{
  "markdown": "# Raziel\n\n[![MCP QA Gate](https://github.com/tide-foundation/raziel-mcp/actions/workflows/qa-gate.yml/badge.svg)](https://github.com/tide-foundation/raziel-mcp/actions/workflows/qa-gate.yml)\n\n**Raziel is the Tide MCP** — it gives AI coding agents the knowledge to implement [TideCloak](https://tidecloak.com) correctly.\n\nThis MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a **security gap analysis** of your existing system and **self-host vs managed-hosting** guidance. Instead of guessing, your AI follows verified playbooks.\n\n## Quick Start\n\n### Claude Code (CLI or VS Code extension)\n\nRun this one command:\n\n```bash\nclaude mcp add tide-pack -- npx -y @tideorg/mcp\n```\n\nDone. Start a conversation and ask your agent to add Tide auth to your app.\n\n### Project-level config (any MCP client)\n\nAdd a `.mcp.json` file to your project root:\n\n```json\n{\n  \"mcpServers\": {\n    \"tide-pack\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tideorg/mcp\"]\n    }\n  }\n}\n```\n\nWorks with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.\n\n### Claude Desktop\n\nEdit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"tide-pack\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tideorg/mcp\"]\n    }\n  }\n}\n```\n\n### Cursor\n\nOpen Settings > MCP Servers > Add Server:\n- Name: `tide-pack`\n- Command: `npx`\n- Args: `-y @tideorg/mcp`\n\nOr add to `.cursor/mcp.json` in your project root.\n\n### Windsurf\n\nAdd to `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"tide\": {\n      \"url\": \"https://mcp.tide.org/mcp\"\n    }\n  }\n}\n```\n\nOr for local: `\"command\": \"npx\", \"args\": [\"-y\", \"@tideorg/mcp\"]`\n\n### Zed\n\nAdd to your Zed settings (`~/.config/zed/settings.json`):\n\n```json\n{\n  \"context_servers\": {\n    \"tide\": {\n      \"command\": {\n        \"path\": \"npx\",\n        \"args\": [\"-y\", \"@tideorg/mcp\"]\n      }\n    }\n  }\n}\n```\n\nNote: Zed uses `context_servers` (not `mcpServers`) and doesn't yet support remote URL-based MCP servers — use the npx command.\n\n### OpenAI Codex CLI\n\nAdd to `~/.codex/config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"tide\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tideorg/mcp\"]\n    }\n  }\n}\n```\n\nNote: Codex CLI currently supports stdio-based MCP servers only — use the npx command.\n\n### Lovable\n\nLovable's build agent can use Raziel through a **Custom MCP** connector (available on all plans). In your Lovable project, open **Connectors → Custom MCP** (the card at the bottom) and add:\n\n- **Server name:** `Raziel`\n- **Server URL:** `https://mcp.tide.org/mcp`\n- **Authentication:** `No authentication`\n\nThen tell the agent to use it — e.g. *\"Use the Raziel connector to pull the TideCloak playbook before writing any auth code.\"*\n\nTwo things that trip people up:\n\n- **You attach it, not the agent.** Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the **Connectors** panel, then point the agent at it — otherwise it will say it \"has no way to connect.\"\n- **It's a build-time connector.** It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.\n\n## What your AI can do with this\n\nOnce connected, your AI assistant can:\n\n- **Analyze your existing system** for security gaps and map each one to what Tide fixes (with an honest \"what Tide does NOT fix\" list)\n- **Add Tide auth** to a new or existing Next.js/React app\n- **Protect API routes** with server-side JWT + DPoP verification\n- **Set up role-based access** with Tide's IGA governance\n- **Deploy Forseti smart contracts** for policy-governed encryption and signing\n- **Bootstrap TideCloak** — self-hosted (Docker) or partner-hosted (Skycloak) — to a fully configured realm\n- **Diagnose issues** like broken login, missing roles, CORS errors\n- **Follow security invariants** that prevent common auth mistakes\n\n## Try it\n\nAfter setup, try these prompts in your AI coding tool:\n\n> Do a security analysis of my app and show what Tide would change\n\n> Add Tide authentication to my Next.js app\n\n> I have an existing app with auth — help me migrate to Tide\n\n> Set up encrypted data sharing between users with Tide\n\n> Help me create a Forseti contract for multi-admin approval\n\n## What's inside\n\n| Category | Count | Examples |\n|----------|-------|---------|\n| Canon doctrine | 15 files | Security invariants, anti-patterns, security gap mapping, IGA change-request API, hosting options, framework matrix, troubleshooting |\n| Playbooks | 18 step-by-step guides | Add auth, protect APIs, verify JWTs, deploy TideCloak, set up E2EE, provision hosted TideCloak |\n| Skills | 11 composable roles | Setup, integration, security analysis, route/API protection, review, QA gate |\n| Scenarios | 5 reference architectures | Password manager, signing service, encrypted chat, governance panel |\n| Prompts | 5 starter prompts | Security gap analysis, secure existing app, migrate auth, admin approval, customer portal |\n\n## Remote Server (no install required)\n\nWe host the MCP server so you don't have to install anything. Just add the URL:\n\n```json\n{\n  \"mcpServers\": {\n    \"tide\": {\n      \"url\": \"https://mcp.tide.org/mcp\"\n    }\n  }\n}\n```\n\nNo Node.js required. No npx. Works with any MCP client that supports remote servers.\n\n## Self-hosting\n\nWant to run your own instance? Pull from Docker Hub:\n\n```bash\ndocker run -p 3000:3000 tideorg/mcp\n```\n\nOr build from source:\n\n```bash\ndocker build -t tideorg/mcp .\ndocker run -p 3000:3000 tideorg/mcp\n```\n\nThen point your MCP client at `http://localhost:3000/mcp`.\n\nOptional: set `API_TOKEN` environment variable to require Bearer token auth:\n\n```bash\ndocker run -p 3000:3000 -e API_TOKEN=your-secret tideorg/mcp\n```\n\n## Requirements\n\n- **Remote server**: None (just an MCP client that supports remote URLs)\n- **npm/npx install**: Node.js 18+\n- **Self-hosted Docker**: Docker\n\nNo TideCloak instance needed to start — the agent will guide you through setup.\n\n## Privacy\n\nThe MCP server is **read-only**. Run locally (`npx`), it collects nothing — no accounts, no telemetry, no storage. The hosted `mcp.tide.org` endpoint records aggregate usage geography (approximate location only, never request content or tool arguments) to see where it's used. Full details in [PRIVACY.md](PRIVACY.md).\n\n## Links\n\n- [TideCloak](https://tidecloak.com) — The identity platform\n- [npm package](https://www.npmjs.com/package/@tideorg/mcp) — `@tideorg/mcp`\n- [Privacy policy](PRIVACY.md)\n- [Tide Foundation](https://tide.org) — The organisation behind Tide\n",
  "bytes": 6806,
  "sha": "30f6a1583fbe7219bf923961868aa8894e7fbe3cb43535e94a2b7bb1ce3dee47",
  "repo_slug": "tide-foundation/raziel-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_tide_foundation_raziel_5e9022ec/readme"
}