Raziel

io.github.tide-foundation由 GitHub 账号 tide-foundation 发布v1.9.34更新于 Oct 29, 2026

MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis

发布方自己的服务：Raziel Calculators

已验证Streamable HTTP可网页运行知识与记忆开发者工具安全与监控

服务详情

标识符: io.github.tide-foundation/raziel
传输: Streamable HTTP
运行时: Web executable
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 tide-foundation。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.tide-foundation%2Fraziel.svg)](https://sourceweft.com/mcp/io.github.tide-foundation%2Fraziel?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

Raziel 是 Tide 智能体包：一个 MCP 服务器，为编码助手提供经核实的操作手册、技能与场景，用于实现 TideCloak 认证、端到端加密与 IGA。

可以做什么: 浏览并读取包内内容：规范教义、操作手册、技能、起始提示词与适配器文件
列出并读取参考应用场景，包括清单、角色策略矩阵与引导序列
将需求匹配到已知场景，或为具体情境推荐合适的操作手册
分析现有系统的安全缺口，并评估权限集中于单点的爆炸半径
获取托管方式（本地 Docker 或托管 Skycloak）、DPoP 资源、用户引导、品牌化、脚手架与登录故障诊断的指导
读取记录包内仍不确定事项的缺口清单
适用场景: 在使用 TideCloak 构建或加固应用时，希望助手遵循厂商提供的操作手册，而不是自行猜测认证、加密或治理代码。也适合在决定是否采用 Tide 之前，审计现有系统的安全缺口。
运行要求: 可使用 mcp.tide.org 远程端点（无需安装、无需 Node.js），或通过 npx 运行 npm 包，需要 Node.js 18+。也支持用 Docker 自托管。开始使用无需已有 TideCloak 实例；服务器本身未声明任何凭据。

安装前请注意

服务器本身只读，但其指导会让助手在你的项目中写入文件、执行命令并生成应用。设置 Tide 域需要许可证邮箱并同意 Tide 条款，且域在引导后无法迁移。托管端点会记录汇总的使用地域；本地 npx 运行不收集任何数据。自托管时可选用 API_TOKEN 要求鉴权。

安装

在 SourceWeft 中

打开控制台中的 Raziel，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.tide-foundation%2Fraziel/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "raziel": {
      "type": "http",
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

README

Raziel

Raziel is the Tide MCP — it gives AI coding agents the knowledge to implement TideCloak correctly.

This MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a security gap analysis of your existing system and self-host vs managed-hosting guidance. Instead of guessing, your AI follows verified playbooks.

Quick Start

Claude Code (CLI or VS Code extension)

Run this one command:

Done. Start a conversation and ask your agent to add Tide auth to your app.

Project-level config (any MCP client)

Add a .mcp.json file to your project root:

json

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Works with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Cursor

Open Settings > MCP Servers > Add Server:

Name: tide-pack
Command: npx
Args: -y @tideorg/mcp

Or add to .cursor/mcp.json in your project root.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

Or for local: "command": "npx", "args": ["-y", "@tideorg/mcp"]

Zed

Add to your Zed settings (~/.config/zed/settings.json):

json

{  "context_servers": {    "tide": {      "command": {        "path": "npx",        "args": ["-y", "@tideorg/mcp"]      }    }  }}

{  "context_servers": {    "tide": {      "command": {        "path": "npx",        "args": ["-y", "@tideorg/mcp"]      }    }  }}

Note: Zed uses context_servers (not mcpServers) and doesn't yet support remote URL-based MCP servers — use the npx command.

OpenAI Codex CLI

Add to ~/.codex/config.json:

json

{  "mcpServers": {    "tide": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Note: Codex CLI currently supports stdio-based MCP servers only — use the npx command.

Lovable

Lovable's build agent can use Raziel through a Custom MCP connector (available on all plans). In your Lovable project, open Connectors → Custom MCP (the card at the bottom) and add:

Server name: Raziel
Server URL: https://mcp.tide.org/mcp
Authentication: No authentication

Then tell the agent to use it — e.g. "Use the Raziel connector to pull the TideCloak playbook before writing any auth code."

Two things that trip people up:

You attach it, not the agent. Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the Connectors panel, then point the agent at it — otherwise it will say it "has no way to connect."
It's a build-time connector. It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.

What your AI can do with this

Once connected, your AI assistant can:

Analyze your existing system for security gaps and map each one to what Tide fixes (with an honest "what Tide does NOT fix" list)
Add Tide auth to a new or existing Next.js/React app
Protect API routes with server-side JWT + DPoP verification
Set up role-based access with Tide's IGA governance
Deploy Forseti smart contracts for policy-governed encryption and signing
Bootstrap TideCloak — self-hosted (Docker) or partner-hosted (Skycloak) — to a fully configured realm
Diagnose issues like broken login, missing roles, CORS errors
Follow security invariants that prevent common auth mistakes

Try it

After setup, try these prompts in your AI coding tool:

Do a security analysis of my app and show what Tide would change

Add Tide authentication to my Next.js app

I have an existing app with auth — help me migrate to Tide

Set up encrypted data sharing between users with Tide

Help me create a Forseti contract for multi-admin approval

What's inside

Category	Count	Examples
Canon doctrine	15 files	Security invariants, anti-patterns, security gap mapping, IGA change-request API, hosting options, framework matrix, troubleshooting
Playbooks	18 step-by-step guides	Add auth, protect APIs, verify JWTs, deploy TideCloak, set up E2EE, provision hosted TideCloak
Skills	11 composable roles	Setup, integration, security analysis, route/API protection, review, QA gate
Scenarios	5 reference architectures	Password manager, signing service, encrypted chat, governance panel
Prompts	5 starter prompts	Security gap analysis, secure existing app, migrate auth, admin approval, customer portal

Remote Server (no install required)

We host the MCP server so you don't have to install anything. Just add the URL:

No Node.js required. No npx. Works with any MCP client that supports remote servers.

Self-hosting

Want to run your own instance? Pull from Docker Hub:

Or build from source:

Then point your MCP client at http://localhost:3000/mcp.

Optional: set API_TOKEN environment variable to require Bearer token auth:

Requirements

Remote server: None (just an MCP client that supports remote URLs)
npm/npx install: Node.js 18+
Self-hosted Docker: Docker

No TideCloak instance needed to start — the agent will guide you through setup.

Privacy

The MCP server is read-only. Run locally (npx), it collects nothing — no accounts, no telemetry, no storage. The hosted mcp.tide.org endpoint records aggregate usage geography (approximate location only, never request content or tool arguments) to see where it's used. Full details in PRIVACY.md.

工具

tide_list

List all available content in the Tide agent pack by category

输入参数category必填

tide_canon

Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

输入参数name必填partsection

tide_playbook

Read a step-by-step playbook for a specific Tide task

输入参数name必填part

tide_skill

Read a composable skill definition

输入参数name必填partsection

tide_prompt

Read a reusable starter prompt from the pack

输入参数name必填

tide_adapter

Read an adapter instruction file (AGENTS, CLAUDE, replit)

输入参数name必填

tide_list_scenarios

List all available scenario patterns under reference-apps/

无需输入参数。

tide_scenario

Read a scenario summary from reference-apps/<scenario>/scenario.md

输入参数name必填part

tide_scenario_manifest

Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

输入参数name必填

tide_scenario_roles

Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

输入参数name必填

tide_scenario_bootstrap

Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

输入参数name必填

tide_choose_scenario

Match a user request to a known scenario pattern before falling back to generic playbooks

输入参数situation必填

tide_choose_playbook

Recommend the right playbook for a given situation

输入参数situation必填

tide_security_analysis

Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

输入参数partinclude_runtime_probes

tide_blast_radius

Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

输入参数part

tide_hosting

Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.

输入参数part

tide_dpop_asset

Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.

无需输入参数。

tide_onboarding

STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

输入参数realmfieldsappNameframeworktidecloakUrlcomponentPath

tide_branding

BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.

输入参数realmaccentappNametidecloakUrl

tide_scaffold

START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.

输入参数appDirappNametemplatesituation

tide_doctor

FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.

输入参数realmappDirappUrlcheckOnly

tide_gaps

Read the gap register — what is still uncertain or unresolved in the pack

输入参数part

版本历史

v1.9.34最新Oct 29, 2026
v1.9.33Oct 20, 2026
v1.9.23Sep 16, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

近 30 天内可连通必需25 分
已声明认证方式必需10 分
已列出工具必需15 分
描述必需15 分
图标10 分
文档15 分
许可证10 分
请在仓库或注册中心条目中声明许可证。

其他 Raziel 集成

Raziel Calculators

co.raziel官方发布者

Raziel Calculators 为助手提供 28 个免费金融计算器，以及指南检索和术语解释，覆盖风投、创业公司与基金数学。

Streamable HTTP可网页运行

金融28 个工具Nov 1, 2026

Raziel

概览

安装

在 SourceWeft 中

交给智能体安装

其他 MCP 客户端

README

Raziel

Quick Start

Claude Code (CLI or VS Code extension)

Project-level config (any MCP client)

Claude Desktop

Cursor

Windsurf

Zed

OpenAI Codex CLI

Lovable

What your AI can do with this

Try it

What's inside

Remote Server (no install required)

Self-hosting

Requirements

Privacy

Links

工具

tide_list

tide_canon

tide_playbook

tide_skill

tide_prompt

tide_adapter

tide_list_scenarios

tide_scenario

tide_scenario_manifest

tide_scenario_roles

tide_scenario_bootstrap

tide_choose_scenario

tide_choose_playbook

tide_security_analysis

tide_blast_radius

tide_hosting

tide_dpop_asset

tide_onboarding

tide_branding

tide_scaffold

tide_doctor

tide_gaps

版本历史

评分

其他 Raziel 集成

Raziel Calculators