{"slug": "show-hn-secure-bearer-jwt-and-jwks-pattern-for-headless-ai-agents-mcp-824", "title": "Show HN: Secure Bearer JWT and JWKS pattern for headless AI agents (MCP #824)", "summary": "Mawyxx proposed a security pattern for Model Context Protocol (MCP) that uses bearer JSON Web Tokens (JWT) and JSON Web Key Sets (JWKS) to authenticate headless AI agents without exposing a master secret to the LLM path. The pattern mints short-lived RS256 JWTs with an audience of 'mcp' and a domain claim, verified by the MCP server via JWKS, and is gated behind an environment variable. This addresses the threat model where static keys or human OAuth flows are inadequate for agent-to-MCP authentication.", "body_md": "# Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path) #824\n\n[Mawyxx](/Mawyxx)started this conversation in\n\n[Show and tell](/orgs/modelcontextprotocol/discussions/categories/show-and-tell)\n\n## Pre-submission Checklist\n## What would you like to share?## Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path)Headless agents calling MCP tools usually get one of two defaults — both fail a serious threat model:\nThat’s what ## Static key vs human OAuth vs JWKS passport\n## Minimal wire\n\n```\nAgent host:     opaque mint secret (env / secret manager)  →  never sent to MCP\nAgent → LIME:   mint RS256 JWT { aud=mcp, domain=<mcp-host>, TTL≈minutes }\nAgent → MCP:    Authorization: Bearer <jwt>\nMCP RS:         JWKS verify → authorize by sub\n```\n\n Gate behind env (\nIf static keys already match the threat model, ignore. If agent auth is heading into review, this is the pattern that usually survives it. ## Relevant Links\n|", "url": "https://wpnews.pro/news/show-hn-secure-bearer-jwt-and-jwks-pattern-for-headless-ai-agents-mcp-824", "canonical_source": "https://github.com/orgs/modelcontextprotocol/discussions/824", "published_at": "2026-07-31 11:17:59+00:00", "updated_at": "2026-07-31 11:22:10.038443+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure"], "entities": ["Mawyxx", "Model Context Protocol", "JWT", "JWKS", "RS256", "LIME"], "alternates": {"html": "https://wpnews.pro/news/show-hn-secure-bearer-jwt-and-jwks-pattern-for-headless-ai-agents-mcp-824", "markdown": "https://wpnews.pro/news/show-hn-secure-bearer-jwt-and-jwks-pattern-for-headless-ai-agents-mcp-824.md", "text": "https://wpnews.pro/news/show-hn-secure-bearer-jwt-and-jwks-pattern-for-headless-ai-agents-mcp-824.txt", "jsonld": "https://wpnews.pro/news/show-hn-secure-bearer-jwt-and-jwks-pattern-for-headless-ai-agents-mcp-824.jsonld"}}