usefulapi

Castle MCP server. Investigate security events and manage the allow/deny lists an analyst acts on.

Claude

Open Settings → Connectors → Add custom connector
Paste this URL:
https://castle.usefulapi.io/mcp
Authenticate with Castle when prompted

Cursor · VS Code · Windsurf · Cline

Add to your MCP config, then reload & authorize:

{
  "mcpServers": {
    "castle": {
      "url": "https://castle.usefulapi.io/mcp"
    }
  }
}

live14 toolsFree 100 tool calls / monthPro $9/mo · $90/yr

Tools 14

Tool	Type	What it does
`castle_get_events_schema`	read	Get the event schema List the event fields you can filter and group on, with their types. Read this first — the other query tools need real field names. Castle: GET /v1/events/schema.
`castle_search_events`	read	Search security events Query the security event stream — logins, registrations, transactions and their risk verdicts. Read-only despite being a POST: Castle takes the query in the body. Castle: POST /v1/events/query.
`castle_group_events`	read	Group security events Aggregate matching events by one or more fields — the fast way to see which IPs, devices or countries dominate a spike. Read-only despite being a POST. Castle: POST /v1/events/group.
`castle_search_lists`	read	Search lists Find the allow/deny lists defined in the environment. Read-only despite being a POST. Castle: POST /v1/lists/query.
`castle_get_list`	read	Get one list Fetch a single list with its primary and secondary field definitions. Castle: GET /v1/lists/{id}.
`castle_search_list_items`	read	Search items in a list Search the entries of one list — the blocked IPs, emails or device ids it holds. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/query.
`castle_count_list_items`	read	Count items in a list Count the entries in one list, with the same optional filters as the search. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/count.
`castle_get_list_item`	read	Get one list item Fetch a single list entry — its value, who added it, the comment and its archive time. Castle: GET /v1/lists/{list_id}/items/{id}.
`castle_create_list`	write	Create a list Create a new allow or deny list. primary_field is the event field its entries match on, e.g. ip or user.email. Castle: POST /v1/lists.
`castle_update_list`	write	Update a list Rename a list or change its colour or description. Castle: PUT /v1/lists/{id}.
`castle_create_list_item`	write	Add an item to a list Add an entry to a list — for example block an IP or an email. This changes live policy behaviour. Castle: POST /v1/lists/{list_id}/items.
`castle_update_list_item`	write	Update a list item's comment Change the comment on a list entry. Castle: PUT /v1/lists/{list_id}/items/{id}.
`castle_archive_list_item`	write	Archive a list item Archive a list entry so it stops matching. Reversible with castle_unarchive_list_item. Castle: DELETE /v1/lists/{list_id}/items/{id}/archive.
`castle_unarchive_list_item`	write	Unarchive a list item Restore a previously archived list entry so it matches again. Castle: PUT /v1/lists/{list_id}/items/{id}/unarchive.

Pricing

Plan	Price	Limit
Free	$0	100 tool calls / month
Pro	$9/mo · $90/yr	Unlimited

This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.