Cryptography
Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.
Call this tool from your code in three languages.
curl -X POST 'https://api.elysiatools.com/en/api/tools/webauthn-passkey-assertion-decoder-challenge-debugger' \
-H 'Content-Type: application/json' \
-d '{"clientDataJson":"{\"type\":\"webauthn.get\",\"challenge\":\"Y2hhbGxlbmdl\",\"origin\":\"https://example.com\"}","clientDataEncoding":"json","authenticatorData":"a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce19478500000002","signature":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","binaryEncoding":"hex","expectedChallenge":"Y2hhbGxlbmdl","expectedOrigin":"","rpId":"example.com","previousSignCount":1,"cosePublicKey":"","coseEncoding":"base64url"}'Send a POST request with your inputs as JSON. File parameters require a separate upload first.
POST https://api.elysiatools.com/en/api/tools/webauthn-passkey-assertion-decoder-challenge-debugger| Name | Type | Required | Description |
|---|---|---|---|
| clientDataJson | textarea | Yes | — |
| clientDataEncoding | select | No | — |
| authenticatorData | textarea | Yes | — |
| signature | textarea | Yes | — |
| binaryEncoding | select | No | — |
| expectedChallenge | text | No | — |
| expectedOrigin | text | No | — |
| rpId | text | No | — |
| previousSignCount | number | No | — |
| cosePublicKey | textarea | No | — |
| coseEncoding | select | No | — |
JSON result
{
"key": {...},
"metadata": {
"key": "value"
},
"error": "Error message (optional)",
"message": "Notification message (optional)"
}Add this tool to your Model Context Protocol server so AI agents can list and call it.
Add this block to your MCP client configuration:
{
"mcpServers": {
"elysiatools-webauthn-passkey-assertion-decoder-challenge-debugger": {
"name": "webauthn-passkey-assertion-decoder-challenge-debugger",
"description": "Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.",
"baseUrl": "https://api.elysiatools.com/mcp/sse?toolId=webauthn-passkey-assertion-decoder-challenge-debugger",
"command": "",
"args": [],
"env": {},
"isActive": true,
"type": "sse"
}
}
}After connecting to the SSE endpoint, list the exposed tools:
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list"
}Invoke the tool by its id, passing arguments built from its parameters:
{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "webauthn-passkey-assertion-decoder-challenge-debugger",
"arguments": {
"clientDataJson": "{\"type\":\"webauthn.get\",\"challenge\":\"Y2hhbGxlbmdl\",\"origin\":\"https://example.com\"}",
"clientDataEncoding": "json",
"authenticatorData": "a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce19478500000002",
"signature": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"binaryEncoding": "hex",
"expectedChallenge": "Y2hhbGxlbmdl",
"expectedOrigin": "",
"rpId": "example.com",
"previousSignCount": 1,
"cosePublicKey": "",
"coseEncoding": "base64url"
}
}
}Questions or issues? Contact [email protected]