Burs-IA Utils

Decodificar JWT (sin verificar)

jwt-decode

Read-onlyIdempotent

Decodifica cabecera y payload de un JWT SIN verificar la firma (no confiar en los datos). Convierte exp/iat/nbf y, con as_of, indica si expiró. Cuándo: hay que leer, construir o revisar con exactitud una URL, una cabecera HTTP, un token, una versión, un rango de IP, un documento HTML o Markdown o un archivo para agentes. No para: comprobar sin conexión un JWT firmado con HMAC (jwt-verify-hmac). Efectos secundarios: ninguno (solo lectura, sin red, sin estado guardado). Determinista: la misma entrada da la misma salida. Límites: entrada JSON de hasta 64 KB, 1 s por llamada, resultado de hasta 1 MB.

EN: Decodes a JWT header and payload WITHOUT verifying the signature, so the claims must not be trusted. Converts exp/iat/nbf to ISO dates and, given as_of, reports whether the token is expired or not yet valid. When: a URL, HTTP header, token, version string, IP range, HTML or Markdown document or agent-readiness file has to be parsed, built or checked exactly. [EN completo / full EN: inputSchema.description]

Input Schema

Name	Required	Description	Default
`as_of`	No	Reference instant for expiry check (ISO 8601) (string; optional; up to 40 chars).
`token`	Yes	JWT (string; required; up to 16384 chars).

Output Schema

Name	Required	Description	Default
`times`	No
`header`	No
`expired`	No
`payload`	No
`verified`	No
`not_yet_valid`	No
`signature_present`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 2, 2026
- addedInput schema / properties / token / examples
```
Added value: +[
+  "eyJhbGciOiJub25lIn0.eyJleHAiOjE3MDAwMDAwMDB9."
+]
```

Changed1 schema field changedNov 1, 2026

addedInput schema / description

Added value: +"EN: Decodes a JWT header and payload WITHOUT verifying the signature, so the claims must not be trusted. Converts exp/iat/nbf to ISO dates and, given as_of, reports whether the token is expired or not yet valid. When: a URL, HTTP header, token, version string, IP range, HTML or Markdown document or agent-readiness file has to be parsed, built or checked exactly. Not for: checking an HMAC-signed JWT (jwt-verify-hmac). Side effects: none (read-only, no network access, no stored state). Deterministic: the same input gives the same output. Limits: JSON input up to 64 KB, 1 s per call, result up to 1 MB."

First observedNov 1, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds genuinely new behavior: no signature verification, exp/iat/nbf converted to ISO dates, expiry reported only when as_of is supplied, plus hard limits (64 KB input, 1 s per call, 1 MB result) and determinism.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core JWT content is front-loaded and tight, but the text is duplicated wholesale in Spanish and English, then capped with 'EN completo / full EN: inputSchema.description' pointing at content the agent already has. The irrelevant 'Cuándo' list of URLs/IP ranges/HTML documents further dilutes an otherwise compact definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return values, and it covers the essentials: what is decoded, what is not verified, timestamp normalization, expiry logic via as_of, exclusions, and size/time limits. Only the off-target 'Cuándo' clause keeps it from being fully coherent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters (token, as_of) are already documented with types and max lengths, so the baseline applies. The description adds only mild extra meaning by tying as_of to the expired/not-yet-valid outcome; it gives no format hints for as_of beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a precise verb+resource and an explicit scope qualifier: decode a JWT header and payload WITHOUT verifying the signature. It also states the safety consequence (claims must not be trusted), which no sibling tool (jwt-verify-hmac, jwt-sign-hmac) would state, so an agent can differentiate immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The negative guidance is excellent and names the sibling explicitly: 'No para: comprobar sin conexión un JWT firmado con HMAC (jwt-verify-hmac)'. However, the positive 'Cuándo' clause lists URLs, HTTP headers, versions, IP ranges, HTML/Markdown and agent-readiness files — none of which describe JWT decoding. That boilerplate actively muddies the routing decision for this specific tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Burs-IA Utils tools Inspect

Try in Browser

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?