Verify a token for an MCP tool call

POST

/v1/mcp/verify

curl --request POST \
  --url http://localhost:8693/v1/mcp/verify \
  --header 'Content-Type: application/json' \
  --data '{ "tool_id": "example", "token": "example", "request_body_hash": "example" }'

• Plaintext (dev mode)
• mTLS (production)

Runs the 9-check verification pipeline against the provided token and tool. Used by non-Go MCP servers via the sidecar pattern.

Request Body ^required

Media type application/json

object

tool_id

required

string

token

required

string

request_body_hash

SHA-256 base64url hash of the request body (for inp_hash check)

string

Example ^generated

{
  "tool_id": "example",
  "token": "example",
  "request_body_hash": "example"
}

Responses

200

Verification passed

403

Verification failed

Media type application/json

object

error

required

Error code (RFC 8693 compatible)

string

Allowed values: invalid_request unsupported_grant_type access_denied server_error not_implemented not_found method_not_allowed

error_description

Human-readable error detail

string

Example

{
  "error": "invalid_request"
}