lime-mcp-server-sdk

JWT verification for LIME MCP resource servers (ADR 0081).

Install:

pip install lime-mcp-server-sdk

Quick start

from lime_mcp_server import TokenVerifier, McpAccessTokenClaims

verifier = TokenVerifier()  # defaults: https://lime.pics, aud=mcp
result = verifier.verify(bearer_token)
if result.is_valid:
    claims: McpAccessTokenClaims = result.valid_claims  # sub, iss, aud, iat, exp, jti
    agent_uuid = result.agent_id  # alias for claims["sub"]

MCP OAuth JWT identity is claim sub (UUID). There is no separate agent_id claim.

Async verify (FastMCP / ASGI)

result = await verifier.verify_async(bearer_token)

Warmup (ASGI lifespan)

verifier = TokenVerifier()
if not verifier.warmup(raise_on_failure=True):
    raise RuntimeError("JWKS warmup failed")

JwksCache.fetch_count tracks successful metadata+JWKS network fetches (ops/debug).

FastMCP snippet (not shipped in wheel)

from lime_mcp_server import TokenVerifier
from fastmcp import FastMCP

verifier = TokenVerifier()

async def verify_token(bearer: str) -> str | None:
    token = bearer.removeprefix("Bearer ").strip()
    result = await verifier.verify_async(token)
    return result.agent_id if result.is_valid else None

Monorepo reference adapter: scripts/verify/lime_mcp_rs_auth.py.

Environment variables

Variable Default Description
LIME_BASE_URL https://lime.pics LIME origin for OAuth metadata + JWKS
LIME_OAUTH_AUDIENCE mcp Expected JWT aud
LIME_JWKS_CACHE_TTL_SECONDS 3600 Metadata + JWKS cache TTL
LIME_JWT_VERIFY_LEEWAY_SECONDS 120 Clock skew leeway
LIME_JWKS_MIN_REFRESH_SECONDS 60 Min interval between forced JWKS refresh

Development

Monorepo workspace: sdk/lime-mcp-server-sdk/ (gitignored). Standalone repo: github.com/Mawyxx/lime-mcp-server-sdk.

cd sdk/lime-mcp-server-sdk
pip install -e ".[dev]"
ruff check src tests
mypy src/lime_mcp_server
pytest --cov=lime_mcp_server --cov-fail-under=100

Live integration (optional):

LIME_MCP_SERVER_INTEGRATION=1 LIME_AGENT_TOKEN=at_... pytest tests/integration/ -v

Publish (standalone repo)

cd sdk/lime-mcp-server-sdk
git push -u origin main
git tag v0.4.0
git push origin v0.4.0

GitHub Actions on tag v* publishes to PyPI via trusted publishing (publish.yml, environment pypi).

Changelog

0.4.0

  • Breaking: OAuth metadata (GET .../oauth-authorization-server) is raw RFC 8414 JSON — no LIME { ok, data } envelope.
  • Core JWKS still uses LIME envelope; unwrap_lime_data() unchanged for JWKS.

0.3.0

  • McpAccessTokenClaims TypedDict; TokenValidationResult.valid_claims
  • verify_async() for non-blocking RS verify
  • Public TokenVerifier.warmup(); JwksCache.fetch_count observability

0.2.0

  • Remove framework adapters (LimeMcpTokenVerifier, [mcp] extra). Core-only wheel.

0.1.0

  • Initial release: TokenVerifier, TokenValidationResult, JWKS cache.

Project links

Data verified by PyPI on Jun 30, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Mawyxx from gravatar.com Mawyxx

Credits

Author: Mawyxx

GitHub Statistics

Data verified by PyPI on Jun 30, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Provides Extra

dev

Tags

jwt lime mcp oauth resource-server

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

lime_mcp_server_sdk-0.4.0.tar.gz (11.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

lime_mcp_server_sdk-0.4.0-py3-none-any.whl (10.5 kB view details)

Uploaded Python 3

File details

Details for the file lime_mcp_server_sdk-0.4.0.tar.gz.

File metadata

  • Download URL: lime_mcp_server_sdk-0.4.0.tar.gz
  • Upload date:
  • Size: 11.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for lime_mcp_server_sdk-0.4.0.tar.gz
Algorithm Hash digest
SHA256 66a20123b3ed04ea5544b9a1a752239c82533511df256fc6e9d559f2fe2d171d
MD5 2f4a824684819c07cc59ceb0be0cb357
BLAKE2b-256 39c0f16d3f9641e869e89108b40d245b51ca3eeb4dd2d2b8ecc0d3fcf1bb428b

See more details on using hashes here.

Provenance

The following attestation bundles were made for lime_mcp_server_sdk-0.4.0.tar.gz:

Publisher: publish.yml on Mawyxx/lime-mcp-server-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file lime_mcp_server_sdk-0.4.0-py3-none-any.whl.

File metadata

File hashes

Hashes for lime_mcp_server_sdk-0.4.0-py3-none-any.whl
Algorithm Hash digest
SHA256 bc61430361884e083b03b6063cdbf895e90144e253807460085cfb5c2673ff28
MD5 5c7cd2976cedc8b912d0aa92e3f00732
BLAKE2b-256 911ea363268fdf95c88a0fb43ec40edc3aeda72c5e6637553907e3f1d7e0e325

See more details on using hashes here.

Provenance

The following attestation bundles were made for lime_mcp_server_sdk-0.4.0-py3-none-any.whl:

Publisher: publish.yml on Mawyxx/lime-mcp-server-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page