Debugging guides

Use public fixtures to test a specific result, then repeat with your own input. Example loaders fill forms; network requests require an explicit tool action.

Read a JWT without trusting it

A decoded token can be forged. Inspecting claims and verifying authenticity are separate steps.

Load the example and inspect its header and payload.
Observe that decoding succeeds even with the deliberately invalid signature.
In your application, verify with a trusted key and allowed algorithm, then enforce issuer, audience, expiry and token purpose (RFC 8725).

Public example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwiaXNzIjoiaHR0cHM6Ly9pZC5leGFtcGxlLmNvbSIsImF1ZCI6ImRlbW8tYXBpIn0.aW52YWxpZA

Expected result: The payload contains sub=demo. The signature is intentionally invalid; decoded output is not an authenticated identity.

Load example in tool

Primary reference

Separate browser CORS from server reachability

A successful proxy call demonstrates server connectivity. It does not prove that a browser origin is permitted.

Use an endpoint you control in the CORS Tester.
Run the browser request and inspect the actual OPTIONS response in browser developer tools.
Compare a proxy request separately. If only the proxy succeeds, fix the endpoint CORS policy for your app origin.

Public example

Origin: https://app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization, content-type

Expected result: For credentialed browser requests, inspect the exact allowed origin and credentials header. A wildcard origin is insufficient with credentials.

Open CORS Tester

Primary reference

Verify the original webhook body

Parsing and reserializing JSON can invalidate an otherwise correct HMAC signature.

Load the signed public fixture into the debugger.
Choose Verify signature, then append a space and verify again.
For Stripe and Slack also check timestamp tolerance. Production handlers need replay controls and server-side verification.

Public example

{"provider":"github","secret":"demo-secret","body":"{\"event\":\"example\"}","signature":"sha256=c5ea8a78bece62e8827a681f3d9aac74ab23d3a77774927524e4335b9f152e57"}

Expected result: The original fixture verifies. Add one space to the body and verification fails. Use only the public demo secret here.

Load example in tool

Primary reference

Choose a protocol version deliberately

A2A 1.0 and current MCP changed both lifecycle and wire formats. A successful HTTP response alone is not interoperability.

Load the card and inspect supportedInterfaces.
Use your own server to exercise SendMessage and streaming artifacts; select 0.3 or legacy explicitly for older servers.
For MCP, use server/discover with 2026-07-28 metadata; older versions use initialize followed by notifications/initialized. The inspector shows the negotiated version.

Public example

{
  "name": "Demo agent",
  "description": "Public fixture; no running server",
  "version": "1.0.0",
  "supportedInterfaces": [
    {
      "url": "https://example.com/a2a",
      "protocolBinding": "JSONRPC",
      "protocolVersion": "1.0"
    }
  ],
  "capabilities": {},
  "defaultInputModes": [
    "text/plain"
  ],
  "defaultOutputModes": [
    "text/plain"
  ],
  "skills": [
    {
      "id": "echo",
      "name": "Echo",
      "description": "Echo text",
      "tags": [
        "demo"
      ]
    }
  ]
}

Expected result: The card advertises an A2A 1.0 JSONRPC interface. Loading a fixture sends no request. example.com is illustrative and has no agent behind it.

Load example in tool

Primary reference

Test evaluated schema rules

An instance passes only when every applicable rule passes. An unknown rule or unresolved reference must not become a success.

Load the schema and instance fixture, then validate.
Change the instance to 10 and validate again.
Change a rule to an unsupported keyword or add a missing local reference; the validator must report the schema problem.

Public example

{
  "schema": {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "oneOf": [
      {
        "type": "string"
      },
      {
        "type": "integer",
        "minimum": 10
      }
    ]
  },
  "instance": 5
}

Expected result: 5 fails oneOf; 10 and a string pass. An unresolved reference reports a schema error, with no validity claim.

Load example in tool

Primary reference