# Deterministic JWT Inspector MCP for AI Agents MCP > Deterministic JWT Inspector is an MCP that lets your AI agent decode, analyze, and diagnose JSON Web Tokens (JWTs) securely within its runtime. You can inspect headers, extract user claims, and check token expiration dates without needing secret keys or verifying signatures. It's a crucial diagnostic tool for debugging complex authentication pipelines. ## Overview - **Category:** fort-knox - **Price:** Free - **Tags:** jwt, security-audit, token-inspection, base64-url, authentication-debugging, payload-extraction ## Description Debugging authentication systems is usually messy. You run into tokens that fail mysteriously, or you just need to know what roles an old session had. The problem? Pasting these sensitive JSON Web Tokens into public online decoders like jwt.io creates massive security risks. The Deterministic JWT Inspector fixes this by giving your AI agent a secure way to handle them. It lets the agent algorithmically decode and inspect any token structure directly within its own environment. You can automatically pull out hidden user claims, check if an access token is expired using precise UTC time calculations, or simply see which cryptographic algorithms were used. This MCP handles all that structural analysis without requiring you to upload keys or worry about validation—it's purely for deep debugging. Because Vinkius manages this entire catalog of specialized tools, your agent can connect once and gain diagnostic access across multiple domains. ## Tools ### inspect_jwt Decodes a JSON Web Token (JWT) structure, extracting its header information, payload claims, and calculating metadata like expiration dates without requiring verification keys. ## Prompt Examples **Prompt:** ``` Hey, can you check this JWT for me? I think it might be expired. ``` **Response:** ``` **JWT Diagnostic Report** * **Status:** Expired * **Expiration Time (exp):** 2024-05-15T12:00:00Z * **Issued At (iat):** 2024-05-15T10:00:00Z * **Result:** The token expired on May 15th. You'll need to refresh the session. ``` **Prompt:** ``` What user details can I get from this access token? ``` **Response:** ``` **Payload Extraction Successful** The decoded payload reveals the following claims: * `user_id`: `3492a-b7e1` * `roles`: `['admin', 'billing', 'viewer']` * `department`: `Finance` This confirms the user has admin rights and access to billing data. ``` **Prompt:** ``` What encryption method is this token using? ``` **Response:** ``` **Header Analysis** The token header indicates it was signed using the **RS256** algorithm. This suggests it uses a combination of public and private keys for signing, which is important context for your backend team. ``` ## Capabilities ### Extracting User Claims The MCP decodes the token payload to reveal hidden user details, such as roles, IDs, or session information. ### Diagnosing Expiration Status It compares the token's embedded 'exp' and 'iat' timestamps against the current UTC time, telling your agent if the token is already invalid. ### Analyzing Token Structure The MCP provides a full breakdown of the JWT headers, showing which cryptographic algorithms were used for the token. ### Debugging Authentication Flow Your agent can use this to inspect tokens mid-process, helping pinpoint exactly why an API call is failing due to poor token structure or expiry. ## Use Cases ### Debugging an 'Invalid Token' API Error A backend engineer runs into an API error: 'Token Invalid.' Instead of guessing, they ask their agent to inspect the token. The agent uses `inspect_jwt` and reports that the payload is fine, but the expiration time shows a mismatch with current UTC time. ### Validating User Roles After Logout A security auditor needs to confirm what roles a user held during an old session. They feed the token into the agent; the MCP decodes the payload and reveals the exact list of claims, confirming if 'admin' or 'editor' status was active. ### Checking Token Drift in Staging A DevOps team member needs to audit tokens generated by a new service. They ask the agent to inspect the token; the MCP identifies that while the structure is correct, the 'iat' timestamp shows it was issued days ago and might be subject to clock skew issues. ### Determining Cryptography Used A developer receives a new token format. They use the agent to inspect the header; the MCP immediately tells them that the token is using the 'RS256' algorithm, guiding their next development steps. ## Benefits - Find the root cause of token failures instantly. Using `inspect_jwt` allows your agent to determine if a rejection is due to an expired timestamp or missing claims. - Avoid security risks associated with manual decoding. You never have to paste sensitive tokens into public websites; the analysis happens entirely within your secure AI client environment. - Understand user context quickly. The MCP automatically extracts all payload claims, letting you see roles and session data without needing a database query. - Check token validity programmatically. By calculating `exp` and `iat` timestamps, you can verify if an access token is currently active or already invalid before calling an API. - Support architectural debugging. It provides deep structural analysis of the header section, letting you confirm which cryptographic algorithm was used for a given token. ## How It Works The bottom line is that your AI client gets a structured, secure analysis of any JWT without you needing to manually decode or verify anything. 1. Provide your AI client with the full JWT string you want to examine. 2. The agent invokes this MCP, which securely processes the token and runs diagnostic checks against its internal metadata. 3. Your agent receives a clean JSON report detailing the decoded payload, header algorithms, and precise expiration status. ## Frequently Asked Questions **Can I use Deterministic JWT Inspector to verify if a token signature is valid?** No. This MCP is strictly for inspection and diagnosis, not validation. It lets you see the structure and claims but does not check cryptographic signatures or keys. **Does Deterministic JWT Inspector work on expired tokens too?** Yes, absolutely. You can feed it an expired token, and the agent will use its diagnostic capabilities to pinpoint exactly *when* it expired and why your API call failed. **What kind of data does the Deterministic JWT Inspector MCP extract?** It pulls three main things: the header details (like algorithms used), the payload claims (user roles, IDs, etc.), and precise time metadata like issue and expiration times. **Is it safe to run this tool with real production tokens?** Yes. Because the inspection happens within your AI client's private runtime environment, you avoid sending sensitive credentials to external websites or services. **If my API fails, how does Deterministic JWT Inspector help me debug it?** You can give the agent the token that caused the failure. The MCP will analyze it and tell you if the problem is structural (bad format) or temporal (expired).