MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Read an adapter instruction file (AGENTS, CLAUDE, replit)
Adapter file name. Available: AGENTS, CLAUDE, replit
Read an adapter instruction file (AGENTS, CLAUDE, replit)
| Argument | Type | Description |
|---|---|---|
| name* | string | Adapter file name. Available: AGENTS, CLAUDE, replit |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Adapter file name. Available: AGENTS, CLAUDE, replit"
}
},
"additionalProperties": false
}Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.
| Argument | Type | Description |
|---|---|---|
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
}
},
"additionalProperties": false
}BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can generate images. Pass realm/accent/appName to get the command pre-filled. CALL THIS whenever branding, a logo, a background, theming or 'skinning' the enclave or login screen comes up — then RUN the command; do not just describe it.
| Argument | Type | Description |
|---|---|---|
| realm | string | Realm to brand, e.g. 'myapp'. Fills in the command. |
| accent | string | Hex accent colour without '#', e.g. '2f6f4e'. Default 1f6feb. |
| appName | string | App name. Deterministically varies the mark's geometry so realms look distinct. |
| tidecloakUrl | string | Base URL. Default http://localhost:8080. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"realm": {
"type": "string",
"description": "Realm to brand, e.g. 'myapp'. Fills in the command."
},
"accent": {
"type": "string",
"description": "Hex accent colour without '#', e.g. '2f6f4e'. Default 1f6feb."
},
"appName": {
"type": "string",
"description": "App name. Deterministically varies the mark's geometry so realms look distinct."
},
"tidecloakUrl": {
"type": "string",
"description": "Base URL. Default http://localhost:8080."
}
},
"additionalProperties": false
}Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)
| Argument | Type | Description |
|---|---|---|
| name* | string | Canon file name. Available: agent-authority, anti-patterns, breach-precedents, concepts, custom-contracts, feature-mapping, framework-matrix, hosting-options, iga-change-requests-api, invariants, redirect-handler, security-gap-mapping, security-runtime-probes, tide-neutralization, tidecloak-bootstrap, tidecloak-endpoints, tidify-compatibility, troubleshooting, ux-states, verifiable-claims, version-policy |
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
| section | string | Return only the section(s) whose heading contains this text, e.g. 'AP-62' or 'T-26'. Use it when another document points you at one entry. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Canon file name. Available: agent-authority, anti-patterns, breach-precedents, concepts, custom-contracts, feature-mapping, framework-matrix, hosting-options, iga-change-requests-api, invariants, redirect-handler, security-gap-mapping, security-runtime-probes, tide-neutralization, tidecloak-bootstrap, tidecloak-endpoints, tidify-compatibility, troubleshooting, ux-states, verifiable-claims, version-policy"
},
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
},
"section": {
"type": "string",
"description": "Return only the section(s) whose heading contains this text, e.g. 'AP-62' or 'T-26'. Use it when another document points you at one entry."
}
},
"additionalProperties": false
}Recommend the right playbook for a given situation
| Argument | Type | Description |
|---|---|---|
| situation* | string | Describe what the builder wants to do, e.g. 'add login to a new Next.js app' |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"situation"
],
"properties": {
"situation": {
"type": "string",
"description": "Describe what the builder wants to do, e.g. 'add login to a new Next.js app'"
}
},
"additionalProperties": false
}Match a user request to a known scenario pattern before falling back to generic playbooks
| Argument | Type | Description |
|---|---|---|
| situation* | string | Describe the app or problem, e.g. 'build an organisation password manager' |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"situation"
],
"properties": {
"situation": {
"type": "string",
"description": "Describe the app or problem, e.g. 'build an organisation password manager'"
}
},
"additionalProperties": false
}FIND AND FIX WHAT IS WRONG WITH A TIDE APP, IN ONE COMMAND. Returns the command that checks an app for the faults behind most broken logins and unprotected APIs. It REPAIRS the mechanical ones itself (re-copies the DPoP page byte-exact, corrects a wrong rewrite path, gitignores .env) and prints the exact fix for the rest, which YOU apply — do not pass the list to the user. Covers: DPoP page missing/stale/served without its headers, useDPoP passed as a JSX prop (silently OFF), createTideCloakProxy called without protectedRoutes (protects nothing), adapter without its embedded key, remote JWKS, Bearer-only token parsing, no server-side verification, secrets about to be committed, a destructive change request pending. CALL THIS after scaffolding or changing auth code, BEFORE telling the user it works, and FIRST whenever a login or an API check misbehaves. This tool call itself only returns the command.
| Argument | Type | Description |
|---|---|---|
| realm | string | Realm name. Adds read-only realm checks (needs the admin password in .env). |
| appDir | string | App directory. Default: the current directory. |
| appUrl | string | URL of the RUNNING app, e.g. http://localhost:3000. Adds checks of what is actually served. |
| checkOnly | boolean | Report only and change nothing (for CI). Default false: mechanical faults are repaired. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"realm": {
"type": "string",
"description": "Realm name. Adds read-only realm checks (needs the admin password in .env)."
},
"appDir": {
"type": "string",
"description": "App directory. Default: the current directory."
},
"appUrl": {
"type": "string",
"description": "URL of the RUNNING app, e.g. http://localhost:3000. Adds checks of what is actually served."
},
"checkOnly": {
"type": "boolean",
"description": "Report only and change nothing (for CI). Default false: mechanical faults are repaired."
}
},
"additionalProperties": false
}Returns the exact command that installs `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. `@tidecloak/js` ships the file from 0.14.34; older SDKs and the TideCloak container do not, and a GitHub search finds a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THIS whenever DPoP is enabled (it is on by default), whenever a login fails with TIDE-SWE-UNHANDLED or 'Popup DPoP verification failed to load', and before copying this file from anywhere else.
No arguments.
{
"type": "object",
"properties": {}
}Read the gap register — what is still uncertain or unresolved in the pack
| Argument | Type | Description |
|---|---|---|
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
}
},
"additionalProperties": false
}Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production', 'deploy TideCloak', 'go live', 'host this somewhere', 'managed option', 'stable URL', 'can someone host TideCloak for us', or any request to stand up an instance where local-vs-hosted has not been settled.
| Argument | Type | Description |
|---|---|---|
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
}
},
"additionalProperties": false
}List all available content in the Tide agent pack by category
| Argument | Type | Description |
|---|---|---|
| category* | string | Which category to list, or 'all' for everything |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"category"
],
"properties": {
"category": {
"enum": [
"canon",
"playbooks",
"skills",
"prompts",
"adapters",
"scenarios",
"all"
],
"type": "string",
"description": "Which category to list, or 'all' for everything"
}
},
"additionalProperties": false
}List all available scenario patterns under reference-apps/
No arguments.
{
"type": "object",
"properties": {}
}STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onboarding, 'Update Account Information', a profile/details form, or 'what users see after they create an account' comes up -- and ALSO proactively once a realm is bootstrapped, because the default is that every new user hits that page.
| Argument | Type | Description |
|---|---|---|
| realm | string | Realm, e.g. 'vialproof'. Fills in the commands. |
| fields | array | Which fields to collect. ASK THE USER FIRST — do not guess. Default ['firstName','lastName']. |
| appName | string | App name, e.g. 'Mood Garden'. Used in the modal's copy. |
| framework | string | Controls the mounting snippet. Default nextjs-app. |
| tidecloakUrl | string | Base URL. Default http://localhost:8080. |
| componentPath | string | Where to WRITE the component, e.g. 'src/components/ProfileOnboarding.tsx'. |
Read a step-by-step playbook for a specific Tide task
| Argument | Type | Description |
|---|---|---|
| name* | string | Playbook name. Available: add-auth-nextjs-existing, add-auth-nextjs-fresh, add-rbac-nextjs, bootstrap-realm-from-template, configure-e2ee-roles-and-policies, deploy-forseti-policy, deploy-tidecloak-docker, diagnose-broken-login, diagnose-missing-roles-or-claims, initialize-admin-and-link-account, migrate-from-existing-auth, protect-api-nextjs, protect-aspnet-core-asgard, protect-routes-nextjs, provision-tidecloak-skycloak, setup-forseti-e2ee, setup-iga-admin-panel, start-tidecloak-dev, verify-jwt-server-side |
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Playbook name. Available: add-auth-nextjs-existing, add-auth-nextjs-fresh, add-rbac-nextjs, bootstrap-realm-from-template, configure-e2ee-roles-and-policies, deploy-forseti-policy, deploy-tidecloak-docker, diagnose-broken-login, diagnose-missing-roles-or-claims, initialize-admin-and-link-account, migrate-from-existing-auth, protect-api-nextjs, protect-aspnet-core-asgard, protect-routes-nextjs, provision-tidecloak-skycloak, setup-forseti-e2ee, setup-iga-admin-panel, start-tidecloak-dev, verify-jwt-server-side"
},
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
}
},
"additionalProperties": false
}Read a reusable starter prompt from the pack
| Argument | Type | Description |
|---|---|---|
| name* | string | Prompt file name. Available: add-admin-approval-flow, build-private-customer-portal, migrate-generic-auth-to-tide, red-team-review, secure-existing-app, security-gap-analysis |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Prompt file name. Available: add-admin-approval-flow, build-private-customer-portal, migrate-generic-auth-to-tide, red-team-review, secure-existing-app, security-gap-analysis"
}
},
"additionalProperties": false
}START A NEW TIDE APP FROM A WORKING TEMPLATE. Returns the exact commands to copy a complete, building app — login, the DPoP page and its wiring, server-side token AND proof verification, and the realm bootstrap script — then install, bootstrap and check it. CALL THIS when building a new app, BEFORE writing any auth code: the code that most often goes wrong (provider config, DPoP, route and API protection) is then copied, not retyped. Pass `situation` and it picks the template; or name one. Not for adding Tide to an existing app.
| Argument | Type | Description |
|---|---|---|
| appDir | string | Directory to create the app in. Default: the current directory. |
| appName | string | Lowercase name, e.g. 'mood-garden'. Becomes the package name, and so the realm and client names. |
| template | string | Choose a template explicitly instead of from `situation`. |
| situation | string | What the user wants to build, in their words. Used to pick the template. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"appDir": {
"type": "string",
"description": "Directory to create the app in. Default: the current directory."
},
"appName": {
"type": "string",
"description": "Lowercase name, e.g. 'mood-garden'. Becomes the package name, and so the realm and client names."
},
"template": {
"enum": [
"nextjs-customer-portal",
"nextjs-e2ee-vault",
"react-vite-internal-dashboard",
"vanilla-js-secure-form"
],
"type": "string",
"description": "Choose a template explicitly instead of from `situation`."
},
"situation": {
"type": "string",
"description": "What the user wants to build, in their words. Used to pick the template."
}
},
"additionalProperties": false
}Read a scenario summary from reference-apps/<scenario>/scenario.md
| Argument | Type | Description |
|---|---|---|
| name* | string | Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation |
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation"
},
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
}
},
"additionalProperties": false
}Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md
| Argument | Type | Description |
|---|---|---|
| name* | string | Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation"
}
},
"additionalProperties": false
}Read a scenario manifest from reference-apps/<scenario>/manifest.yaml
| Argument | Type | Description |
|---|---|---|
| name* | string | Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation"
}
},
"additionalProperties": false
}Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md
| Argument | Type | Description |
|---|---|---|
| name* | string | Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Scenario name. Available: attestation, attested-provenance-registry, encrypted-communication, git-pr-signing-service, iga-admin-governance, organisation-password-manager, policy-governed-signing, relationship-attestation"
}
},
"additionalProperties": false
}Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.
| Argument | Type | Description |
|---|---|---|
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
| include_runtime_probes | boolean | Include the runtime-confirmation probe procedures (canon/security-runtime-probes.md). Only relevant when the operator is authorized to probe a live target. Defaults to true. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
},
"include_runtime_probes": {
"type": "boolean",
"description": "Include the runtime-confirmation probe procedures (canon/security-runtime-probes.md). Only relevant when the operator is authorized to probe a live target. Defaults to true."
}
},
"additionalProperties": false
}Read a composable skill definition
| Argument | Type | Description |
|---|---|---|
| name* | string | Skill name. Available: grc-review, tide-diagnostics, tide-integration, tide-learning-capture, tide-mcp-qa, tide-rbac-and-e2ee, tide-red-team, tide-reviewer, tide-route-and-api-protection, tide-scenario-resolver, tide-security-analyst, tide-setup, tide-solutions-architect |
| part | integer | Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are. |
| section | string | Return only the section(s) whose heading contains this text, e.g. 'AP-62' or 'T-26'. Use it when another document points you at one entry. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Skill name. Available: grc-review, tide-diagnostics, tide-integration, tide-learning-capture, tide-mcp-qa, tide-rbac-and-e2ee, tide-red-team, tide-reviewer, tide-route-and-api-protection, tide-scenario-resolver, tide-security-analyst, tide-setup, tide-solutions-architect"
},
"part": {
"type": "integer",
"minimum": 1,
"description": "Which part to return when the document is delivered in several parts. Omit for part 1; the response says how many there are."
},
"section": {
"type": "string",
"description": "Return only the section(s) whose heading contains this text, e.g. 'AP-62' or 'T-26'. Use it when another document points you at one entry."
}
},
"additionalProperties": false
}{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"realm": {
"type": "string",
"description": "Realm, e.g. 'vialproof'. Fills in the commands."
},
"fields": {
"type": "array",
"items": {
"enum": [
"displayName",
"firstName",
"lastName",
"email"
],
"type": "string"
},
"description": "Which fields to collect. ASK THE USER FIRST — do not guess. Default ['firstName','lastName']."
},
"appName": {
"type": "string",
"description": "App name, e.g. 'Mood Garden'. Used in the modal's copy."
},
"framework": {
"enum": [
"nextjs-app",
"nextjs-pages",
"react-vite"
],
"type": "string",
"description": "Controls the mounting snippet. Default nextjs-app."
},
"tidecloakUrl": {
"type": "string",
"description": "Base URL. Default http://localhost:8080."
},
"componentPath": {
"type": "string",
"description": "Where to WRITE the component, e.g. 'src/components/ProfileOnboarding.tsx'."
}
},
"additionalProperties": false
}