JWT Decoder API

What the JWT Decoder API MCP server does

The JWT Decoder API MCP server provides one MCP tool, security_decode_jwt, for reading the contents of a JSON Web Token without validating its signature. It accepts a token string in the standard header.payload.signature format and returns decoded token information for inspection.

The response can include the JWT header, payload, claims, signing algorithm, issue time, expiration time, and an expired-status indicator. A typical result may identify an algorithm such as RS256, return a subject claim, and report whether the exp value has passed.

This is intended for inspection rather than authentication. It can help an agent examine a token before making an API request, investigate an authentication problem, or determine whether a token should be refreshed.

How it works

The JWT Decoder API MCP server is available at a hosted MCP endpoint:

https://jwt-decoder.api.klymax402.com/mcp

An MCP-compatible client sends a tool call containing the JWT as the token argument. The service decodes the token and returns structured header and payload data together with time-related fields when available. Signature verification is explicitly outside the tool's function, so a successful decode does not prove that the token was issued by a trusted signer or that its contents are authentic.

The underlying HTTP operation is also available at /api/decode as a POST request with a JSON body containing token. x402-aware clients handle the payment challenge and retry process for that endpoint.

Setup and configuration

Add the hosted MCP URL to the configuration for an MCP client such as Claude Desktop or Cursor:

{
  "mcpServers": {
    "jwt-decoder": {
      "url": "https://jwt-decoder.api.klymax402.com/mcp"
    }
  }
}

No API key, account signup, or server-local environment variable is specified. Requests are paid per call through x402. The documented payment network is Base L2 (eip155:8453), and the payment asset is USDC. The listed price for security_decode_jwt is $0.003 per call.

Tools and capabilities

security_decode_jwt accepts one required parameter:

• token: the JWT to decode, supplied as header.payload.signature

The tool can expose:

• Decoded header fields
• Decoded payload and claims
• Signature algorithm information
• Issued-at and expiration timestamps when present
• An isExpired result

Limitations and notes

The JWT Decoder API MCP server does not verify signatures. Do not use its output alone to authorize users, validate an issuer, or establish that claims are trustworthy. Decoding also does not replace a complete authentication or token-validation flow.

The service is a focused JWT inspection tool. The README distinguishes it from hashing, Base64 encoding or decoding, and password analysis tools. Its documented interface contains only security_decode_jwt; no additional MCP tools are listed.

Calls require x402 payment handling rather than a conventional API key. A client that cannot process the x402 payment challenge may need an x402-compatible HTTP client or another supported access method before it can complete requests.