Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path)

[Mawyxx]

Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path)

Headless agents calling MCP tools usually get one of two defaults — both fail a serious threat model:

• Static API key in the agent env — prompt-injection / log leak ⇒ shared blast radius across the fleet.
• Human OAuth — no browser, no consent click; teams then ship a service-user hack or leave auth off.

Fix shape: agent mints a short-lived RS256 JWT bound to this MCP hostname → Authorization: Bearer → resource server verifies locally via JWKS (aud / exp / domain) → authorize by sub. Long-lived mint credential stays on the agent host and never hits the RS.

That’s what LIME implements as a machine-only AS: issue the JWT, publish JWKS, keep verify on your side (in-process crypto after JWKS cache; no LIME RTT on the tool hot path).

Static key vs human OAuth vs JWKS passport

	Static key	Human OAuth	LIME (JWKS passport)
Injection / exfil	Master secret in LLM path → fleet burns	Wrong protocol for machines	Wire = short JWT; tools never see the mint secret
Headless	Works (trap)	Breaks on consent	Mint → Bearer → tool
Verify latency	strcmp or fragile introspect	Agent never reaches tools	Local JWKS after cache → no IdP RTT on verify
Identity	Shared secret, no stable agent sub	Human subject — not the agent	sub = agent id; aud + domain + exp on every call

Minimal wire

Agent host:     opaque mint secret (env / secret manager)  →  never sent to MCP
Agent → LIME:   mint RS256 JWT { aud=mcp, domain=<mcp-host>, TTL≈minutes }
Agent → MCP:    Authorization: Bearer <jwt>
MCP RS:         JWKS verify → authorize by sub

Gate behind env (off for local demos, on for prod). First JWKS fetch is network; warm-cache verify is local.

• JWKS: https://lime.pics/api/v1/core/.well-known/jwks.json
• AS metadata: https://lime.pics/.well-known/oauth-authorization-server
• RS SDK: https://github.com/Mawyxx/lime-mcp-server-sdk (TokenVerifier, expected_domain)

If static keys already match the threat model, ignore. If agent auth is heading into review, this is the pattern that usually survives it.

— https://lime.pics