP clients. It uses stdio transport and does not open a port.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "basitalisandhu-mcp-jwt-tools": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/basitalisandhu/mcp-jwt-tools:0.3.0"
      ]
    }
  }
}
Run commanddocker run -i --rm ghcr.io/basitalisandhu/mcp-jwt-tools:0.3.0

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocighcr.io/basitalisandhu/mcp-jwt-tools:0.3.0

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

jwt-tools MCP server

Decodes JSON Web Tokens without verifying them (and says so in the output), flags risky algorithms and claims, verifies HS256/384/512 and RS256/384/512 signatures when you supply the key, and mints tokens for test fixtures. Pure node:crypto; no network, no files.

Part of dev-mcp-servers. Stdio transport only; the server never opens a port.

Tools

ToolInputWhat it returns
decode_jwttoken, now?, max_ttl_hours?Header, payload, ISO timestamps and findings: alg none or missing, empty signature, jku/x5u/jwk in the header, expired, not yet valid, missing exp/iat/aud/iss/sub/jti, lifetime above the threshold (default 24 h), millisecond timestamps, claims named like secrets. Always reports verified: false.
verify_jwttoken, key, algorithm, audience?, issuer?, now?, clock_tolerance_seconds?Signature check for exactly the given algorithm (a token whose header says anything else fails without a cryptographic check, which blocks algorithm confusion), then exp (required), nbf, aud, iss. Returns valid, signature_valid, claims_valid and reasons.
sign_test_jwtpayload, key, algorithm, expires_in_seconds?, now?Signs a claims object for tests. HS* takes a shared secret, RS* a PEM private key.

Install

Claude Code:

claude mcp add jwt-tools -- docker run --rm -i ghcr.io/basitalisandhu/mcp-jwt-tools:0.2.2

Add -s user to make it available in every project. Any client that reads .mcp.json (Claude Code, Claude Desktop, Cursor):

{
  "mcpServers": {
    "jwt-tools": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "ghcr.io/basitalisandhu/mcp-jwt-tools:0.2.2"]
    }
  }
}

Pin the version as shown so that an update cannot change what runs in your editor without you noticing. The package is not on npmjs.com yet, so npx does not work; see the repository README for GitHub Packages npm. From a checkout, use "command": "node", "args": ["<path>/packages/jwt-tools/dist/index.js"] after npm install && npm run build at the repository root.

What it touches

  • Network: None.
  • Local files: None. Keys are used for the one call and not stored.
  • Telemetry: none.

Notes

  • HMAC comparison uses crypto.timingSafeEqual.
  • RS* verification accepts a PEM public key, certificate or private key (the public part is derived).
  • JWE (encrypted, five-part) tokens are rejected; ES* and PS* tokens decode but cannot be verified here.

Build and test

npm install        # at the repository root
npm run build -w @basitalisandhu/mcp-jwt-tools
npm test -w @basitalisandhu/mcp-jwt-tools

Tests use node:test and the SDK's in-memory transport; they do not reach the network.

Licence

MIT. See LICENSE.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.