enterprise-auth-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| decode_jwtA | JWT-Token dekodieren (ohne Signaturvalidierung). Gibt Header, Payload und Metadaten zurueck. Nuetzlich fuer schnelle Inspektion von Token-Inhalten. |
| validate_jwtA | JWT-Token validieren — Signatur, Ablauf und Claims pruefen. secret: HMAC-Secret oder leer fuer keine Signaturpruefung. algorithms: kommagetrennte Liste, z.B. 'HS256,RS256'. audience: erwartete Audience (optional). issuer: erwarteter Issuer (optional). |
| check_permissionsA | Prueft ob ein JWT-Token die benoetigten Scopes und Rollen besitzt. required_scopes: kommagetrennte Liste, z.B. 'read:users,write:data'. required_roles: kommagetrennte Liste, z.B. 'admin,manager'. |
| get_user_rolesA | Extrahiert Benutzerrollen und Identitaetsinformationen aus einem JWT. Unterstuetzt Standard-Claims und Keycloak realm_access/resource_access. |
| oauth_introspectB | OAuth 2.0 Token-Introspection (RFC 7662). introspection_url: Endpoint des Authorization Servers (optional). Ohne URL: lokale JWT-Dekodierung als Fallback. |
| verify_oidc_claimsA | OIDC-spezifische Claims validieren (OpenID Connect Core 1.0). Prueft: iss, sub, aud, exp, iat, nonce. Erkennt fehlende Pflicht-Claims und Audience/Issuer-Mismatches. |
| list_token_scopesA | Listet alle Scopes, Rollen und Berechtigungen aus einem JWT-Token auf. Erkennt automatisch den Identity Provider (Azure AD, Okta, Auth0, Keycloak). |
| get_oidc_discoveryA | OIDC Discovery Dokument abrufen (/.well-known/openid-configuration). Gibt alle wichtigen Endpoints (authorization, token, userinfo, jwks_uri) zurueck. Beispiel issuer_url: https://accounts.google.com oder https://login.microsoftonline.com/tenant-id |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose: decoding, validating, checking permissions, extracting roles, listing scopes, OIDC discovery, token introspection, and OIDC claims verification. Despite some thematic overlap, the descriptions ensure no ambiguity.
All tool names follow a consistent verb_noun pattern using snake_case (e.g., check_permissions, decode_jwt, get_oidc_discovery). No mixing of conventions or irregular naming.
8 tools is well-scoped for an enterprise auth server. Each tool covers a distinct authentication or authorization operation without unnecessary duplication or gaps.
The set covers core JWT operations, OIDC discovery, token introspection, and permission checking. Minor gaps like userinfo endpoint retrieval or token refresh are not critical for the server's stated purpose, so the surface is reasonably complete.