JWT verification middleware for MCP servers built with MCP Fusion. Timing-safe validation with jose, JWKS auto-discovery, and self-healing error responses.

Quick Start

import { initFusion } from '@vinkius-core/mcp-fusion';
import { jwtGuard } from '@vinkius-core/mcp-fusion-jwt';

const f = initFusion<AppContext>();

const withJwt = jwtGuard({
    secret: process.env.JWT_SECRET!,
    algorithms: ['HS256'],
});

export default f.query('billing.invoices')
    .use(withJwt)
    .handle(async (input, ctx) => {
        // ctx.jwt contains the decoded payload
        return db.invoices.findMany({ where: { tenantId: ctx.jwt.sub } });
    });

Features

| Feature | Description | |---------|-------------| | Algorithms | HS256, RS256, ES256 — all standard algorithms via jose | | JWKS | Auto-discovery from /.well-known/jwks.json with key rotation | | Self-Healing | Expired/invalid tokens return actionable hints to the LLM agent | | Timing-Safe | Constant-time signature verification | | Zero Config | Works with Auth0, Clerk, Supabase, Firebase, any OIDC provider |

JWKS Auto-Discovery

const withJwt = jwtGuard({
    jwksUri: 'https://auth.example.com/.well-known/jwks.json',
    issuer: 'https://auth.example.com/',
    audience: 'my-mcp-server',
});

Installation

npm install @vinkius-core/mcp-fusion-jwt jose

Peer Dependencies

| Package | Version | |---------|---------| | @vinkius-core/mcp-fusion | ^2.0.0 | | jose | ^5.0.0 (optional) |

Requirements

• Node.js ≥ 18.0.0
• MCP Fusion ≥ 2.0.0 (peer dependency)

License

Apache-2.0