{"name":"io.github.tide-foundation/raziel","slug":"tide-foundation-raziel","title":"Raziel","description":"MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis","url":"https://mcp.market/server/tide-foundation-raziel","rating":null,"grade":"B","score":81,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":24,"stars":0,"forks":0,"downloads_week":60,"last_push_at":"2026-08-20T09:03:57.000Z","license":"NOASSERTION"},"uptime":{"percent":92,"checks":13,"ok":12,"last_checked_at":"2026-09-22T16:56:01.729Z","last_ok_at":"2026-09-22T16:56:01.729Z","latency_ms":921},"claimed":false,"transport":"mixed","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/tide-foundation/raziel-mcp","website":null,"version":"1.9.23","remotes":[{"type":"streamable-http","url":"https://mcp.tide.org/mcp"}],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"@tideorg/mcp","version":"1.9.23","runtimeHint":"npx","transport":{"type":"stdio"}}],"tools":[{"name":"tide_adapter","description":"Read an adapter instruction file (AGENTS, CLAUDE, replit)","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Adapter file name. Available: AGENTS, CLAUDE, replit"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_blast_radius","description":"Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{},"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_branding","description":"BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"realm":{"type":"string","description":"Realm to brand, e.g. 'myapp'. Fills in the command."},"accent":{"type":"string","description":"Hex accent colour without '#', e.g. '2f6f4e'. Default 1f6feb."},"appName":{"type":"string","description":"App name. Deterministically varies the mark's geometry so realms look distinct."},"tidecloakUrl":{"type":"string","description":"Base URL. Default http://localhost:8080."}},"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_canon","description":"Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Canon file name. Available: agent-authority, anti-patterns, breach-precedents, concepts, custom-contracts, feature-mapping, framework-matrix, hosting-options, iga-change-requests-api, invariants, redirect-handler, security-gap-mapping, security-runtime-probes, tide-neutralization, tidecloak-bootstrap, tidecloak-endpoints, tidify-compatibility, troubleshooting, ux-states, verifiable-claims, version-policy"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_choose_playbook","description":"Recommend the right playbook for a given situation","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"situation":{"type":"string","description":"Describe what the builder wants to do, e.g. 'add login to a new Next.js app'"}},"required":["situation"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_choose_scenario","description":"Match a user request to a known scenario pattern before falling back to generic playbooks","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"situation":{"type":"string","description":"Describe the app or problem, e.g. 'build an organisation password manager'"}},"required":["situation"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_dpop_asset","description":"Returns the CONTENTS of `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. The file is NOT shipped in the @tidecloak/* npm packages and is NOT in the TideCloak container, so there is nowhere else to get it: without this tool people search GitHub and find a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"tide_gaps","description":"Read the gap register — what is still uncertain or unresolved in the pack","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"tide_hosting","description":"Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"tide_list","description":"List all available content in the Tide agent pack by category","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"category":{"type":"string","enum":["canon","playbooks","skills","prompts","adapters","scenarios","all"],"description":"Which category to list, or 'all' for everything"}},"required":["category"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_list_scenarios","description":"List all available scenario patterns under reference-apps/","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"tide_onboarding","description":"STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"realm":{"type":"string","description":"Realm, e.g. 'vialproof'. Fills in the commands."},"tidecloakUrl":{"type":"string","description":"Base URL. Default http://localhost:8080."},"appName":{"type":"string","description":"App name, e.g. 'Mood Garden'. Used in the modal's copy."},"fields":{"type":"array","items":{"type":"string","enum":["displayName","firstName","lastName","email"]},"description":"Which fields to collect. ASK THE USER FIRST — do not guess. Default ['firstName','lastName']."},"componentPath":{"type":"string","description":"Where to WRITE the component, e.g. 'src/components/ProfileOnboarding.tsx'."},"framework":{"type":"string","enum":["nextjs-app","nextjs-pages","react-vite"],"description":"Controls the mounting snippet. Default nextjs-app."}},"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_playbook","description":"Read a step-by-step playbook for a specific Tide task","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Playbook name. Available: add-auth-nextjs-existing, add-auth-nextjs-fresh, add-rbac-nextjs, bootstrap-realm-from-template, configure-e2ee-roles-and-policies, deploy-forseti-policy, deploy-tidecloak-docker, diagnose-broken-login, diagnose-missing-roles-or-claims, initialize-admin-and-link-account, migrate-from-existing-auth, protect-api-nextjs, protect-aspnet-core-asgard, protect-routes-nextjs, provision-tidecloak-skycloak, setup-forseti-e2ee, setup-iga-admin-panel, start-tidecloak-dev, verify-jwt-server-side"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_prompt","description":"Read a reusable starter prompt from the pack","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Prompt file name. Available: add-admin-approval-flow, build-private-customer-portal, migrate-generic-auth-to-tide, red-team-review, secure-existing-app, security-gap-analysis"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_scenario","description":"Read a scenario summary from reference-apps/<scenario>/scenario.md","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Scenario name. Available: attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_scenario_bootstrap","description":"Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Scenario name. Available: attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_scenario_manifest","description":"Read a scenario manifest from reference-apps/<scenario>/manifest.yaml","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Scenario name. Available: attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_scenario_roles","description":"Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Scenario name. Available: attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_security_analysis","description":"Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"include_runtime_probes":{"type":"boolean","description":"Include the runtime-confirmation probe procedures (canon/security-runtime-probes.md). Only relevant when the operator is authorized to probe a live target. Defaults to true."}},"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"tide_skill","description":"Read a composable skill definition","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","description":"Skill name. Available: grc-review, tide-diagnostics, tide-integration, tide-learning-capture, tide-mcp-qa, tide-rbac-and-e2ee, tide-red-team, tide-reviewer, tide-route-and-api-protection, tide-scenario-resolver, tide-security-analyst, tide-setup, tide-solutions-architect"}},"required":["name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}}],"scan":{"score":81,"grade":"B","scanned_at":"2026-09-22T11:51:11.255Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-22T11:51:11.247Z","components":{"code":{"score":25,"max":25,"notes":["13 source files scanned"]},"reliability":{"score":17,"max":20,"notes":["remote reachable in 2400ms"]},"poisoning":{"score":15,"max":15,"notes":["20 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 1 write-action tools with no auth"]},"maintenance":{"score":12,"max":15,"notes":["last push 33 days ago"]},"identity":{"score":9,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"}],"inputs":{"probes":[{"url":"https://mcp.tide.org/mcp","reachable":true,"authRequired":false,"latencyMs":2400,"serverInfo":{"name":"@tideorg/mcp","version":"1.9.23"}}],"packages":[{"registryType":"npm","identifier":"@tideorg/mcp","version":"1.9.23","found":true,"license":"SEE LICENSE IN LICENSE","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-08-21T01:40:29.749Z","repositoryUrl":"git+https://github.com/tide-foundation/raziel-mcp.git","weeklyDownloads":60}],"repo":{"found":true,"owner":"tide-foundation","repo":"raziel-mcp","archived":false,"pushedAt":"2026-08-20T09:03:57Z","stars":0,"forks":0,"openIssues":0,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/50648942?v=4","ownerCreatedAt":"2019-05-15T04:01:41Z","license":"NOASSERTION"},"icon":{"url":"https://avatars.githubusercontent.com/u/50648942?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":60,"license":"NOASSERTION","lastPushAt":"2026-08-20T09:03:57.000Z","score":24}}}},"grade_history":[],"reviews":[]}