Skip to main content
Glama

jwt decode

jwt_decode
Read-only

Decode and check a JWT: header, claims, issued / expiry / not-before times with seconds left, audience and issuer checks, alg=none detection, and signature verification with an HS256/384/512 secret or a JWKS URL (RS, PS, ES algorithms). Costs $0.002 USDC per call (x402).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
tokenYes
issuerNo
secretNo
audienceNo
jwks_urlNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true and openWorldHint=true; the description adds genuinely new behavior: alg=none detection, HMAC vs RS/PS/ES algorithm coverage, that issuer/audience are actively checked, and a per-call cost of $0.002 USDC via x402. That pricing/auth-model disclosure is exactly the kind of context structured fields do not carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence that front-loads the core action (decode and check) then layers the checks and verification modes, closing with the cost. Every clause adds information, though the list is long enough that it reads more like an enumeration than crisp prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters, no output schema, and no schema descriptions, the description covers what an agent needs: what gets decoded, what gets verified, which algorithms each credential type enables, and the price. Return contents are summarized since there is no output schema, though exact response shape remains unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter burden, and it largely does: it maps secret to HS256/384/512 verification, jwks_url to RS/PS/ES verification, and issuer/audience to validation checks. It does not specify token format expectations or the exact semantics of issuer/audience matching (string vs list), leaving a small gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource (decode and check a JWT) and enumerates exactly what is computed: header, claims, time claims with seconds left, audience/issuer checks, alg=none detection, and signature verification. It is clearly distinguishable from siblings like abi_decode, tx_decode_raw, and sign_verify without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (you need to inspect/validate a JWT and optionally verify its signature), but it never states when to prefer this over alternatives such as sign_verify, tx_decode_raw, or rpc, nor any exclusion conditions. The cost note gives practical context but not selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources