Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "raziel": {
      "type": "http",
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

claude mcp add --transport http raziel https://mcp.tide.org/mcp

[mcp_servers.raziel]
url = "https://mcp.tide.org/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "raziel": {
      "type": "remote",
      "url": "https://mcp.tide.org/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "raziel": {
      "type": "http",
      "url": "https://mcp.tide.org/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=raziel&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnRpZGUub3JnL21jcCJ9"
}

{
  "servers": {
    "raziel": {
      "type": "http",
      "url": "https://mcp.tide.org/mcp"
    }
  }
}

{
  "mcpServers": {
    "raziel": {
      "httpUrl": "https://mcp.tide.org/mcp"
    }
  }
}

extensions:
  "raziel":
    enabled: true
    name: "raziel"
    type: streamable_http
    uri: "https://mcp.tide.org/mcp"
    timeout: 300

Quality 80 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations22 of 22 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: tide_choose_playbook (idempotentHint, openWorldHint); tide_canon (idempotentHint, openWorldHint); tide_list_scenarios (idempotentHint, openWorldHint); …
pass
tools.token_costabout 4,363 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability75 · weight 15

warn
stability.changes14 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvabledependencies not resolved yet

22 tools, about 4,363 tokens to load them all · tool set 102ba60e1880 · tools last changed 2026-10-20 · checked 2026-10-20 14:21 UTC

Tool changes

2026-10-20tide_gapschangedinput schema
2026-10-20tide_doctoradded
FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.
2026-10-20tide_scaffoldadded
START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.
2026-10-20tide_dpop_assetchangeddescription
before
Returns the CONTENTS of `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. The file is NOT shipped in the @tidecloak/* npm packages and is NOT in the TideCloak container, so there is nowhere else to get it: without this tool people search GitHub and find a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.
after · 72% of words in common
Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.
2026-10-20tide_hostingchangedinput schema
2026-10-20tide_blast_radiuschangedinput schema
2026-10-20tide_security_analysischangedinput schema
2026-10-20tide_scenario_bootstrapchangedinput schema
2026-10-20tide_scenario_roleschangedinput schema
2026-10-20tide_scenario_manifestchangedinput schema

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 94 / 100

provenance80

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +reachable +uptime-100% +updated-0d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@tideorg/[email protected] npmnot resolved yet; dependencies are read once a day

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://mcp.tide.org/mcp` streamable-http	none	yes	100%	785 ms	2025-11-25	2026-10-20

package	registry	version	runtime	secrets
`@tideorg/mcp`	npm	1.9.33	npx

Tools (22)

`tide_adapter`read-only	Read an adapter instruction file (AGENTS, CLAUDE, replit)
`tide_blast_radius`read-only	Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.
`tide_branding`read-only	BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.
`tide_canon`read-only	Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)
`tide_choose_playbook`read-only	Recommend the right playbook for a given situation
`tide_choose_scenario`read-only	Match a user request to a known scenario pattern before falling back to generic playbooks
`tide_doctor`read-only	FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.
`tide_dpop_asset`read-only	Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.
`tide_gaps`read-only	Read the gap register — what is still uncertain or unresolved in the pack
`tide_hosting`read-only	Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.
`tide_list`read-only	List all available content in the Tide agent pack by category
`tide_list_scenarios`read-only	List all available scenario patterns under reference-apps/
`tide_onboarding`read-only	STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.
`tide_playbook`read-only	Read a step-by-step playbook for a specific Tide task
`tide_prompt`read-only	Read a reusable starter prompt from the pack
`tide_scaffold`read-only	START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.
`tide_scenario`read-only	Read a scenario summary from reference-apps/<scenario>/scenario.md
`tide_scenario_bootstrap`read-only	Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md
`tide_scenario_manifest`read-only	Read a scenario manifest from reference-apps/<scenario>/manifest.yaml
`tide_scenario_roles`read-only	Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md
`tide_security_analysis`read-only	Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.
`tide_skill`read-only	Read a composable skill definition

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "io.github.tide-foundation/raziel",
  "title": "Raziel",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://mcp.tide.org/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.9.33",
  "packages": [
    {
      "version": "1.9.33",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@tideorg/mcp",
      "runtimeHint": "npx",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org"
    }
  ],
  "repository": {
    "url": "https://github.com/tide-foundation/raziel-mcp",
    "source": "github"
  },
  "description": "MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis"
}