Tide Foundation has released Raziel, an MCP server for AI developer assistants that flips the conventional logic of scanners: instead of looking for entry points, it starts from the assumption that the attacker has already obtained root and assesses what they can do inside the system. At its core is the concept of emergent authority — instead of permanently storing permissions with a single holder, they are cryptographically computed at the moment of action. The product is available at tide.org/agent-plugins, and open source code allows the approach to be tested hands-on.
What Happened
Raziel, named after the archangel of secrets, equips AI developer assistants with deep knowledge of Tide authentication, threshold cryptography, end-to-end encryption, and governance, recommends self-hosted or managed hosting, and generates verified playbooks for integration. Based on scan results, the server builds a blast radius map — a list of where an attacker with root access can impersonate any user and assign themselves any permissions. The product is available at tide.org/agent-plugins.
Context
MCP is a protocol through which AI agents connect to external tools and data, so releasing a security product in this format means that security knowledge is delivered directly into the coding agent's workflow, rather than into documentation for humans. The technical foundation of the approach is threshold cryptography, where keys and permissions are split into parts among participants: none of them holds full control, and an attacker who compromises a server with root gains nothing valuable. In the traditional perimeter model, protection is built around central holders of privileges — root keys, admin accounts, identity providers, vaults, MFA, and EDR. Emergent authority offers the opposite: authority is not permanently stored by a single entity, but is computed at the moment identity, policy, context, and intent align, and then immediately disappears, so collected permissions cannot be recovered.
Why This Matters for the Industry
The “assume the attacker is already root” approach brings the fail-safe idea into IAM design and reduces the cost of a single mistake in code or configuration: a compromised machine does not give the attacker a ready-made set of permissions. The distribution channel is equally important: security knowledge is packaged for the first time as an MCP server, meaning the product is designed from the start for AI agent access, not for a human reading documentation — this is a cheaper GTM and an early marker of the shift toward “security for agentic development.” If independent latency benchmarks for threshold cryptography and the first public deployments appear, the approach could take its place in the agentic security stack alongside vaults and EDR, especially in the self-hosted segment, and blast radius assessment before deployment could become a separate step in CI/CD and agentic pipelines; the “security as MCP context” pattern will likely be copied by other vendors regardless of Raziel's fate.
Why This Matters for Users
If you are piloting AI agents in development, you can connect Raziel as an MCP server to your assistant, ask it to generate a TideCloak integration playbook — an open-source system that replaces IAM — and build a blast radius map of your current infrastructure. Open source code on GitHub and a quickstart at docs.tide.org allow you to deploy a test environment and verify the claims hands-on, while the white paper with a chatbot at tide.org/whitepaper explains threshold cryptography without reading 50 pages. This is at the level of experiments and pilots in a small team, not production: load testing will be needed before live use.
What Is Still Unknown / Limitations
The entire evidence base is currently vendor-provided: the sources contain no independent benchmarks, audits, or formal model of emergent authority. The availability of open source TideCloak code is an opportunity to run the system, not reproducibility of the claimed security properties: they do not confirm cryptographic guarantees or the quality of the blast radius map, and the methodology and metrics by which this map is calculated are not disclosed in the materials. There is also no data on latency, cost, or real deployments, so replacing an existing IAM based on vendor materials is premature.
Sources
- The New Stack — Tide launched Raziel for AI security. It assumes hackers are inside.
- Tide — Raziel MCP server for AI agents (agent-plugins)
- Tide Foundation — White paper on emergent authority
- Tide — documentation and quickstart
- Hacker News — discussion of AI security that assumes the attacker has root
Author
Look at AI, editorial team