# Deterministic JWT Inspector MCP for AI Agents AI Agent Connect > Deterministic JWT Inspector. Decode and inspect JSON Web Tokens (JWTs) directly within your AI client. It pulls headers, payloads, and expiry metadata without needing private keys. Stop copy-pasting sensitive tokens into public websites and keep your auth data secure. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_RsYg5zWS4FmqwKKg6ipnjA8RXRYXPnnOtriCNwkH/ai-agent-connect - **Tags:** jwt, security-audit, token-inspection, base64-url, authentication-debugging, payload-extraction ## Description Debugging authentication pipelines is a mess when you have to keep moving between your code and a browser tab. Most developers end up pasting sensitive JSON Web Tokens into public websites just to see what's inside, which is a huge security risk. This Connector changes that by letting your AI agent handle the decoding work locally. It pulls out user claims, roles, and session data so you can ask questions about the token's contents without ever leaving your workspace. It's a big part of why the Vinkius catalog is so useful for security-minded devs who need to move fast without breaking protocols. You get immediate answers on whether a token is expired or what specific permissions it's carrying, all while keeping that data inside your secure environment. It doesn't care about your private RSA keys, so it works for any architectural debugging task you have on your plate. ## Tools ### inspect_jwt Decodes a JWT to show its header and payload. It also calculates if the token is currently expired. ## Prompt Examples **Prompt:** ``` Check if this token is expired: eyJ... ``` **Response:** ``` I've inspected the token. It is currently expired. It was valid until 2024-12-01. ``` **Prompt:** ``` What roles does this user have? ``` **Response:** ``` The payload shows the user has the following roles: * **editor** * **billing_admin** ``` **Prompt:** ``` What's the header info? ``` **Response:** ``` The header indicates the token uses the **RS256** algorithm. ``` ## Capabilities ### Decode Base64Url segments Turn encoded strings into readable JSON claims instantly. ### Extract user roles Identify specific permissions hidden inside the token payload. ### Calculate expiry dates Get a clear is this expired status based on current UTC time. ### Inspect token headers See the encryption algorithms and metadata used by the issuer. ### Run in local runtime Execute all decoding logic without sending data to third-party APIs. ## Use Cases ### Debugging 403 Forbidden errors A developer asks the agent why a user can't access a page. The agent uses inspect_jwt to find that the 'admin' role is missing from the token payload. ### Verifying token expiration An engineer is unsure why an API request is failing. They ask the agent to check the token, which reveals it expired two minutes ago. ### Audit header algorithms A security researcher wants to see what encryption is being used. The agent pulls the header data to confirm the use of RS256. ### Rapid claim extraction A dev needs to know exactly what data is in a production token. The agent instantly lists all user claims without needing any keys. ## Benefits - Keep sensitive auth data private by decoding tokens locally instead of pasting them into public websites. - Get immediate confirmation on token expiration by having the agent check exp and iat timestamps automatically. - Speed up debugging by letting your AI client extract specific user roles or claims from complex payloads. - Simplify frontend and backend analysis since the tool doesn't require RSA keys or complex cryptographic setup. - Reduce context switching by keeping all your token inspection work inside your primary AI workspace. ## How It Works The bottom line is you get instant, secure token insights without ever exposing your data to a public website. 1. Provide a raw JWT string to your AI agent. 2. The agent uses the inspector to break down the Base64Url segments. 3. You get a structured list of claims, headers, and a clear expiry status. ## Frequently Asked Questions **Can I use Deterministic JWT Inspector to see my user roles?** Yes, it extracts all claims from the payload so you can see roles immediately. **Is it safe to use Deterministic JWT Inspector with production tokens?** It's much safer than public sites because it stays in your local environment. **Does Deterministic JWT Inspector need my private keys?** No, it only decodes the data, so you don't need any keys to see the payload. **How does Deterministic JWT Inspector handle expired tokens?** It calculates the expiry based on the current time and tells you if it's dead. **Can Deterministic JWT Inspector decode different types of tokens?** It works on any standard JSON Web Token regardless of the encryption used. **Does this tool verify the JWT signature for authentication?** No. The JWT Inspector is strictly a structural diagnostic tool. It bypasses signature verification to allow the AI to inspect payloads and headers during development and debugging workflows. It should not be used as a backend authentication gate. **Is it secure to decode tokens this way?** Extremely secure. Instead of pasting your token into a third-party website, the decoding happens entirely within the deterministic V8 engine of your local agent runtime, ensuring zero data leakage. **Can it tell me if a token has expired?** Yes. The engine automatically parses the `exp` (expiration) and `iat` (issued at) claims, converting them from UNIX timestamps into human-readable ISO dates and returning a boolean flag indicating if it is expired.