Raziel

by tide-foundation · remote · local (npm) · no sign-in to list tools · v1.9.33 · published by GitHub user tide-foundation

MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis

Changes · 72 high findings

Compare Registry entry

22 tools: 7 change things and 15 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things7Claude Code: ask: see these tools
Only reads15Claude Code: allow: see these tools

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http raziel https://mcp.tide.org/mcp

Findings

Matches of fixed checks, with the text they matched.

2 high3 warn

Hightide_doctor
The description refers to ".env".
Matched text
description: "...rrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest,..."
What this check looks for
Hightide_doctor
The input schema at properties.realm.description refers to ".env".
Matched text
inputSchema.properties.realm.description: "...alm checks (needs the admin password in .env)."
What this check looks for
Warntide_blast_radius
The server marks "tide_blast_radius" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false}; The description's first verb is "run": a word for a change.
What this check looks for
Warntide_onboarding
The server marks "tide_onboarding" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false}; The description's first verb is "stop": a word for a change.
What this check looks for
Warntide_scaffold
The server marks "tide_scaffold" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false}; The description's first verb is "start": a word for a change.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

22 tools

Changes things 7Creates or changes something that can be changed back.Claude Code: ask

tide_blast_radiusRun a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains ev…1 finding
Why it is in this group
- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "tide_blast_radius" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false}; The description's first verb is "run": a word for a change.
  What this check looks for
Description, as the server wrote it
Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_brandingBRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_choose_playbookRecommend the right playbook for a given situationNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Recommend the right playbook for a given situation
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_choose_scenarioMatch a user request to a known scenario pattern before falling back to generic playbooksNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Match a user request to a known scenario pattern before falling back to generic playbooks
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_hostingWhere TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_onboardingSTOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead.1 finding
Why it is in this group
- The description's first verb is "stop": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "tide_onboarding" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false}; The description's first verb is "stop": a word for a change.
  What this check looks for
Description, as the server wrote it
STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_scaffoldSTART A NEW TIDE APP FROM A WORKING TEMPLATE.1 finding
Why it is in this group
- The description's first verb is "start": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "tide_scaffold" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false}; The description's first verb is "start": a word for a change.
  What this check looks for
Description, as the server wrote it
START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false

Only reads 15Looks things up and changes nothing.Claude Code: allow

tide_adapterRead an adapter instruction file (AGENTS, CLAUDE, replit)No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read an adapter instruction file (AGENTS, CLAUDE, replit)
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_canonRead a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_doctorFIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND.2 findings
Why it is in this group
- The description's first verb is "find": a word for reading.
Findings
- High
  The description refers to ".env".
  Matched text
  description: "...rrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest,..."
  What this check looks for
- High
  The input schema at properties.realm.description refers to ".env".
  Matched text
  inputSchema.properties.realm.description: "...alm checks (needs the admin password in .env)."
  What this check looks for
Description, as the server wrote it
FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_dpop_assetReturns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrit…No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_gapsRead the gap register — what is still uncertain or unresolved in the packNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read the gap register — what is still uncertain or unresolved in the pack
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_listList all available content in the Tide agent pack by categoryNo findings
Why it is in this group
- The name "tide_list" says "list": a word for reading.
Description, as the server wrote it
List all available content in the Tide agent pack by category
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_list_scenariosList all available scenario patterns under reference-apps/No findings
Why it is in this group
- The name "tide_list_scenarios" says "list": a word for reading.
Description, as the server wrote it
List all available scenario patterns under reference-apps/
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_playbookRead a step-by-step playbook for a specific Tide taskNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a step-by-step playbook for a specific Tide task
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_promptRead a reusable starter prompt from the packNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a reusable starter prompt from the pack
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_scenarioRead a scenario summary from reference-apps/<scenario>/scenario.mdNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a scenario summary from reference-apps/<scenario>/scenario.md
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_scenario_bootstrapRead a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.mdNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_scenario_manifestRead a scenario manifest from reference-apps/<scenario>/manifest.yamlNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a scenario manifest from reference-apps/<scenario>/manifest.yaml
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_scenario_rolesRead a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.mdNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_security_analysisAnalyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities.No findings
Why it is in this group
- The description's first verb is "analyze": a word for reading.
Description, as the server wrote it
Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
tide_skillRead a composable skill definitionNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a composable skill definition
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.9.33. Values in angle brackets are yours to fill in.

claude mcp add --transport http raziel https://mcp.tide.org/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__raziel__tide_list",
      "mcp__raziel__tide_canon",
      "mcp__raziel__tide_playbook",
      "mcp__raziel__tide_skill",
      "mcp__raziel__tide_prompt",
      "mcp__raziel__tide_adapter",
      "mcp__raziel__tide_list_scenarios",
      "mcp__raziel__tide_scenario",
      "mcp__raziel__tide_scenario_manifest",
      "mcp__raziel__tide_scenario_roles",
      "mcp__raziel__tide_scenario_bootstrap",
      "mcp__raziel__tide_security_analysis",
      "mcp__raziel__tide_dpop_asset",
      "mcp__raziel__tide_doctor",
      "mcp__raziel__tide_gaps"
    ],
    "ask": [
      "mcp__raziel__tide_choose_scenario",
      "mcp__raziel__tide_choose_playbook",
      "mcp__raziel__tide_blast_radius",
      "mcp__raziel__tide_hosting",
      "mcp__raziel__tide_onboarding",
      "mcp__raziel__tide_branding",
      "mcp__raziel__tide_scaffold"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as raziel. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.tide-foundation/raziel/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:50 UTC.

For agents: Markdown · JSON · report this listing