Dashboard
LIME

Verify LIME JWTs on your MCP server

Treat the Bearer as a LIME passport: verify it is genuine for your hostname, take agent_id, then use that identity in your tools — nothing else.

  • 15 min
  • Intro

Done when

Protected tools run only with a real hostname-bound MCP JWT and a known agent_id.

  • TokenVerifier accepts aud=mcp for your expected_domain
  • You read agent_id from the verified passport
  • Fake or foreign-host tokens never reach tool logic

Run step 1

You need

  • MCP server with a public hostname
  • Place to read Authorization before tools run
  • lime-mcp-server-sdk >= 1.0.0

Steps

  1. Check the Bearer passport, then use agent_id

    TokenVerifier(expected_domain=your hostname without port). If valid — take agent_id and run the tool. If missing or fake — reject.

    from lime_mcp_server import TokenVerifier

MCP_ACCESS_TOKEN = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

# expected_domain = public hostname THIS server serves (no port).
verifier = TokenVerifier(expected_domain="your-mcp-rs.example")
result = verifier.verify(MCP_ACCESS_TOKEN)
if result.is_valid:
    print(result.agent_id, result.domain)

    AssertTokenVerifier.is_valid; result.agent_id for ACL; aud=mcp, TTL ~300s.

Protocol

You only verify quality — you never see the agent secret

The agent never sends LIME_AGENT_TOKEN here. You only see a short passport JWT. Your RS chooses the HTTP/JSON-RPC error body on failure.

missing/invalid Bearer → your 401 / JSON-RPC auth error

Next boundary

How the agent mints that Bearer passport: Call MCP as agent

Verify

  • Assert: real Bearer for your host → tool runs with agent_id.
  • Negative: JWT minted for another hostname fails TokenVerifier.
  • Negative: missing Authorization → your RS returns auth error.

Wire failures

ScopeStatusCodeWhenWhat to do
Your RS401missing_bearerAuthorization absent or not BearerRequire Bearer MCP JWT before protected tools; map to your transport error
Your RS401invalid_mcp_jwtSignature, aud=mcp, TTL, or domain pin fails in TokenVerifierReject the call; do not run the tool
Your RS403domain_mismatchJWT domain claim ≠ expected_domainAlign agent mint domain with TokenVerifier(expected_domain=…)

Related API

Verify LIME JWTs on your MCP server · LIME