The Token for Someone Else — a remote MCP server checks who a token was issued for — cheat sheet

lab-idp show "$TOKEN"                                   # iss, aud, sub, iat, exp — no key needed
sudo lab-idp mint --audience URL --subject NAME         # a token for one service
curl -i -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' http://127.0.0.1:8931/mcp
sudo inventory-mcp restart                              # settings are read at start
tail -f /var/log/inventory-mcp.log                      # who called, what was refused, and why