Show HN: Secure Bearer JWT and JWKS pattern for headless AI agents (MCP #824)

Mawyxx proposed a security pattern for Model Context Protocol (MCP) that uses bearer JSON Web Tokens (JWT) and JSON Web Key Sets (JWKS) to authenticate headless AI agents without exposing a master secret to the LLM path. The pattern mints short-lived RS256 JWTs with an audience of 'mcp' and a domain claim, verified by the MCP server via JWKS, and is gated behind an environment variable. This addresses the threat model where static keys or human OAuth flows are inadequate for agent-to-MCP authentication.

Security: Bearer JWT + JWKS for agent callers no master secret in the LLM path 824 Mawyxx /Mawyxx started this conversation in Show and tell /orgs/modelcontextprotocol/discussions/categories/show-and-tell Pre-submission Checklist What would you like to share? Security: Bearer JWT + JWKS for agent callers no master secret in the LLM path Headless agents calling MCP tools usually get one of two defaults — both fail a serious threat model: That’s what Static key vs human OAuth vs JWKS passport Minimal wire Agent host: opaque mint secret env / secret manager → never sent to MCP Agent → LIME: mint RS256 JWT { aud=mcp, domain=<mcp-host , TTL≈minutes } Agent → MCP: Authorization: Bearer <jwt MCP RS: JWKS verify → authorize by sub Gate behind env If static keys already match the threat model, ignore. If agent auth is heading into review, this is the pattern that usually survives it. Relevant Links |