io.github.tide-foundation/raziel

Est-ce que io.github.tide-foundation/raziel est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.tide-foundation/raziel » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 22 outils

• tide_adapter≈ 106 tokens

  Read an adapter instruction file (AGENTS, CLAUDE, replit)

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Adapter file name. Available: AGENTS, CLAUDE, replit

  Exemple d'appel

  {"name": "tide_adapter", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_blast_radius≈ 264 tokens

  Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

  Paramètres, retour & exemple (1)

  Paramètres

  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.

  Exemple d'appel

  {"name": "tide_blast_radius", "arguments": {"part": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_branding≈ 352 tokens

  BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.

  Paramètres, retour & exemple (4)

  Paramètres

  • realm · string · optionnel
    Realm to brand, e.g. 'myapp'. Fills in the command.
  • accent · string · optionnel
    Hex accent colour without '#', e.g. '2f6f4e'. Default 1f6feb.
  • appName · string · optionnel
    App name. Deterministically varies the mark's geometry so realms look distinct.
  • tidecloakUrl · string · optionnel
    Base URL. Default http://localhost:8080.

  Exemple d'appel

  {"name": "tide_branding", "arguments": {"realm": "texte", "accent": "texte", "appName": "texte", "tidecloakUrl": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_canon≈ 306 tokens

  Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

  Paramètres, retour & exemple (3)

  Paramètres

  • name · string · requis
    Canon file name. Available: agent-authority, anti-patterns, breach-precedents, concepts, custom-contracts, feature-mapping, framework-matrix, hosting-options, iga-change-requests-api, invariants, redirect-handler, security-gap-mapping, security-runtime-probes, tide-neutralization, tidecloak-bootstrap, tidecloak-endpoints, tidify-compatibility, troubleshooting, ux-states, verifiable-claims, version-policy
  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.
  • section · string · optionnel
    Return only the section(s) whose heading contains this text, e.g. 'AP-62' or 'T-26'. Use it when another document points you at one entry.

  Exemple d'appel

  {"name": "tide_canon", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_choose_playbook≈ 114 tokens

  Recommend the right playbook for a given situation

  Paramètres, retour & exemple (1)

  Paramètres

  • situation · string · requis
    Describe what the builder wants to do, e.g. 'add login to a new Next.js app'

  Exemple d'appel

  {"name": "tide_choose_playbook", "arguments": {"situation": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_choose_scenario≈ 124 tokens

  Match a user request to a known scenario pattern before falling back to generic playbooks

  Paramètres, retour & exemple (1)

  Paramètres

  • situation · string · requis
    Describe the app or problem, e.g. 'build an organisation password manager'

  Exemple d'appel

  {"name": "tide_choose_scenario", "arguments": {"situation": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_doctor≈ 413 tokens

  FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.

  Paramètres, retour & exemple (4)

  Paramètres

  • realm · string · optionnel
    Realm name. Adds read-only realm checks (needs the admin password in .env).
  • appDir · string · optionnel
    App directory. Default: the current directory.
  • appUrl · string · optionnel
    URL of the RUNNING app, e.g. http://localhost:3000. Adds checks of what is actually served.
  • checkOnly · boolean · optionnel
    Report only and change nothing (for CI). Default false: mechanical faults are repaired.

  Exemple d'appel

  {"name": "tide_doctor", "arguments": {"realm": "texte", "appDir": "texte", "appUrl": "texte", "checkOnly": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_dpop_asset≈ 202 tokens

  Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "tide_dpop_asset", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_gaps≈ 125 tokens

  Read the gap register — what is still uncertain or unresolved in the pack

  Paramètres, retour & exemple (1)

  Paramètres

  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.

  Exemple d'appel

  {"name": "tide_gaps", "arguments": {"part": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_hosting≈ 284 tokens

  Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.

  Paramètres, retour & exemple (1)

  Paramètres

  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.

  Exemple d'appel

  {"name": "tide_hosting", "arguments": {"part": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_list≈ 128 tokens

  List all available content in the Tide agent pack by category

  Paramètres, retour & exemple (1)

  Paramètres

  • category · string · requis · canon | playbooks | skills | prompts | adapters | scenarios | all
    Which category to list, or 'all' for everything

  Exemple d'appel

  {"name": "tide_list", "arguments": {"category": "canon"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_list_scenarios≈ 56 tokens

  List all available scenario patterns under reference-apps/

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "tide_list_scenarios", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_onboarding≈ 447 tokens

  STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.

  Paramètres, retour & exemple (6)

  Paramètres

  • realm · string · optionnel
    Realm, e.g. 'vialproof'. Fills in the commands.
  • fields · array · optionnel
    Which fields to collect. ASK THE USER FIRST — do not guess. Default ['firstName','lastName'].
  • appName · string · optionnel
    App name, e.g. 'Mood Garden'. Used in the modal's copy.
  • framework · string · optionnel · nextjs-app | nextjs-pages | react-vite
    Controls the mounting snippet. Default nextjs-app.
  • tidecloakUrl · string · optionnel
    Base URL. Default http://localhost:8080.
  • componentPath · string · optionnel
    Where to WRITE the component, e.g. 'src/components/ProfileOnboarding.tsx'.

  Exemple d'appel

  {"name": "tide_onboarding", "arguments": {"realm": "texte", "fields": [], "appName": "texte", "framework": "nextjs-app", "tidecloakUrl": "texte", "componentPath": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_playbook≈ 266 tokens

  Read a step-by-step playbook for a specific Tide task

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    Playbook name. Available: add-auth-nextjs-existing, add-auth-nextjs-fresh, add-rbac-nextjs, bootstrap-realm-from-template, configure-e2ee-roles-and-policies, deploy-forseti-policy, deploy-tidecloak-docker, diagnose-broken-login, diagnose-missing-roles-or-claims, initialize-admin-and-link-account, migrate-from-existing-auth, protect-api-nextjs, protect-aspnet-core-asgard, protect-routes-nextjs, provision-tidecloak-skycloak, setup-forseti-e2ee, setup-iga-admin-panel, start-tidecloak-dev, verify-jwt-server-side
  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.

  Exemple d'appel

  {"name": "tide_playbook", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_prompt≈ 132 tokens

  Read a reusable starter prompt from the pack

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Prompt file name. Available: add-admin-approval-flow, build-private-customer-portal, migrate-generic-auth-to-tide, red-team-review, secure-existing-app, security-gap-analysis

  Exemple d'appel

  {"name": "tide_prompt", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_scaffold≈ 346 tokens

  START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.

  Paramètres, retour & exemple (4)

  Paramètres

  • appDir · string · optionnel
    Directory to create the app in. Default: the current directory.
  • appName · string · optionnel
    Lowercase name, e.g. 'mood-garden'. Becomes the package name, and so the realm and client names.
  • template · string · optionnel · nextjs-customer-portal | nextjs-e2ee-vault | react-vite-internal-dashboard | vanilla-js-secure-form
    Choose a template explicitly instead of from `situation`.
  • situation · string · optionnel
    What the user wants to build, in their words. Used to pick the template.

  Exemple d'appel

  {"name": "tide_scaffold", "arguments": {"appDir": "texte", "appName": "texte", "template": "nextjs-customer-portal", "situation": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_scenario≈ 196 tokens

  Read a scenario summary from reference-apps/<scenario>/scenario.md

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation
  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.

  Exemple d'appel

  {"name": "tide_scenario", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_scenario_bootstrap≈ 158 tokens

  Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation

  Exemple d'appel

  {"name": "tide_scenario_bootstrap", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_scenario_manifest≈ 153 tokens

  Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation

  Exemple d'appel

  {"name": "tide_scenario_manifest", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_scenario_roles≈ 157 tokens

  Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation

  Exemple d'appel

  {"name": "tide_scenario_roles", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_security_analysis≈ 258 tokens

  Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

  Paramètres, retour & exemple (2)

  Paramètres

  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.
  • include_runtime_probes · boolean · optionnel
    Include the runtime-confirmation probe procedures (canon/security-runtime-probes.md). Only relevant when the operator is authorized to probe a live target. Defaults to true.

  Exemple d'appel

  {"name": "tide_security_analysis", "arguments": {"part": 1, "include_runtime_probes": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tide_skill≈ 248 tokens

  Read a composable skill definition

  Paramètres, retour & exemple (3)

  Paramètres

  • name · string · requis
    Skill name. Available: grc-review, tide-diagnostics, tide-integration, tide-learning-capture, tide-mcp-qa, tide-rbac-and-e2ee, tide-red-team, tide-reviewer, tide-route-and-api-protection, tide-scenario-resolver, tide-security-analyst, tide-setup, tide-solutions-architect
  • part · integer · optionnel
    Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are.
  • section · string · optionnel
    Return only the section(s) whose heading contains this text, e.g. 'AP-62' or 'T-26'. Use it when another document points you at one entry.

  Exemple d'appel

  {"name": "tide_skill", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.tide.org/mcp