license

Documentation

Overview

Package license provides JWT license key parsing, validation, and tier enforcement for the MCP Zero-Trust Proxy. License keys are ECDSA P-256 signed JWTs that encode tier, resource limits, and expiry. The proxy enforces limits locally with zero network calls — all information is embedded in the signed token.

Index

• func PublicKeyFromPEM(pemData []byte) (*ecdsa.PublicKey, error)
• func SignJWT(priv *ecdsa.PrivateKey, sigInput string) (string, error)
• func Validate(lic *License) error
• type License
  • func FreeTierLicense() *License
  • func Parse(keyString string, publicKey *ecdsa.PublicKey) (*License, error)
  • func ParseEmbedded(keyString string) (*License, error)
• type Tier

Functions

func PublicKeyFromPEM

func PublicKeyFromPEM(pemData []byte) (*ecdsa.PublicKey, error)

PublicKeyFromPEM parses a PEM-encoded ECDSA P-256 public key. The PEM block must be of type "PUBLIC KEY" in PKIX/SubjectPublicKeyInfo format.

func SignJWT

func SignJWT(priv *ecdsa.PrivateKey, sigInput string) (string, error)

SignJWT signs the sigInput string (header.payload) with the private key and returns the base64url-encoded DER-encoded ASN.1 ECDSA signature.

This is exported for use in tests only. In production, license keys are generated offline and distributed to customers.

func Validate

func Validate(lic *License) error

Validate checks that the license has not expired. Returns an error if ExpiresAt is non-zero and in the past. A zero ExpiresAt (free tier) is always valid.

Types

type License

type License struct {
	// Tier is the subscription tier (free, pro, enterprise).
	Tier Tier
	// MaxUpstreams is the maximum number of upstream MCP servers allowed.
	// 0 means unlimited (Enterprise tier).
	MaxUpstreams int
	// MaxRPM is the maximum requests per minute allowed.
	// 0 means unlimited (Enterprise tier).
	MaxRPM int
	// ExpiresAt is when the license expires. Zero value means no expiry (free tier).
	ExpiresAt time.Time
	// Subject is the license holder's identifier (typically customer email).
	Subject string
}

License holds the decoded, validated claims from a license JWT.

func FreeTierLicense

func FreeTierLicense() *License

FreeTierLicense returns a License with free tier defaults. Free tier: 1 upstream, 10 req/min, no file audit, no expiry.

func Parse

func Parse(keyString string, publicKey *ecdsa.PublicKey) (*License, error)

Parse decodes and validates a license key string using the provided public key.

An empty keyString returns a free-tier License with no error.

A non-empty keyString must be a valid ECDSA P-256 signed JWT with:

• alg: ES256
• iss: "mcpzerotrust.dev"
• exp: a future Unix timestamp

Errors are returned for: malformed tokens, invalid signatures, wrong issuer, and expired tokens.

func ParseEmbedded

func ParseEmbedded(keyString string) (*License, error)

ParseEmbedded parses the license key using the public key embedded in the binary. This is the function called by main.go — it requires no external key material. An empty keyString returns a free-tier License with no error.

type Tier

type Tier string

Tier represents a subscription tier that controls feature limits.

const (
	// TierFree is the default tier with no license key.
	// Limits: 1 upstream server, 10 req/min, audit output = stdout only.
	TierFree Tier = "free"
	// TierPro is the paid tier ($49/mo).
	// Limits: 5 upstream servers, up to 200 req/min, audit file output enabled.
	TierPro Tier = "pro"
	// TierEnterprise is the unlimited tier ($199/mo).
	// Limits: no upstream cap, no rate cap, all features enabled.
	TierEnterprise Tier = "enterprise"
)