secure-token-handling
Installation
SKILL.md
Secure Token Handling for MCP Servers
Security Requirement
MCP servers MUST implement best practices for token validation and secure token storage to prevent token-based attacks.
Token Validation Requirements
Every incoming token MUST be validated for:
| Check | Details |
|---|---|
| Signature | Verify JWT signature against the IdP's JWKS; reject unsigned or weakly signed tokens |
Expiry (exp) |
Reject expired tokens; do not allow clock skew greater than 30 seconds |
Audience (aud) |
Must match the MCP server's audience identifier |
Issuer (iss) |
Must match the trusted IdP issuer URL |
Not-before (nbf) |
If present, reject tokens used before this time |
Token ID (jti) |
Check against revocation list if token revocation is supported |