Raziel

io.github.tide-foundationPublished by GitHub account tide-foundationv1.9.34Updated Oct 29, 2026

MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis

The publisher's own server: Raziel Calculators

VerifiedStreamable HTTPWeb executableKnowledge & Memory Developer Tools Security & Monitoring

Server details

Identifier: io.github.tide-foundation/raziel
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account tide-foundation for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.tide-foundation%2Fraziel.svg)](https://sourceweft.com/mcp/io.github.tide-foundation%2Fraziel?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Raziel is the Tide agent pack: an MCP server that gives coding assistants verified playbooks, skills and scenarios for implementing TideCloak auth, E2EE and…

What you can do: Browse and read the pack's content: canon doctrine, playbooks, skills, starter prompts and adapter files
List and read reference-app scenarios, including manifests, role-policy matrices and bootstrap sequences
Match a request to a scenario or recommend the right playbook for a situation
Analyze an existing system for security gaps and run a blast-radius assessment of where authority is concentrated
Get guidance on hosting (local Docker vs hosted Skycloak), DPoP asset setup, onboarding, branding, scaffolding and diagnosing broken logins
Read the gap register of what is still uncertain in the pack
When to use it: Useful when building or securing an app with TideCloak and you want the assistant to follow the vendor's own playbooks instead of improvising auth, encryption or governance code. Also suited to auditing an existing system's security gaps before deciding whether Tide applies.
Requirements: Either a remote endpoint at mcp.tide.org (no install, no Node.js) or the npm package run with npx, which needs Node.js 18+. Self-hosting via Docker is also documented. No TideCloak instance is needed to start; no credentials are declared for the server itself.

Before you install

The server is read-only, but its guidance leads the assistant to write files, run commands and scaffold apps in your project. Setting up a Tide realm involves a licence email and agreeing to Tide's terms, and a realm cannot be moved after bootstrapping. The hosted endpoint records aggregate usage geography; the local npx run collects nothing. Self-hosting can optionally require an API_TOKEN.

Installation

In SourceWeft

Open Raziel in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.tide-foundation%2Fraziel/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "raziel": {
      "type": "http",
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

README

Raziel

Raziel is the Tide MCP — it gives AI coding agents the knowledge to implement TideCloak correctly.

This MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a security gap analysis of your existing system and self-host vs managed-hosting guidance. Instead of guessing, your AI follows verified playbooks.

Quick Start

Claude Code (CLI or VS Code extension)

Run this one command:

Done. Start a conversation and ask your agent to add Tide auth to your app.

Project-level config (any MCP client)

Add a .mcp.json file to your project root:

json

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Works with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Cursor

Open Settings > MCP Servers > Add Server:

Name: tide-pack
Command: npx
Args: -y @tideorg/mcp

Or add to .cursor/mcp.json in your project root.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

Or for local: "command": "npx", "args": ["-y", "@tideorg/mcp"]

Zed

Add to your Zed settings (~/.config/zed/settings.json):

json

{  "context_servers": {    "tide": {      "command": {        "path": "npx",        "args": ["-y", "@tideorg/mcp"]      }    }  }}

{  "context_servers": {    "tide": {      "command": {        "path": "npx",        "args": ["-y", "@tideorg/mcp"]      }    }  }}

Note: Zed uses context_servers (not mcpServers) and doesn't yet support remote URL-based MCP servers — use the npx command.

OpenAI Codex CLI

Add to ~/.codex/config.json:

json

{  "mcpServers": {    "tide": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Note: Codex CLI currently supports stdio-based MCP servers only — use the npx command.

Lovable

Lovable's build agent can use Raziel through a Custom MCP connector (available on all plans). In your Lovable project, open Connectors → Custom MCP (the card at the bottom) and add:

Server name: Raziel
Server URL: https://mcp.tide.org/mcp
Authentication: No authentication

Then tell the agent to use it — e.g. "Use the Raziel connector to pull the TideCloak playbook before writing any auth code."

Two things that trip people up:

You attach it, not the agent. Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the Connectors panel, then point the agent at it — otherwise it will say it "has no way to connect."
It's a build-time connector. It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.

What your AI can do with this

Once connected, your AI assistant can:

Analyze your existing system for security gaps and map each one to what Tide fixes (with an honest "what Tide does NOT fix" list)
Add Tide auth to a new or existing Next.js/React app
Protect API routes with server-side JWT + DPoP verification
Set up role-based access with Tide's IGA governance
Deploy Forseti smart contracts for policy-governed encryption and signing
Bootstrap TideCloak — self-hosted (Docker) or partner-hosted (Skycloak) — to a fully configured realm
Diagnose issues like broken login, missing roles, CORS errors
Follow security invariants that prevent common auth mistakes

Try it

After setup, try these prompts in your AI coding tool:

Do a security analysis of my app and show what Tide would change

Add Tide authentication to my Next.js app

I have an existing app with auth — help me migrate to Tide

Set up encrypted data sharing between users with Tide

Help me create a Forseti contract for multi-admin approval

What's inside

Category	Count	Examples
Canon doctrine	15 files	Security invariants, anti-patterns, security gap mapping, IGA change-request API, hosting options, framework matrix, troubleshooting
Playbooks	18 step-by-step guides	Add auth, protect APIs, verify JWTs, deploy TideCloak, set up E2EE, provision hosted TideCloak
Skills	11 composable roles	Setup, integration, security analysis, route/API protection, review, QA gate
Scenarios	5 reference architectures	Password manager, signing service, encrypted chat, governance panel
Prompts	5 starter prompts	Security gap analysis, secure existing app, migrate auth, admin approval, customer portal

Remote Server (no install required)

We host the MCP server so you don't have to install anything. Just add the URL:

No Node.js required. No npx. Works with any MCP client that supports remote servers.

Self-hosting

Want to run your own instance? Pull from Docker Hub:

Or build from source:

Then point your MCP client at http://localhost:3000/mcp.

Optional: set API_TOKEN environment variable to require Bearer token auth:

Requirements

Remote server: None (just an MCP client that supports remote URLs)
npm/npx install: Node.js 18+
Self-hosted Docker: Docker

No TideCloak instance needed to start — the agent will guide you through setup.

Privacy

The MCP server is read-only. Run locally (npx), it collects nothing — no accounts, no telemetry, no storage. The hosted mcp.tide.org endpoint records aggregate usage geography (approximate location only, never request content or tool arguments) to see where it's used. Full details in PRIVACY.md.

Tools

tide_list

List all available content in the Tide agent pack by category

Parameterscategoryrequired

tide_canon

Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

Parametersnamerequiredpartsection

tide_playbook

Read a step-by-step playbook for a specific Tide task

Parametersnamerequiredpart

tide_skill

Read a composable skill definition

Parametersnamerequiredpartsection

tide_prompt

Read a reusable starter prompt from the pack

Parametersnamerequired

tide_adapter

Read an adapter instruction file (AGENTS, CLAUDE, replit)

Parametersnamerequired

tide_list_scenarios

List all available scenario patterns under reference-apps/

Takes no parameters.

tide_scenario

Read a scenario summary from reference-apps/<scenario>/scenario.md

Parametersnamerequiredpart

tide_scenario_manifest

Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

Parametersnamerequired

tide_scenario_roles

Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

Parametersnamerequired

tide_scenario_bootstrap

Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

Parametersnamerequired

tide_choose_scenario

Match a user request to a known scenario pattern before falling back to generic playbooks

Parameterssituationrequired

tide_choose_playbook

Recommend the right playbook for a given situation

Parameterssituationrequired

tide_security_analysis

Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

Parameterspartinclude_runtime_probes

tide_blast_radius

Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

Parameterspart

tide_hosting

Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.

Parameterspart

tide_dpop_asset

Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.

Takes no parameters.

tide_onboarding

STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

ParametersrealmfieldsappNameframeworktidecloakUrlcomponentPath

tide_branding

BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.

ParametersrealmaccentappNametidecloakUrl

tide_scaffold

START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.

ParametersappDirappNametemplatesituation

tide_doctor

FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.

ParametersrealmappDirappUrlcheckOnly

tide_gaps

Read the gap register — what is still uncertain or unresolved in the pack

Parameterspart

Version history

v1.9.34LatestOct 29, 2026
v1.9.33Oct 20, 2026
v1.9.23Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.

Other Raziel integrations

Raziel Calculators

co.razielOfficial publisher

Raziel Calculators gives an assistant 28 free finance calculators plus guide search and term definitions for venture, startup and fund math.

Streamable HTTPWeb executable

Finance28 toolsNov 1, 2026

Raziel

Overview

Installation

In SourceWeft

Use with an agent

Other MCP clients

README

Raziel

Quick Start

Claude Code (CLI or VS Code extension)

Project-level config (any MCP client)

Claude Desktop

Cursor

Windsurf

Zed

OpenAI Codex CLI

Lovable

What your AI can do with this

Try it

What's inside

Remote Server (no install required)

Self-hosting

Requirements

Privacy

Links

Tools

tide_list

tide_canon

tide_playbook

tide_skill

tide_prompt

tide_adapter

tide_list_scenarios

tide_scenario

tide_scenario_manifest

tide_scenario_roles

tide_scenario_bootstrap

tide_choose_scenario

tide_choose_playbook

tide_security_analysis

tide_blast_radius

tide_hosting

tide_dpop_asset

tide_onboarding

tide_branding

tide_scaffold

tide_doctor

tide_gaps

Version history

Score

Other Raziel integrations

Raziel Calculators