Skip to main content
Glama
Jambozx

OnlineCyberTools MCP (280+ filterable tools)

by Jambozx
OverviewSchemaRelated ServersScoreDiscussions
JavaScript
Remote

security_jwt_generator_validator

Read-onlyIdempotent

Decode, validate HMAC signatures, sign HMAC tokens, and build JWT claim payloads. Supports preset and standard claims, with configurable expiration and audience checks.

Instructions

JWT Decode, Validate, Sign and Claim Builder. Decode, validate (HMAC), HMAC-sign, and assemble JSON Web Tokens (RFC 7519) plus list claim-set presets and standard-claim docs, all from a single operation switch. Unlike encoding_decoding_jwt, which only decodes/inspects, this tool also verifies HMAC signatures (HS256/HS384/HS512), recomputes a signature to mint a token, and builds claim payloads with iss/sub/aud/exp/nbf/iat/jti. Asymmetric algorithms (RS/ES/EdDSA) are decoded but NOT verified or signed server-side. Time is never read from the clock: pass an explicit now (epoch seconds) for exp/nbf/iat comparisons and deltas, so identical input yields identical output. Runs locally via a bundled pure-JS HMAC implementation: read-only, non-destructive, contacts no external service, and is rate-limited (30 requests/minute for anonymous callers). Returns success, the echoed operation, and an operation-specific result object.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
operationYesAction to run. decode: parse a token (no signature check). validate: verify an HMAC signature plus claim validity. signHmac: mint an HMAC-signed token. assembleClaims: build a claim payload. presets: list curated claim-set presets. standardClaims: list RFC 7519 registered-claim docs.
tokenNoCompact JWS string (header.payload.signature). Required for decode and validate; ignored otherwise.
secretNoShared HMAC secret (UTF-8) used by validate to recompute the signature. Required for HMAC validation; ignored otherwise.
nowNoCurrent time in epoch seconds for exp/nbf/iat checks on decode. Omit to compare against epoch 0 (relative-time strings only).
optionsNoClaim-check settings for validate (ignored for other operations).
inputNoOperation payload for assembleClaims (claim fields) or signHmac (token parts).

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
successNoAlways true on a 2xx response.
operationNoThe operation that was executed.
resultNoOperation-specific output. decode: {header,payload,signature,raw,claims,warnings,error}. validate: {valid,errors,header,payload,signatureValid,claimsValid}. signHmac: {token,header,payload}. assembleClaims: {claims,warnings}. presets: {presets[]}. standardClaims: {claims[]}.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed10 schema fields changedv0.5.1
    • addedInput schema / additionalProperties
      Added value: +false
    • addedInput schema / properties / input
      Added value: +{
+  "additionalProperties": true,
+  "description": "Operation payload for assembleClaims (claim fields) or signHmac (token parts).",
+  "properties": {
+    "alg": {
+      "description": "HMAC algorithm for signHmac when no header.alg is given (default HS256). Asymmetric algorithms are rejected server-side.",
+      "enum": [
+        "HS256",
+        "HS384",
+        "HS512"
+      ],
+      "type": "string"
+    },
+    "aud": {
+      "description": "Audience claim (assembleClaims).",
+      "type": "string"
+    },
+    "customClaims": {
+      "description": "Extra claims merged last (assembleClaims); JSON object or JSON object string. Never overrides a standard claim already set.",
+      "type": [
+        "object",
+        "string"
+      ]
+    },
+    "exp": {
+      "description": "Expiry (assembleClaims): treated as seconds-from-iat when 1000000000 or less, else absolute epoch.",
+      "type": [
+        "integer",
+        "string"
+      ]
+    },
+    "header": {
+      "description": "JOSE header for signHmac; alg here wins over the top-level alg. typ defaults to JWT.",
+      "type": "object"
+    },
+    "iat": {
+      "description": "Issued-at (assembleClaims); defaults to now (or epoch 0 if now absent).",
+      "type": [
+        "integer",
+        "string"
+      ]
+    },
+    "iss": {
+      "description": "Issuer claim (assembleClaims).",
+      "type": "string"
+    },
+    "jti": {
+      "description": "Token ID claim (assembleClaims).",
+      "type": "string"
+    },
+    "nbf": {
+      "description": "Not-before (assembleClaims): delta-from-iat when 1000000000 or less, else absolute epoch.",
+      "type": [
+        "integer",
+        "string"
+      ]
+    },
+    "now": {
+      "description": "Current epoch seconds used to resolve iat and exp/nbf deltas (assembleClaims).",
+      "type": "integer"
+    },
+    "payload": {
+      "description": "Claim set object to sign (signHmac). Required for signHmac.",
+      "type": "object"
+    },
+    "secret": {
+      "description": "HMAC secret (UTF-8) for signHmac. Required for signHmac.",
+      "type": "string"
+    },
+    "sub": {
+      "description": "Subject claim (assembleClaims).",
+      "type": "string"
+    }
+  },
+  "type": "object"
+}
    • addedInput schema / properties / now
      Added value: +{
+  "description": "Current time in epoch seconds for exp/nbf/iat checks on decode. Omit to compare against epoch 0 (relative-time strings only).",
+  "type": [
+    "integer",
+    "null"
+  ]
+}
    • addedInput schema / properties / operation / description
      Added value: +"Action to run. decode: parse a token (no signature check). validate: verify an HMAC signature plus claim validity. signHmac: mint an HMAC-signed token. assembleClaims: build a claim payload. presets: list curated claim-set presets. standardClaims: list RFC 7519 registered-claim docs."
    • addedInput schema / properties / operation / enum
      Added value: +[
+  "decode",
+  "validate",
+  "signHmac",
+  "assembleClaims",
+  "presets",
+  "standardClaims"
+]
    • addedInput schema / properties / options
      Added value: +{
+  "additionalProperties": false,
+  "description": "Claim-check settings for validate (ignored for other operations).",
+  "properties": {
+    "expectedAudience": {
+      "description": "If set, aud must equal or contain this.",
+      "type": "string"
+    },
+    "expectedIssuer": {
+      "description": "If set, iss must equal this exactly.",
+      "type": "string"
+    },
+    "leeway": {
+      "default": 0,
+      "description": "Clock-skew tolerance in seconds applied to exp/nbf.",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "now": {
+      "description": "Current time in epoch seconds for exp/nbf/iat checks.",
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}
    • addedInput schema / properties / secret
      Added value: +{
+  "description": "Shared HMAC secret (UTF-8) used by validate to recompute the signature. Required for HMAC validation; ignored otherwise.",
+  "type": "string"
+}
    • addedInput schema / properties / token / description
      Added value: +"Compact JWS string (header.payload.signature). Required for decode and validate; ignored otherwise."
    • changedInput schema / required
      Previous value: -[
-  "operation",
-  "token"
-]New value: +[
+  "operation"
+]
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "operation": {
+      "description": "The operation that was executed.",
+      "type": "string"
+    },
+    "result": {
+      "description": "Operation-specific output. decode: {header,payload,signature,raw,claims,warnings,error}. validate: {valid,errors,header,payload,signatureValid,claimsValid}. signHmac: {token,header,payload}. assembleClaims: {claims,warnings}. presets: {presets[]}. standardClaims: {claims[]}.",
+      "properties": {
+        "claims": {
+          "description": "decode/assembleClaims: the parsed or built claim object (iss/sub/aud/exp/nbf/iat/jti plus a custom map; exp/nbf/iat expand to epoch/iso/relative on decode). standardClaims: an array of registered-claim doc objects.",
+          "type": [
+            "object",
+            "array"
+          ]
+        },
+        "claimsValid": {
+          "description": "True if all non-signature claim checks passed (validate).",
+          "type": "boolean"
+        },
+        "error": {
+          "description": "Always null on success (decode).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "errors": {
+          "description": "Signature and claim failures (validate).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "header": {
+          "description": "Decoded JOSE header (decode/validate/signHmac).",
+          "type": "object"
+        },
+        "payload": {
+          "description": "Decoded or signed claim set (decode/validate/signHmac).",
+          "type": "object"
+        },
+        "presets": {
+          "description": "Curated claim-set presets (presets operation), each with id, name, description, header, payload.",
+          "items": {
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "raw": {
+          "description": "The three base64url segments as received (decode).",
+          "properties": {
+            "header": {
+              "description": "base64url header segment.",
+              "type": "string"
+            },
+            "payload": {
+              "description": "base64url payload segment.",
+              "type": "string"
+            },
+            "signature": {
+              "description": "base64url signature segment.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "signature": {
+          "description": "Raw base64url signature segment (decode).",
+          "type": "string"
+        },
+        "signatureValid": {
+          "description": "HMAC signature result; null for asymmetric algorithms not verified server-side (validate).",
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "token": {
+          "description": "The signed compact JWS (signHmac).",
+          "type": "string"
+        },
+        "valid": {
+          "description": "True only if the signature verified AND no claim errors (validate).",
+          "type": "boolean"
+        },
+        "warnings": {
+          "description": "Advisory notes, e.g. alg none or expired token (decode/assembleClaims).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "success": {
+      "description": "Always true on a 2xx response.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}
  2. First observedv0.1.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond annotations: it discloses local pure-JS implementation, read-only/non-destructive nature, no external service contact, rate limiting (30 req/min), and explicit now parameter for deterministic behavior. Annotations already indicate read-only and idempotent, so the description provides additional detail without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but well-structured with a clear front-loaded purpose statement and logical flow. Every sentence adds value, although it could be slightly more condensed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (six operations, nested parameters, output schema exists), the description covers all necessary aspects: what operations do, when to use, behavioral traits, parameter semantics, and return structure. It is complete enough for an AI agent to understand and select the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds extra meaning beyond the schema, such as explaining that 'now' parameter ensures deterministic output by not reading the clock, and clarifying the behavior of exp/nbf deltas in assembleClaims. This provides enough value to raise the score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as 'JWT Decode, Validate, Sign and Claim Builder' and lists six specific operations. It explicitly differentiates from the sibling tool encoding_decoding_jwt by noting that this tool also verifies HMAC signatures and builds claims, providing a specific verb+resource with sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit guidance on when to use this tool versus the sibling encoding_decoding_jwt, and states limitations for asymmetric algorithms (decoded but not verified/signed server-side). However, it does not provide explicit 'when-not-to-use' or alternatives for asymmetric operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Jambozx/onlinecybertools-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server