Skip to main content
emisar

OIDC and JWKS diagnostics

v0.1.7

Generic read-only OpenID Connect discovery and JWKS diagnostics, plus local key-ID comparison and protected JWT-header inspection. Network actions use explicit HTTPS URLs, never follow redirects, and never submit bearer tokens.

5 allowed by default
Pack ID
oidc-jwks
Vendor
emisar
OS
linux
Actions
5
Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.
bash curl jq base64

Use this pack with your agent

New to emisar? Start with the quickstart to connect one Linux host and verify an action. With a runner connected, review this pack's actions and host requirements, then follow installing and verifying a published pack. Your policy decides which actions run, wait for approval, or are denied.

Connect a CLI agent, Claude.ai or ChatGPT to discover the installed actions through the same infrastructure MCP.

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host 
sudo emisar pack install oidc-jwks --hash sha256:dc825bb1cae1b9b55718596bac865e703d25e155d96fcd71bec191cb36452280

Setup

Discovery and JWKS documents are public metadata. The runner needs outbound HTTPS access to the exact issuer or JWKS host supplied to an action.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • OIDC_CA_CERT

    Optional PEM CA bundle for a private issuer.

Notes

  • OIDC_CA_CERT must be allowlisted in execution.inherit_env when set.
  • Explicit HTTPS URLs can still name private or loopback services; restrict destinations with runner policy and network egress controls when agents must not reach them.
  • Network actions do not follow redirects or automatically fetch a secondary URL. Validate discovery first, then call oidc.jwks with the returned jwks_uri explicitly.
  • oidc.jwt_header decodes metadata only. It does not verify the signature, issuer, audience, expiry, or any other claim.

Verify it works

Runs oidc.validate_discovery, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify oidc-jwks

Install and configure a pack walks through the whole sequence on a host.

Actions 5 total

View on GitHub
  • oidc.compare_key_ids script low Low: read-only or trivially reversible

    Compare authoritative and consumer key IDs

    Compare two bounded JSON arrays of public key IDs and report exact counts of shared, missing, and extra IDs plus capped, clipped samples of the missing and extra ones. Inputs are sorted and deduplicated before comparison.

    Arguments
    Name Type Required
    authoritative_key_ids_json string Yes
    consumer_key_ids_json string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • oidc.discovery script low Low: read-only or trivially reversible

    Fetch OIDC discovery metadata

    Fetch and return the public OpenID Provider Configuration for one exact HTTPS issuer. Redirects are rejected and advertised URLs are not followed.

    Arguments
    Name Type Required
    issuer string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • oidc.jwks script low Low: read-only or trivially reversible

    Fetch a public JWKS

    Fetch and validate one explicit public JWKS. The action rejects redirects, oversized key sets, malformed keys, and private or symmetric key material.

    Arguments
    Name Type Required
    jwks_uri string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • oidc.jwt_header script low Low: read-only or trivially reversible

    Decode a protected JWT header

    Decode and project recognized fields from a compact JWS or JWE protected header. The payload and claims are never decoded, and no signature or claim validation is performed. Recognized fields are byte-bounded; a header whose field exceeds its bound or carries control characters is rejected.

    Arguments
    Name Type Required
    jwt string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
  • oidc.validate_discovery script low Low: read-only or trivially reversible

    Validate OIDC discovery metadata

    Require an exact issuer match and an accepted HTTPS jwks_uri in one discovery document. This action does not fetch the advertised JWKS.

    Arguments
    Name Type Required
    issuer string Yes

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
← Back to registry
Pack reference  Publish your own