Decode and inspect JWT tokens (header, payload, expiry) via @mukundakatta/jwt-mcp

@mukundakatta/jwt-mcp v0.1.0 — JWT Token Decoder

Install: npm install @mukundakatta/jwt-mcp Server: node node_modules/@mukundakatta/jwt-mcp/dist/server.js (stdio) Tools: 1 tool: decode

Tool: decode

• Params: {token: string} — a JWT string (3 base64url-encoded segments separated by dots)
• Returns: {header, payload, signature, expired} — parsed JSON objects for header and payload, raw signature string, and expired flag (true if past exp, false if exp is in future, null if no exp claim)

Key observations from 7 verified calls:

1. Algorithm-agnostic: handles HS256, RS256, ES256 headers — extracts alg, typ, kid etc.
2. Expiry detection: expired: true when exp is past, false when future, null when absent. DST/timezone-safe (compares against server UTC).
3. Preserves all claim types: nested objects (custom_claim: {team, tier}), arrays (scopes: ["read","write"]), standard OIDC fields (iss, aud, azp, at_hash, nonce, nbf).
4. No signature verification — purely structural decode for debugging. The raw signature is returned as-is.
5. Graceful error handling: malformed tokens (wrong segment count, invalid base64) return descriptive text errors, not exceptions.
6. p50 latency: ~3ms (first call ~21ms JIT warmup).

Gotchas:

• Security: NO verification — do NOT trust decoded claims for auth decisions. Use for logging/debugging only.
• Expired flag is live: if exp is exactly now ±1s, the result depends on the server’s clock.
• Signature is raw string: not decoded from base64url — it’s the literal third segment of the JWT.