Raziel

io.github.tide-foundation由 GitHub 帳號 tide-foundation 發布v1.9.34更新於 Oct 29, 2026

MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis

發布方自己的服務：Raziel Calculators

已驗證Streamable HTTP可網頁執行知識與記憶開發者工具安全與監控

服務詳細資訊

識別碼: io.github.tide-foundation/raziel
傳輸: Streamable HTTP
執行環境: Web executable
信任: Verified
發布於: Sep 16, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此條目所屬的 GitHub 帳號 tide-foundation。這並不表明該帳號就是產品方。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.tide-foundation%2Fraziel.svg)](https://sourceweft.com/mcp/io.github.tide-foundation%2Fraziel?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

Raziel 是 Tide 代理包：一個 MCP 伺服器，為編碼助理提供經驗證的作業手冊、技能與情境，用來實作 TideCloak 驗證、端對端加密與 IGA。

可以做什麼: 瀏覽並讀取套件內容：規範教義、作業手冊、技能、起始提示詞與轉接檔
列出並讀取參考應用情境，包含清單、角色政策矩陣與引導序列
將需求對應到已知情境，或針對特定狀況推薦合適的作業手冊
分析現有系統的安全缺口，並評估權限集中於單點的爆炸半徑
取得託管方式（本機 Docker 或託管 Skycloak）、DPoP 資源、使用者引導、品牌化、腳手架與登入故障診斷的指引
讀取記錄套件內仍未確定事項的缺口清單
適用情境: 在使用 TideCloak 建置或強化應用時，希望助理遵循廠商提供的作業手冊，而不是自行猜測驗證、加密或治理程式碼。也適合在決定是否採用 Tide 之前，稽核現有系統的安全缺口。
執行需求: 可使用 mcp.tide.org 遠端端點（免安裝、免 Node.js），或以 npx 執行 npm 套件，需要 Node.js 18+。也支援以 Docker 自行託管。開始使用不需要既有的 TideCloak 執行個體；伺服器本身未宣告任何憑證。

安裝前請注意

伺服器本身為唯讀，但其指引會讓助理在你的專案中寫入檔案、執行指令並產生應用。設定 Tide 領域需要授權電子郵件並同意 Tide 條款，且領域在引導後無法搬移。託管端點會記錄彙總的使用地理資訊；本機 npx 執行不收集任何資料。自行託管時可選擇以 API_TOKEN 要求驗證。

安裝

在 SourceWeft 中

開啟儀表板中的 Raziel，將其新增到工作區。
為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.tide-foundation%2Fraziel/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "raziel": {
      "type": "http",
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

README

Raziel

Raziel is the Tide MCP — it gives AI coding agents the knowledge to implement TideCloak correctly.

This MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a security gap analysis of your existing system and self-host vs managed-hosting guidance. Instead of guessing, your AI follows verified playbooks.

Quick Start

Claude Code (CLI or VS Code extension)

Run this one command:

Done. Start a conversation and ask your agent to add Tide auth to your app.

Project-level config (any MCP client)

Add a .mcp.json file to your project root:

json

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Works with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide-pack": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Cursor

Open Settings > MCP Servers > Add Server:

Name: tide-pack
Command: npx
Args: -y @tideorg/mcp

Or add to .cursor/mcp.json in your project root.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

Or for local: "command": "npx", "args": ["-y", "@tideorg/mcp"]

Zed

Add to your Zed settings (~/.config/zed/settings.json):

json

{  "context_servers": {    "tide": {      "command": {        "path": "npx",        "args": ["-y", "@tideorg/mcp"]      }    }  }}

{  "context_servers": {    "tide": {      "command": {        "path": "npx",        "args": ["-y", "@tideorg/mcp"]      }    }  }}

Note: Zed uses context_servers (not mcpServers) and doesn't yet support remote URL-based MCP servers — use the npx command.

OpenAI Codex CLI

Add to ~/.codex/config.json:

json

{  "mcpServers": {    "tide": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

{  "mcpServers": {    "tide": {      "command": "npx",      "args": ["-y", "@tideorg/mcp"]    }  }}

Note: Codex CLI currently supports stdio-based MCP servers only — use the npx command.

Lovable

Lovable's build agent can use Raziel through a Custom MCP connector (available on all plans). In your Lovable project, open Connectors → Custom MCP (the card at the bottom) and add:

Server name: Raziel
Server URL: https://mcp.tide.org/mcp
Authentication: No authentication

Then tell the agent to use it — e.g. "Use the Raziel connector to pull the TideCloak playbook before writing any auth code."

Two things that trip people up:

You attach it, not the agent. Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the Connectors panel, then point the agent at it — otherwise it will say it "has no way to connect."
It's a build-time connector. It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.

What your AI can do with this

Once connected, your AI assistant can:

Analyze your existing system for security gaps and map each one to what Tide fixes (with an honest "what Tide does NOT fix" list)
Add Tide auth to a new or existing Next.js/React app
Protect API routes with server-side JWT + DPoP verification
Set up role-based access with Tide's IGA governance
Deploy Forseti smart contracts for policy-governed encryption and signing
Bootstrap TideCloak — self-hosted (Docker) or partner-hosted (Skycloak) — to a fully configured realm
Diagnose issues like broken login, missing roles, CORS errors
Follow security invariants that prevent common auth mistakes

Try it

After setup, try these prompts in your AI coding tool:

Do a security analysis of my app and show what Tide would change

Add Tide authentication to my Next.js app

I have an existing app with auth — help me migrate to Tide

Set up encrypted data sharing between users with Tide

Help me create a Forseti contract for multi-admin approval

What's inside

Category	Count	Examples
Canon doctrine	15 files	Security invariants, anti-patterns, security gap mapping, IGA change-request API, hosting options, framework matrix, troubleshooting
Playbooks	18 step-by-step guides	Add auth, protect APIs, verify JWTs, deploy TideCloak, set up E2EE, provision hosted TideCloak
Skills	11 composable roles	Setup, integration, security analysis, route/API protection, review, QA gate
Scenarios	5 reference architectures	Password manager, signing service, encrypted chat, governance panel
Prompts	5 starter prompts	Security gap analysis, secure existing app, migrate auth, admin approval, customer portal

Remote Server (no install required)

We host the MCP server so you don't have to install anything. Just add the URL:

No Node.js required. No npx. Works with any MCP client that supports remote servers.

Self-hosting

Want to run your own instance? Pull from Docker Hub:

Or build from source:

Then point your MCP client at http://localhost:3000/mcp.

Optional: set API_TOKEN environment variable to require Bearer token auth:

Requirements

Remote server: None (just an MCP client that supports remote URLs)
npm/npx install: Node.js 18+
Self-hosted Docker: Docker

No TideCloak instance needed to start — the agent will guide you through setup.

Privacy

The MCP server is read-only. Run locally (npx), it collects nothing — no accounts, no telemetry, no storage. The hosted mcp.tide.org endpoint records aggregate usage geography (approximate location only, never request content or tool arguments) to see where it's used. Full details in PRIVACY.md.

工具

tide_list

List all available content in the Tide agent pack by category

輸入參數category必填

tide_canon

Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

輸入參數name必填partsection

tide_playbook

Read a step-by-step playbook for a specific Tide task

輸入參數name必填part

tide_skill

Read a composable skill definition

輸入參數name必填partsection

tide_prompt

Read a reusable starter prompt from the pack

輸入參數name必填

tide_adapter

Read an adapter instruction file (AGENTS, CLAUDE, replit)

輸入參數name必填

tide_list_scenarios

List all available scenario patterns under reference-apps/

無需輸入參數。

tide_scenario

Read a scenario summary from reference-apps/<scenario>/scenario.md

輸入參數name必填part

tide_scenario_manifest

Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

輸入參數name必填

tide_scenario_roles

Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

輸入參數name必填

tide_scenario_bootstrap

Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

輸入參數name必填

tide_choose_scenario

Match a user request to a known scenario pattern before falling back to generic playbooks

輸入參數situation必填

tide_choose_playbook

Recommend the right playbook for a given situation

輸入參數situation必填

tide_security_analysis

Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

輸入參數partinclude_runtime_probes

tide_blast_radius

Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

輸入參數part

tide_hosting

Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.

輸入參數part

tide_dpop_asset

Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.

無需輸入參數。

tide_onboarding

STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

輸入參數realmfieldsappNameframeworktidecloakUrlcomponentPath

tide_branding

BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.

輸入參數realmaccentappNametidecloakUrl

tide_scaffold

START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.

輸入參數appDirappNametemplatesituation

tide_doctor

FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.

輸入參數realmappDirappUrlcheckOnly

tide_gaps

Read the gap register — what is still uncertain or unresolved in the pack

輸入參數part

版本歷史

v1.9.34最新Oct 29, 2026
v1.9.33Oct 20, 2026
v1.9.23Sep 16, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

近 30 天內可連通必需25 分
已宣告認證方式必需10 分
已列出工具必需15 分
描述必需15 分
圖示10 分
文件15 分
授權條款10 分
請在儲存庫或註冊中心條目中宣告授權條款。

其他 Raziel 整合

Raziel Calculators

co.raziel官方發布者

Raziel Calculators 為助理提供 28 個免費金融計算機，以及指南檢索與術語解釋，涵蓋創投、新創公司與基金數學。

Streamable HTTP可網頁執行

金融28 個工具Nov 1, 2026

Raziel

概覽

安裝

在 SourceWeft 中

交給代理程式安裝

其他 MCP 客戶端

README

Raziel

Quick Start

Claude Code (CLI or VS Code extension)

Project-level config (any MCP client)

Claude Desktop

Cursor

Windsurf

Zed

OpenAI Codex CLI

Lovable

What your AI can do with this

Try it

What's inside

Remote Server (no install required)

Self-hosting

Requirements

Privacy

Links

工具

tide_list

tide_canon

tide_playbook

tide_skill

tide_prompt

tide_adapter

tide_list_scenarios

tide_scenario

tide_scenario_manifest

tide_scenario_roles

tide_scenario_bootstrap

tide_choose_scenario

tide_choose_playbook

tide_security_analysis

tide_blast_radius

tide_hosting

tide_dpop_asset

tide_onboarding

tide_branding

tide_scaffold

tide_doctor

tide_gaps

版本歷史

評分

其他 Raziel 整合

Raziel Calculators