Raziel
MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis
Open source Repository Open in the app JSON README (API)
About
MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis
Details
- Kind
- MCP servers
- Topic
- No topic detected
- Publisher
- tide-foundation
- Origin
- official
- Category
- ferramentas
- Transport
- http
- Version
- 1.9.23
- Last push
- 2026-08-20T09:03:57Z
- Repository state
- ativo
- Language
- Shell
- License
- NOASSERTION
- Added
- 2026-08-29 04:01:33
- Updated
- 2026-08-29 04:01:33
- Origin id
io.github.tide-foundation/raziel
README
# Raziel
[](https://github.com/tide-foundation/raziel-mcp/actions/workflows/qa-gate.yml)
**Raziel is the Tide MCP** — it gives AI coding agents the knowledge to implement [TideCloak](https://tidecloak.com) correctly.
This MCP server gives your AI assistant deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, IGA governance, and Forseti smart contracts — plus a **security gap analysis** of your existing system and **self-host vs managed-hosting** guidance. Instead of guessing, your AI follows verified playbooks.
## Quick Start
### Claude Code (CLI or VS Code extension)
Run this one command:
```bash
claude mcp add tide-pack -- npx -y @tideorg/mcp
```
Done. Start a conversation and ask your agent to add Tide auth to your app.
### Project-level config (any MCP client)
Add a `.mcp.json` file to your project root:
```json
{
"mcpServers": {
"tide-pack": {
"command": "npx",
"args": ["-y", "@tideorg/mcp"]
}
}
}
```
Works with: Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible tool.
### Claude Desktop
Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
```json
{
"mcpServers": {
"tide-pack": {
"command": "npx",
"args": ["-y", "@tideorg/mcp"]
}
}
}
```
### Cursor
Open Settings > MCP Servers > Add Server:
- Name: `tide-pack`
- Command: `npx`
- Args: `-y @tideorg/mcp`
Or add to `.cursor/mcp.json` in your project root.
### Windsurf
Add to `~/.codeium/windsurf/mcp_config.json`:
```json
{
"mcpServers": {
"tide": {
"url": "https://mcp.tide.org/mcp"
}
}
}
```
Or for local: `"command": "npx", "args": ["-y", "@tideorg/mcp"]`
### Zed
Add to your Zed settings (`~/.config/zed/settings.json`):
```json
{
"context_servers": {
"tide": {
"command": {
"path": "npx",
"args": ["-y", "@tideorg/mcp"]
}
}
}
}
```
Note: Zed uses `context_servers` (not `mcpServers`) and doesn't yet support remote URL-based MCP servers — use the npx command.
### OpenAI Codex CLI
Add to `~/.codex/config.json`:
```json
{
"mcpServers": {
"tide": {
"command": "npx",
"args": ["-y", "@tideorg/mcp"]
}
}
}
```
Note: Codex CLI currently supports stdio-based MCP servers only — use the npx command.
### Lovable
Lovable's build agent can use Raziel through a **Custom MCP** connector (available on all plans). In your Lovable project, open **Connectors → Custom MCP** (the card at the bottom) and add:
- **Server name:** `Raziel`
- **Server URL:** `https://mcp.tide.org/mcp`
- **Authentication:** `No authentication`
Then tell the agent to use it — e.g. *"Use the Raziel connector to pull the TideCloak playbook before writing any auth code."*
Two things that trip people up:
- **You attach it, not the agent.** Lovable's agent can't add connectors and won't find Tide in the prebuilt catalog (Tide isn't a catalog partner). Add it yourself in the **Connectors** panel, then point the agent at it — otherwise it will say it "has no way to connect."
- **It's a build-time connector.** It gives Lovable's agent verified Tide knowledge while it generates your app; it does not run inside the published app. You still wire TideCloak into the generated app the normal way.
## What your AI can do with this
Once connected, your AI assistant can:
- **Analyze your existing system** for security gaps and map each one to what Tide fixes (with an honest "what Tide does NOT fix" list)
- **Add Tide auth** to a new or existing Next.js/React app
- **Protect API routes** with server-side JWT + DPoP verification
- **Set up role-based access** with Tide's IGA governance
- **Deploy Forseti smart contracts** for policy-governed encryption and signing
- **Bootstrap TideCloak** — self-hosted (Docker) or partner-hosted (Skycloak) — to a fully configured realm
- **Diagnose issues** like broken login, missing roles, CORS errors
- **Follow security invariants** that prevent common auth mistakes
## Try it
After setup, try these prompts in your AI coding tool:
> Do a security analysis of my app and show what Tide would change
> Add Tide authentication to my Next.js app
> I have an existing app with auth — help me migrate to Tide
> Set up encrypted data sharing between users with Tide
> Help me create a Forseti contract for multi-admin approval
## What's inside
| Category | Count | Examples |
|----------|-------|---------|
| Canon doctrine | 15 files | Security invariants, anti-patterns, security gap mapping, IGA change-request API, hosting options, framework matrix, troubleshooting |
| Playbooks | 18 step-by-step guides | Add auth, protect APIs, verify JWTs, deploy TideCloak, set up E2EE, provision hosted TideCloak |
| Skills | 11 composable roles | Setup, integration, security analysis, route/API protection, review, QA gate |
| Scenarios | 5 reference architectures | Password manager, signing service, encrypted chat, governance panel |
| Prompts | 5 starter prompts | Security gap analysis, secure existing app, migrate auth, admin approval, customer portal |
## Remote Server (no install required)
We host the MCP server so you don't have to install anything. Just add the URL:
```json
{
"mcpServers": {
"tide": {
"url": "https://mcp.tide.org/mcp"
}
}
}
```
No Node.js required. No npx. Works with any MCP client that supports remote servers.
## Self-hosting
Want to run your own instance? Pull from Docker Hub:
```bash
docker run -p 3000:3000 tideorg/mcp
```
Or build from source:
```bash
docker build -t tideorg/mcp .
docker run -p 3000:3000 tideorg/mcp
```
Then point your MCP client at `http://localhost:3000/mcp`.
Optional: set `API_TOKEN` environment variable to require Bearer token auth:
```bash
docker run -p 3000:3000 -e API_TOKEN=your-secret tideorg/mcp
```
## Requirements
- **Remote server**: None (just an MCP client that supports remote URLs)
- **npm/npx install**: Node.js 18+
- **Self-hosted Docker**: Docker
No TideCloak instance needed to start — the agent will guide you through setup.
## Privacy
The MCP server is **read-only**. Run locally (`npx`), it collects nothing — no accounts, no telemetry, no storage. The hosted `mcp.tide.org` endpoint records aggregate usage geography (approximate location only, never request content or tool arguments) to see where it's used. Full details in [PRIVACY.md](PRIVACY.md).
## Links
- [TideCloak](https://tidecloak.com) — The identity platform
- [npm package](https://www.npmjs.com/package/@tideorg/mcp) — `@tideorg/mcp`
- [Privacy policy](PRIVACY.md)
- [Tide Foundation](https://tide.org) — The organisation behind Tide