APIVerve

JWT Decoder

JWTDecoder

Read-only

JWT Decoder: JWT Decoder decodes JWT tokens to reveal header and payload information, and on paid plans verifies the signature against a public key you supply. It handles JSON web token decode from any language over REST, so you can inspect claims and expiry without adding a JWT library. (Cost: 1 credit)

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "token": "<token>"
    },
    "name": "JWTDecoder"
  }
}

Input Schema

Name	Required	Description	Default
`token`	Yes	JWT token to decode
`publicKey`	No	Public key to verify the signature with: a PEM public key, a PEM X.509 certificate, or a JWK (as a JSON object or string). Asymmetric algorithms only; HMAC secrets are refused and keys are never fetched from URLs. Omit it to decode only.

Output Schema

Name	Required	Description
`data`	No
`error`	No	Error message, null on success
`status`	No	"ok" on success

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 7, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, non-destructive and openWorld, so the safety profile is covered. The description adds real behavioral context on top: signature verification is gated behind a paid plan, the key must be one you supply, and each call costs 1 credit. It does not mention failure modes such as malformed-token handling, but the added plan and cost disclosures are substantive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core decode purpose and followed by the differentiating verification capability and cost. Minor waste from restating 'JWT Decoder' immediately after the title, but no filler otherwise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the description covers both operating modes, the plan gate, and the credit cost. For a two-parameter read-only decoder this is close to complete; only error/edge behavior is unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema itself already spells out accepted key formats, the asymmetric-only restriction, and the 'omit it to decode only' semantics. The description only adds that the key is one 'you supply' and is plan-gated, which is marginal beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('decodes JWT tokens to reveal header and payload information') and adds the verification capability, so an agent knows exactly what it gets back. It does not name a competing sibling (e.g. Base64EncoderDecoder or HashGenerator) to differentiate against, which keeps it out of 5 territory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than stated: 'on paid plans' flags a plan restriction, and the credit cost signals that calls are metered. There is no explicit when-to-use versus alternatives routing and no when-not-to-use guidance, so an agent must infer the selection rules.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All APIVerve tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.