Mmcp.market

Raziel MCP server

by tide-foundation·io.github.tide-foundation/raziel·v1.9.23
No reviews yet

MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis

B81/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B81/100

full report

Adoption
Growing

0 stars60 downloads/wk

Reviews

Write one

Nobody has reviewed Raziel yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Raziel tools (20, 1 write)

write = sends, deletes, buys or posts
  • tide_adapterFree

    Read an adapter instruction file (AGENTS, CLAUDE, replit)

  • tide_blast_radiuswrite actionFree

    Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

  • tide_brandingFree

    BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.

  • tide_canonFree

    Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

  • tide_choose_playbookFree

    Recommend the right playbook for a given situation

  • tide_choose_scenarioFree

    Match a user request to a known scenario pattern before falling back to generic playbooks

  • tide_dpop_assetFree

    Returns the CONTENTS of `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. The file is NOT shipped in the @tidecloak/* npm packages and is NOT in the TideCloak container, so there is nowhere else to get it: without this tool people search GitHub and find a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.

  • tide_gapsFree

    Read the gap register — what is still uncertain or unresolved in the pack

  • tide_hostingFree

    Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.

  • tide_listFree

    List all available content in the Tide agent pack by category

  • tide_list_scenariosFree

    List all available scenario patterns under reference-apps/

  • tide_onboardingFree

    STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

  • tide_playbookFree

    Read a step-by-step playbook for a specific Tide task

  • tide_promptFree

    Read a reusable starter prompt from the pack

  • tide_scenarioFree

    Read a scenario summary from reference-apps/<scenario>/scenario.md

  • tide_scenario_bootstrapFree

    Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

  • tide_scenario_manifestFree

    Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

  • tide_scenario_rolesFree

    Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

  • tide_security_analysisFree

    Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

  • tide_skillFree

    Read a composable skill definition

Public scan report

scanner v0.1.9 · 2026-09-22 · same rubric, same numbers if you re-run it

1 high
  • Code scan13 source files scanned25/25
  • Live reliabilityremote reachable in 2400ms17/20
  • Tool poisoning20 tool descriptions checked15/15
  • Auth qualityopen endpoint exposes 1 write-action tools with no auth3/15
  • Maintenancelast push 33 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Findings (1)

  • highWrite-action tools reachable without authenticationauth.open-write
Overall 81/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the Raziel repository's README, as published. We do not edit it. Read it on GitHub

Raziel

Raziel is the Tide MCP — it gives AI coding agents the knowledge to implement TideCloak correctly.

This MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a security gap analysis of your existing system and self-host vs managed-hosting guidance. Instead of guessing, your AI follows verified playbooks.

Quick Start

Claude Code (CLI or VS Code extension)

Run this one command:

claude mcp add tide-pack -- npx -y @tideorg/mcp

Done. Start a conversation and ask your agent to add Tide auth to your app.

Project-level config (any MCP client)

Add a .mcp.json file to your project root:

{
  "mcpServers": {
    "tide-pack": {
      "command": "npx",
      "args": ["-y", "@tideorg/mcp"]
    }
  }
}

Works with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.

Claude Desktop

Edit ~/Library/Application Support/Claude/claudedesktopconfig.json (macOS) or %APPDATA%\Claude\claudedesktopconfig.json (Windows):

{
  "mcpServers": {
    "tide-pack": {
      "command": "npx",
      "args": ["-y", "@tideorg/mcp"]
    }
  }
}

Cursor

Open Settings > MCP Servers > Add Server:

  • Name: tide-pack
  • Command: npx
  • Args: -y @tideorg/mcp

Or add to .cursor/mcp.json in your project root.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "tide": {
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

Or for local: "command": "npx", "args": ["-y", "@tideorg/mcp"]

Zed

Add to your Zed settings (~/.config/zed/settings.json):

{
  "context_servers": {
    "tide": {
      "command": {
        "path": "npx",
        "args": ["-y", "@tideorg/mcp"]
      }
    }
  }
}

Note: Zed uses context_servers (not mcpServers) and doesn't yet support remote URL-based MCP servers — use the npx command.

OpenAI Codex CLI

Add to ~/.codex/config.json:

{
  "mcpServers": {
    "tide": {
      "command": "npx",
      "args": ["-y", "@tideorg/mcp"]
    }
  }
}

Note: Codex CLI currently supports stdio-based MCP servers only — use the npx command.

Lovable

Lovable's build agent can use Raziel through a Custom MCP connector (available on all plans). In your Lovable project, open Connectors → Custom MCP (the card at the bottom) and add:

  • Server name: Raziel
  • Server URL: https://mcp.tide.org/mcp
  • Authentication: No authentication

Then tell the agent to use it — e.g. "Use the Raziel connector to pull the TideCloak playbook before writing any auth code."

Two things that trip people up:

  • You attach it, not the agent. Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the Connectors panel, then point the agent at it — otherwise it will say it "has no way to connect."
  • It's a build-time connector. It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.

What your AI can do with this

Once connected, your AI assistant can:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

claude mcp add --transport http raziel https://mcp.tide.org/mcp
Add to Cursor

Raziel: common questions

Is Raziel MCP server safe?
Mostly: it is graded B (81/100). Read the Raziel safety report
How do I install Raziel?
It runs remotely at mcp.tide.org. Add it to Claude Code, Claude Desktop or Cursor with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Raziel need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Raziel maintained?
The last commit was 34 days ago (2026-08-20). The latest release is v1.9.23.
Is Raziel up?
92% of our last 13 checks got an answer. We check remote servers about four times a day.
What can I use instead of Raziel?
Servers from other publishers that do the same job: CrowdStrike Falcon MCP Server, Reversecore MCP server and Npm Sentinel MCP server. Compare all Raziel alternatives.

Alternatives to Raziel

Same job from other publishers: the closest match first, then the best rated.

All Raziel alternatives →
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • Reversecore MCP
    Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
    B
  • Npm Sentinel
    Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.
    A
  • npm Registry MCP Server
    npm registry MCP server — package intelligence, security audits, dependency analysis
    More from YawLabs →
    B
  • SSH Manager
    SSH server management for agents, with per-server read-only and allowlist security modes
    B
Raziel vs CrowdStrike Falcon MCP ServerRaziel vs Reversecore MCPRaziel vs Npm Sentinel

More from tide-foundation →