Skip to main content
Glama

JWT decode: decode a JWT token's header and payload and check its expiry

jwt_decode
Read-only

Decode a JSON Web Token's header and payload without verifying the signature, and report issued-at, not-before and expiry as dates and whether it has expired. The token is not stored. Do not use the result to trust a token. Use to debug auth flows. Example: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3OTIyODE2MDB9.sig. Price $0.01/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

Input Schema

NameRequiredDescriptionDefault
tokenYesThe JWT

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added
  2. Removed
  3. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond annotations: no signature verification, the token is not stored, results must not be used for trust decisions, and per-call billing explains why repeats are not free (consistent with idempotentHint=false). The sentence 'Reads or computes only and changes nothing' duplicates readOnlyHint/destructiveHint rather than adding value, and error behavior on malformed tokens is unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the operation and its outputs, then stacks cautions, example, and pricing in a sensible order. The pricing/credits sentence is long and partly boilerplate, though it does justify the non-idempotent charge behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by describing decoded header/payload plus date-normalized claims and an expiry verdict. Missing only failure behavior (malformed or non-JWT input) and whether the output is structured or stringified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single required parameter with 100% schema coverage, so the schema baseline applies; the description only adds a worked example token, which helps confirm the expected compact-serialization format but no other semantics. Baseline 3 is right.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: 'Decode a JSON Web Token's header and payload without verifying the signature', and it enumerates the outputs (iat/nbf/exp as dates, expired flag). This clearly separates it from generic siblings like base64_decode and json_format.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('Use to debug auth flows') and a strong when-not warning ('Do not use the result to trust a token'). It does not name a sibling alternative, but no JWT verification tool exists among the siblings, so the routing gap is small.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.