MCP.Market

Raziel MCP server

online · 100% uptime
by tide-foundation·io.github.tide-foundation/raziel·v1.9.34·2 stars
No reviews yet

MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis

A87/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A87/100

full report

Adoption
Growing

2 stars401 downloads/wk

Reviews

Write one

Nobody has reviewed Raziel yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Raziel tools (22, 1 write)

write = sends, deletes, buys or posts
  • tide_adapterFree

    Read an adapter instruction file (AGENTS, CLAUDE, replit)

  • tide_blast_radiuswrite actionFree

    Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

  • tide_brandingFree

    BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.

  • tide_canonFree

    Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

  • tide_choose_playbookFree

    Recommend the right playbook for a given situation

  • tide_choose_scenarioFree

    Match a user request to a known scenario pattern before falling back to generic playbooks

  • tide_doctorFree

    FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.

  • tide_dpop_assetFree

    Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.

  • tide_gapsFree

    Read the gap register — what is still uncertain or unresolved in the pack

  • tide_hostingFree

    Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.

  • tide_listFree

    List all available content in the Tide agent pack by category

  • tide_list_scenariosFree

    List all available scenario patterns under reference-apps/

  • tide_onboardingFree

    STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

  • tide_playbookFree

    Read a step-by-step playbook for a specific Tide task

  • tide_promptFree

    Read a reusable starter prompt from the pack

  • tide_scaffoldFree

    START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.

  • tide_scenarioFree

    Read a scenario summary from reference-apps/<scenario>/scenario.md

  • tide_scenario_bootstrapFree

    Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

  • tide_scenario_manifestFree

    Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

  • tide_scenario_rolesFree

    Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

  • tide_security_analysisFree

    Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

  • tide_skillFree

    Read a composable skill definition

Public scan report

scanner v0.1.10 · 2026-11-02 · same rubric, same numbers if you re-run it

1 high
  • Code scan71 source files scanned25/25
  • Live reliabilityremote reachable in 1693ms20/20
  • Tool poisoning22 tool descriptions checked15/15
  • Auth qualityopen endpoint exposes 1 write-action tools with no auth3/15
  • Maintenancelast push 4 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Findings (1)

  • highWrite-action tools reachable without authenticationauth.open-write
Overall 87/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Raziel compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
87/100
higher than 83% of 917 Security servers
Tools
22
the typical Security server has 10
Tools that change things
5%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote Security server answers 100%
Response time
900 ms
faster than 8% of 551 Security servers
GitHub stars
2
more than 75% of 589 Security servers
Downloads a week
401
more than 86% of 386 Security servers with a package

What its tools let an agent do: 21 read · 1 change

Release history: 3 versions in the registry since 2026-08-21, latest 2026-10-29, typically one every 60 days.

Install Raziel in Claude Code, Cursor or VS Code

claude mcp add --transport http raziel https://mcp.tide.org/mcp
Add to Cursor

What the publisher says

From the Raziel repository's README, as published. We do not edit it. Read it on GitHub

Raziel

Raziel is the Tide MCP — it gives AI coding agents the knowledge to implement TideCloak correctly.

This MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a security gap analysis of your existing system and self-host vs managed-hosting guidance. Instead of guessing, your AI follows verified playbooks.

Quick Start

Claude Code (CLI or VS Code extension)

Run this one command:

claude mcp add tide-pack -- npx -y @tideorg/mcp

Done. Start a conversation and ask your agent to add Tide auth to your app.

Project-level config (any MCP client)

Add a .mcp.json file to your project root:

{
  "mcpServers": {
    "tide-pack": {
      "command": "npx",
      "args": ["-y", "@tideorg/mcp"]
    }
  }
}

Works with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.

Claude Desktop

Edit ~/Library/Application Support/Claude/claudedesktopconfig.json (macOS) or %APPDATA%\Claude\claudedesktopconfig.json (Windows):

{
  "mcpServers": {
    "tide-pack": {
      "command": "npx",
      "args": ["-y", "@tideorg/mcp"]
    }
  }
}

Cursor

Open Settings > MCP Servers > Add Server:

  • Name: tide-pack
  • Command: npx
  • Args: -y @tideorg/mcp

Or add to .cursor/mcp.json in your project root.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "tide": {
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

Or for local: "command": "npx", "args": ["-y", "@tideorg/mcp"]

Zed

Add to your Zed settings (~/.config/zed/settings.json):

{
  "context_servers": {
    "tide": {
      "command": {
        "path": "npx",
        "args": ["-y", "@tideorg/mcp"]
      }
    }
  }
}

Note: Zed uses context_servers (not mcpServers) and doesn't yet support remote URL-based MCP servers — use the npx command.

OpenAI Codex CLI

Add to ~/.codex/config.json:

{
  "mcpServers": {
    "tide": {
      "command": "npx",
      "args": ["-y", "@tideorg/mcp"]
    }
  }
}

Note: Codex CLI currently supports stdio-based MCP servers only — use the npx command.

Lovable

Lovable's build agent can use Raziel through a Custom MCP connector (available on all plans). In your Lovable project, open Connectors → Custom MCP (the card at the bottom) and add:

  • Server name: Raziel
  • Server URL: https://mcp.tide.org/mcp
  • Authentication: No authentication

Then tell the agent to use it — e.g. "Use the Raziel connector to pull the TideCloak playbook before writing any auth code."

Two things that trip people up:

  • You attach it, not the agent. Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the Connectors panel, then point the agent at it — otherwise it will say it "has no way to connect."
  • It's a build-time connector. It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.

What your AI can do with this

Once connected, your AI assistant can:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-11-02restoreB → Ascore 87: Write-action tools reachable without authentication

Raziel: common questions

Is Raziel MCP server safe?
Yes, by our scan: it is graded A (87/100). Read the Raziel safety report
How do I install Raziel?
It runs remotely at mcp.tide.org. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Raziel need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Raziel maintained?
The last commit was 17 days ago (2026-10-29). The latest release is v1.9.34.
Is Raziel up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
What can I use instead of Raziel?
Servers from other publishers that do the same job: CrowdStrike Falcon MCP Server, Wireshark MCP server and Virustotal MCP server. Compare all Raziel alternatives.
How does Raziel compare with other Security MCP servers?
safety score 87/100 (higher than 83% of 917 Security servers); tools 22 (the typical Security server has 10); tools that change things 5% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Raziel

Same job from other publishers: the closest match first, then the best rated.

All Raziel alternatives →
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • Wireshark
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
    A
  • Virustotal
    MCP server for querying VirusTotal API with comprehensive security analysis tools.
    B
  • Virustotal
    MCP server for querying VirusTotal API with comprehensive security analysis tools.
    B
  • Reversecore MCP
    Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
    B