Decode and validate a JWT. Returns header, payload, algorithm, signature presence, and — when a secret is provided — whether an HMAC-SHA256/384/512 signature verifies. Also checks exp/nbf/iat timestamps.
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | The JWT (three dot-separated base64url parts) | |
| secret | No | Shared secret to verify HS256/HS384/HS512 signatures |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral disclosure burden. It does well by listing returned fields, the conditional HMAC verification behavior, and the exp/nbf/iat timestamp checks. It does not cover invalid-token behavior or non-HMAC algorithms, but the major behavioral surface is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The primary purpose is front-loaded, and each clause adds meaningful behavioral detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description appropriately explains what the tool returns. It covers the core outputs and timestamp checks. It could be more complete by addressing malformed tokens or failure behavior, but it is sufficient for correct invocation in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces the token and secret meanings but does not add substantial parameter semantics beyond what the schema already provides. It clarifies that secret is optional and only relevant to HMAC verification, which is mild added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Decode and validate a JWT,' and enumerates what the tool returns. This clearly distinguishes it from siblings like base64_encode and hash_compute, whose purposes are different.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when the tool is useful — for JWT decoding and validation — and explains that providing a secret enables HMAC signature verification. However, it does not explicitly state when to use this tool instead of alternatives or mention any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool targets a distinct operation—encoding, color conversion, parsing, hashing, JWT validation, Markdown rendering, regex testing, SemVer operations, diffing, URL analysis, and UUID generation. The four SemVer tools are related but cleanly separated by action (bump vs compare vs max vs satisfies), and descriptions clarify their boundaries.
Tools overwhelmingly follow an object_verb snake_case convention (base64_encode, csv_parse, regex_test, semver_bump). Semver_max and semver_satisfies deviate slightly from the imperative verb pattern, but the overall naming is predictable and searchable.
At 16 tools, the server is slightly above the ideal 3–15 tool range but each utility earns its place for a general-purpose developer toolbox. No tools feel redundant, and the count remains manageable because the names and domains are highly scannable.
The toolkit covers a solid breadth of common developer utilities: encodings, common formats (JSON, CSV, Markdown), hashing/JWT, regex, SemVer, cron, URL, UUIDs, and diffing. It lacks some fringe converters such as YAML/XML parsing or HTML escape/unescape, but these are minor gaps that agents can work around rather than dead ends.