io.usefulapi/castle

up checked 2026-11-11T08:37:38.842Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

Castle MCP by usefulapi

Publisher-provided description

Investigate security events and manage the allow/deny lists an analyst acts on.

Summary by lookupd

Queries security event streams and manages allow/deny lists, including adding, archiving and counting entries that affect live policy.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http castle https://castle.usefulapi.io/mcp

Codex, remote (streamable-http)

codex mcp add castle --url https://castle.usefulapi.io/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "castle": {
      "url": "https://castle.usefulapi.io/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (14 tools)

Publisher-provided text

• castle_get_events_schema List the event fields you can filter and group on, with their types. Read this first — the other query tools need real field names. Castle: GET /v1/events/schem
• castle_search_events Query the security event stream — logins, registrations, transactions and their risk verdicts. Read-only despite being a POST: Castle takes the query in the bod
• castle_group_events Aggregate matching events by one or more fields — the fast way to see which IPs, devices or countries dominate a spike. Read-only despite being a POST. Castle:
• castle_search_lists Find the allow/deny lists defined in the environment. Read-only despite being a POST. Castle: POST /v1/lists/query.
• castle_get_list Fetch a single list with its primary and secondary field definitions. Castle: GET /v1/lists/{id}.
• castle_search_list_items Search the entries of one list — the blocked IPs, emails or device ids it holds. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/query.
• castle_count_list_items Count the entries in one list, with the same optional filters as the search. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/count.
• castle_get_list_item Fetch a single list entry — its value, who added it, the comment and its archive time. Castle: GET /v1/lists/{list_id}/items/{id}.
• castle_create_list Create a new allow or deny list. primary_field is the event field its entries match on, e.g. ip or user.email. Castle: POST /v1/lists.
• castle_update_list Rename a list or change its colour or description. Castle: PUT /v1/lists/{id}.
• castle_create_list_item Add an entry to a list — for example block an IP or an email. This changes live policy behaviour. Castle: POST /v1/lists/{list_id}/items.
• castle_update_list_item Change the comment on a list entry. Castle: PUT /v1/lists/{list_id}/items/{id}.
• castle_archive_list_item Archive a list entry so it stops matching. Reversible with castle_unarchive_list_item. Castle: DELETE /v1/lists/{list_id}/items/{id}/archive.
• castle_unarchive_list_item Restore a previously archived list entry so it matches again. Castle: PUT /v1/lists/{list_id}/items/{id}/unarchive.

Details

• Version: 1.37.3
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 390 ms
• First indexed: 2026-11-01T10:03:57.936Z
• Last seen in registry: 2026-11-11T00:17:21.516Z
• Repository: https://github.com/m190/usefulapi-mcp
• Website: https://usefulapi.io/castle/

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.usefulapi/castle.svg)](https://lookupd.com/servers/io.usefulapi/castle)

• 62033 servers
• Last crawl: 2026-11-11T15:38:39.561Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp