Raziel
MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis
| Endpoint | https://mcp.tide.org/mcp (streamable-http) |
|---|---|
| Registry version | 1.9.34 |
| Now | 22 tools · grade C (71) · pin ts_7f2c128c0e4e6832acc4922d8129ae27 · protocol 2025-06-18 |
| First / last listed | 2026-11-01 03:21 UTC / 2026-11-01 03:21 UTC |
| Grade over time | 2026-11-01: C (71), 22 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: tide_list tide_canon tide_playbook tide_skill tide_prompt tide_adapter tide_list_scenarios tide_scenario tide_scenario_manifest tide_scenario_roles tide_scenario_bootstrap tide_choose_scenario tide_choose_playbook tide_security_analysis tide_blast_radius tide_hosting tide_dpop_asset tide_onboarding tide_branding tide_scaffold tide_doctor tide_gaps
tide_list | List all available content in the Tide agent pack by category params: category* |
tide_canon | Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.) params: name*, section, part |
tide_playbook | Read a step-by-step playbook for a specific Tide task params: name*, part |
tide_skill | Read a composable skill definition params: name*, section, part |
tide_prompt | Read a reusable starter prompt from the pack params: name* |
tide_adapter | Read an adapter instruction file (AGENTS, CLAUDE, replit) params: name* |
tide_list_scenarios | List all available scenario patterns under reference-apps/ params: none |
tide_scenario | Read a scenario summary from reference-apps/<scenario>/scenario.md params: name*, part |
tide_scenario_manifest | Read a scenario manifest from reference-apps/<scenario>/manifest.yaml params: name* |
tide_scenario_roles | Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md params: name* |
tide_scenario_bootstrap | Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md params: name* |
tide_choose_scenario | Match a user request to a known scenario pattern before falling back to generic playbooks params: situation* |
tide_choose_playbook | Recommend the right playbook for a given situation params: situation* |
tide_security_analysis | Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'. params: include_runtime_probes, part |
tide_blast_radius | Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 compa params: part |
tide_hosting | Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) b params: part |
tide_dpop_asset | Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fall params: none |
tide_onboarding | STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop Re params: realm, tidecloakUrl, appName, fields, componentPath, framework |
tide_branding | BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB params: realm, accent, appName, tidecloakUrl |
tide_scaffold | START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API pro params: situation, template, appDir, appName |
tide_doctor | FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missin params: appUrl, realm, appDir, checkOnly |
tide_gaps | Read the gap register — what is still uncertain or unresolved in the pack params: part |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.