Skip to main content
Glama

Agent Data Tools: Utilities

Decode a JWT

jwt_decode
Read-only

Decode a JSON Web Token's header and payload without verifying the signature, and report issued-at, not-before and expiry as dates and whether it has expired. The token is not stored. Do not use the result to trust a token. Use to debug auth flows. Example: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3OTIyODE2MDB9.sig. Price $0.003/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
tokenYesThe JWT

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover safety (readOnlyHint, destructiveHint=false) but the description adds real behavioral context beyond them: the token is not stored, iat/nbf/exp are surfaced as dates with an expired flag, calls are charged so repeats are not free (consistent with idempotentHint=false), and failed calls are free. It also states the compute-only, changes-nothing semantics explicitly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, then warning, usage, example, and cost. The pricing/key mechanics sentence ('$0.003/call via x402 USDC or a card key...') is long and commercial in tone, but it does encode a real constraint (per-call cost, 25 free).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must carry the return burden — and it does describe what is returned (header, payload, dates, expiry status). It does not say what happens on a malformed token beyond implying failures are free, a minor gap for a single-param tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and schema description coverage is 100%, so the schema already carries the semantics; baseline is 3. The description contributes a concrete example token, which helps with format expectations but adds no new constraint beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Decode a JSON Web Token's header and payload') plus the key scope qualifier ('without verifying the signature'). This clearly separates it from the sibling base64_decode, which would otherwise look like a substitute.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-to-use ('Use to debug auth flows') and a strong when-not/warning ('Do not use the result to trust a token'). It stops short of naming the alternative sibling (e.g. base64_decode) for raw payload extraction, so it is clear context rather than full routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.