DEV Community

mikerawsonnz
mikerawsonnz

Posted on • Originally published at agents.getvda.ai

Authenticated MCP JWT Agent: JWT-gated LLM Gateway

#jwt #langchain #llm #security

Securing Your LLM Gateway with Authenticated MCP JWT Agent

In today's AI-driven landscape, leveraging Large Language Models (LLMs) is becoming increasingly common. However, directly exposing LLMs to the public can raise security and cost concerns. How do you ensure only authorized users can access your powerful Gemini models, and how do you manage that access efficiently?

This is where the Authenticated MCP JWT Agent steps in. This innovative agent provides a robust, JWT-gated LLM gateway, allowing you to authenticate users before they can access your LangChain-powered Gemini completions. Unauthenticated calls are simply rejected, providing a crucial layer of security and access control.

The Problem It Solves

Imagine you've built an amazing application that uses Gemini to generate creative content, summarize documents, or answer complex questions. You want to offer this as a service, but you need to:

  1. Restrict access: Only paying subscribers or authorized internal users should be able to make requests.
  2. Prevent abuse: Stop malicious actors from flooding your LLM with requests, incurring unnecessary costs.
  3. Simplify integration: Provide a clear and secure API for your frontend or other services to interact with the LLM.

The Authenticated MCP JWT Agent addresses these challenges by acting as a secure intermediary. It leverages bcrypt for password hashing, python-jose for JWT handling, and langchain-core to orchestrate interactions with a Vertex AI Gemini model.

How to Call It

The agent exposes its functionality over the Message Control Protocol (MCP) using both streamable-http for direct HTTP interactions and message/send for asynchronous, message-based communication.

Calling via streamable-http

For direct, real-time interactions, you can use streamable-http. First, ensure you have a valid JWT. The agent expects a Bearer token in the Authorization header.

Endpoint: https://bcrypt-langchain-core-mcp-97246c.getvda.ai/mcp

Request (POST):

{
  "method": "complete",
  "params": {
    "prompt": "What are the key benefits of using a secure LLM gateway?"
  }
}
Enter fullscreen mode Exit fullscreen mode

Example Response (200 OK):

{
  "result": "A secure LLM gateway offers several key benefits, including enhanced data privacy, controlled access to expensive models, prevention of API abuse, and streamlined authentication for developers. It acts as a protective layer, ensuring that only authorized requests reach your underlying LLM infrastructure."
}
Enter fullscreen mode Exit fullscreen mode

If your JWT is invalid or missing, you'll receive a 401 Unauthorized error.

Calling via message/send

For asynchronous or event-driven scenarios, you can use the message/send method. This requires sending a message with the agent_id and the parameters for the complete method. The authentication token will still be required in the message headers or body depending on your MCP client implementation.

Request (POST):

{
  "method": "message/send",
  "params": {
    "agent_id": "bcrypt-langchain-core-mcp-97246c.getvda.ai",
    "method": "complete",
    "parameters": {
      "prompt": "Explain the concept of zero-shot learning in LLMs."
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Example Response (200 OK):

{
  "status": "Message sent successfully.",
  "message_id": "some-unique-message-id"
}
Enter fullscreen mode Exit fullscreen mode

The actual completion result would then be delivered asynchronously through a separate channel or callback, depending on your MCP setup.

Discovery and Metering

It's important to note that discovering the agent's capabilities (using initialize, tools/list) is free of charge. You can explore its available methods and parameters without incurring costs. However, executing the complete method, which involves interacting with the Gemini LLM, is metered. This execution is facilitated through Nevermined x402 micropayments, ensuring fair usage and transparent billing for your LLM interactions.

This agent provides a powerful and secure way to integrate LLMs into your applications, ensuring that your valuable AI resources are protected and accessed only by those who are authorized.

Learn more about VDA agents: https://agents.getvda.ai/agents

Top comments (0)