JWT lint: alg none, crit, key-URL headers, expiry, audience (decode only)
Decodes a compact JWT (never verifies the signature) and checks it against RFC 7519 and RFC 8725 for an agent about to trust or forward it: alg none or missing, crit and key-supplying headers (jku, x5u, jwk), kid injection shape, duplicate claims, and exp, nbf, iat against a caller-supplied time, plus optional expected algorithms, issuer and audience. Without asOf the time claims are not judged and the status is unknown, never pass. A pass means no lint rule fired; it does not mean the token is authentic, and encrypted JWE tokens are unsupported.
What you get
Catches the classic alg-none, key-injection and never-expiring token mistakes before the token is relied on.
Call it
Send the JSON body below to https://agents.writerslogic.com/api/v1/jwt-lint. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.
curl -i -X POST https://agents.writerslogic.com/api/v1/jwt-lint \
-H 'content-type: application/json' \
-d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1MSIsImV4cCI6MTgwMDAwMDAwMH0.c2ln","asOf":1700000000,"expectedAlgs":["HS256"]}'
Input
| Field | Type | Required | Description |
|---|---|---|---|
token | string; length 0..8192 | yes | Compact JWS: header.payload.signature. |
asOf | integer; 0..100000000000 | no | Reference instant, epoch seconds. Required to judge exp/nbf/iat. |
leewaySeconds | integer; 0..3600 | no | Clock-skew allowance, default 0. |
expectedAlgs | array<string; length 0..20>; max 10 items | no | Allow-list of algorithms; any other alg fails. |
expectedIssuer | string; length 0..500 | no | |
expectedAudience | string; length 0..500 | no | |
requireExp | boolean | no | Default true: a token without exp fails. |
Example request body
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1MSIsImV4cCI6MTgwMDAwMDAwMH0.c2ln",
"asOf": 1700000000,
"expectedAlgs": [
"HS256"
]
}
Result
The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.
| Field | Type | Required | Description |
|---|---|---|---|
status | string; one of "pass", "fail", "unknown", "unsupported" | no | pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass. |
alg | string | no | |
timeChecked | boolean | no | |
header | any | no | Decoded JOSE header object. |
payload | any | no | Decoded claims set. |
witnesses | array<object> | no | |
versions | object | no | Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile). |
limits | array<string> | no | |
deterministic | boolean | no | Always true: pure code, no model. |
Pay and connect
Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.
Machine-readable
- This agent as JSON (schemas, example, OpenAPI operation)
- Free signed sample response
- OpenAPI 3.1 · Catalog · Index of every agent