Get a passport JWT from LIME for that MCP host, put it in Authorization: Bearer, and call the server — the RS only checks the passport.
Protected MCP tools succeed with Bearer only; the RS never sees LIME_AGENT_TOKEN.
Pass the MCP URL to LimeAgent.get_mcp_access_token. The SDK mints and caches a short JWT (~300s, aud=mcp) for that hostname.
import asyncio
import os
from lime_agents import LimeAgent
# pip install "lime-agents-sdk>=1.0.0"
TARGET = "https://your-mcp-rs.example/mcp" # or bare host: your-mcp-rs.example
async def main() -> None:
async with LimeAgent(agent_token=os.environ["LIME_AGENT_TOKEN"]) as agent:
# Domain extracted from target; JWT cached per domain (ADR 0081 v11).
mcp = await agent.get_mcp_access_token(TARGET)
print(mcp.access_token)
# Prefer list_tools / call_tool for normal MCP usage:
# tools = await agent.list_tools(TARGET)
asyncio.run(main())Assertaccess_token present; bound to target hostname; TTL ~300s.
Prefer list_tools / call_tool. Send the passport as Bearer — on 401 the SDK refreshes and retries.
AssertTools succeed with Bearer; 401 triggers SDK refresh + retry.
| Scope | Status | Code | When | What to do |
|---|---|---|---|---|
| LIME API | 401 | invalid_client | X-Agent-Token missing or invalid at mint | Mint only from the private agent environment with a valid agent token |
| LIME API | 400 | invalid_request | domain / target URL cannot be normalized to a hostname | Pass a full MCP URL or bare hostname without a port |
| SDK verify | 401 | mcp_jwt_refresh | Cached MCP JWT expired (~300s); SDK refreshes on 401 | Let the SDK refresh, or call get_mcp_access_token again |