lime-mcp-server-sdk 0.2.0

JWT verification for LIME MCP resource servers

lime-mcp-server-sdk

JWT verification for LIME MCP resource servers (ADR 0081).

Install:

pip install lime-mcp-server-sdk

Quick start

from lime_mcp_server import TokenVerifier

verifier = TokenVerifier()  # defaults: https://lime.pics, aud=mcp
result = verifier.verify(bearer_token)
if result.is_valid:
    agent_uuid = result.agent_id  # alias for claims["sub"]

MCP OAuth JWT identity is claim sub (UUID). There is no separate agent_id claim.

Environment variables

Variable	Default	Description
LIME_BASE_URL	https://lime.pics	LIME origin for OAuth metadata + JWKS
LIME_OAUTH_AUDIENCE	mcp	Expected JWT aud
LIME_JWKS_CACHE_TTL_SECONDS	3600	Metadata + JWKS cache TTL
LIME_JWT_VERIFY_LEEWAY_SECONDS	120	Clock skew leeway
LIME_JWKS_MIN_REFRESH_SECONDS	60	Min interval between forced JWKS refresh

Development

Monorepo workspace: sdk/lime-mcp-server-sdk/ (gitignored). Standalone repo: github.com/Mawyxx/lime-mcp-server-sdk.

cd sdk/lime-mcp-server-sdk
pip install -e ".[dev]"
ruff check src tests
mypy src/lime_mcp_server
pytest --cov=lime_mcp_server --cov-fail-under=100

Live integration (optional):

LIME_MCP_SERVER_INTEGRATION=1 LIME_AGENT_TOKEN=at_... pytest tests/integration/ -v

Publish (standalone repo)

From monorepo workspace (after local QA):

cd sdk/lime-mcp-server-sdk
git push -u origin main
git tag v0.2.0
git push origin v0.2.0

GitHub Actions on tag v* publishes to PyPI. One-time setup:

1. Create project lime-mcp-server-sdk on pypi.org
2. PyPI → Publishing → Add a new pending publisher:
   • Owner: Mawyxx, repo: lime-mcp-server-sdk, workflow: publish.yml, environment: pypi
3. GitHub repo → Settings → Environments → create pypi
4. Push tag: git push origin v0.2.0 (or re-tag and force-push)

Until PyPI is live, install from GitHub:

pip install "lime-mcp-server-sdk @ git+https://github.com/Mawyxx/lime-mcp-server-sdk.git@v0.2.0"

Changelog

0.2.0

• Remove framework adapters (LimeMcpTokenVerifier, [mcp] extra). Core-only wheel.

0.1.0

• Initial release: TokenVerifier, TokenValidationResult, JWKS cache.