# decode_jwt

Decode a JWT token into its header, payload, and signature parts. Use this to inspect JWT tokens without verifying signatures. Returns the header (alg, typ) and payload (claims) decoded from base64. Parameters: token — The full JWT token string (3 dot-separated base64 parts).

Agent View of the PolicyLayer registry record for `decode_jwt`. HTML page: https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/decode-jwt

## Facts

- Tool: `decode_jwt`
- Server: X402 Middleware (`@gadgethumans/x402`) — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware.md
- Install: `npx -y @gadgethumans/x402`
- Homepage: https://github.com/scotia1973-bot/gadgethumans-x402
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 1 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `token` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "decode_jwt",
    "arguments": {
      "token": "<token>"
    }
  }
}
```

## Why decode_jwt is rated Low

The tool performs cryptographic decoding and inspection of JWT tokens, which is a read-only operation. It extracts and returns the constituent parts of a JWT (header, payload, signature) without modifying data, executing code, making financial transactions, or destructively deleting anything. The 'without verifying signatures' phrase confirms it performs inspection only, not validation or state changes.

From the tool's own definition: "Tool description states 'Decode a JWT token into its header, payload, and signature parts' and 'inspect JWT tokens without verifying signatures.' These are query/retrieval operations that decode and return data with no side effects."

Risk signals: Handles credentials or secrets (token)

## Use case

AI agents call decode_jwt to retrieve information from X402 Middleware without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches X402 Middleware:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "decode_jwt": {}
  }
}
```

## Other tools on X402 Middleware (57)

- `agent_memory` — Destructive — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/agent-memory.md
- `wallet_buy` — Financial — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/wallet-buy.md
- `x402_payment_request` — Financial — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/x402-payment-request.md
- `x402_pricing` — Financial — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/x402-pricing.md
- `x402_verify_payment` — Financial — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/x402-verify-payment.md
- `analyze_readability` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/analyze-readability.md
- `analyze_url` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/analyze-url.md
- `bmr_calc` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/bmr-calc.md
- `calculate_bmi` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/calculate-bmi.md
- `calculate_date` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/calculate-date.md
- `check_ssl_certificate` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/check-ssl-certificate.md
- `classify` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/classify.md
- `compare_items` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/compare-items.md
- `convert_currency` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/convert-currency.md
- `convert_timestamp` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/convert-timestamp.md
- `convert_timezone` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/convert-timezone.md
- `detect_language` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/detect-language.md
- `dns_lookup` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/dns-lookup.md
- `extract_contacts` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/extract-contacts.md
- `generate_seo_metadata` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/generate-seo-metadata.md
- `generate_uuid` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/generate-uuid.md
- `geocode` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/geocode.md
- `geolocate_ip` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/geolocate-ip.md
- `get_air_quality` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/get-air-quality.md
- `get_crypto_prices` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/get-crypto-prices.md
- `get_forecast` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/get-forecast.md
- `get_og_metadata` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/get-og-metadata.md
- `get_weather` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/get-weather.md
- `grammar` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/grammar.md
- `hash_text` — Read — https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware/hash-text.md
- …and 27 more: https://policylayer.com/tools/com-gadgethumans-swarm-x402-middleware.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-gadgethumans-swarm-x402-middleware · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-gadgethumans-swarm-x402-middleware