jwt-lint
JWT lint: alg none, crit, key-URL headers, expiry, audience (decode only) — Decodes a compact JWT (never verifies the signature) and checks it against RFC 7519 and RFC 8725 for an agent about to trust or forward it: alg none or missing, crit and key-supplying headers (jku, x5u, jwk), kid injection shape, duplicate claims, and exp, nbf, iat against a caller-supplied time, plus optional expected algorithms, issuer and audience. Without asOf the time claims are not judged an
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"token": "<token>"
},
"name": "jwt-lint"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| asOf | No | Reference instant, epoch seconds. Required to judge exp/nbf/iat. | |
| token | Yes | Compact JWS: header.payload.signature. | |
| requireExp | No | Default true: a token without exp fails. | |
| expectedAlgs | No | Allow-list of algorithms; any other alg fails. | |
| leewaySeconds | No | Clock-skew allowance, default 0. | |
| expectedIssuer | No | ||
| expectedAudience | No |