Castle MCP by usefulapi
Investigate security events and manage the allow/deny lists an analyst acts on.
Connect it
Settings → Connectors → Add custom connector
URL: https://castle.usefulapi.io/mcpSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://castle.usefulapi.io/mcp{
"mcpServers": {
"castle": {
"url": "https://castle.usefulapi.io/mcp"
}
}
}claude mcp add --transport http castle https://castle.usefulapi.io/mcp{
"servers": {
"castle": {
"type": "http",
"url": "https://castle.usefulapi.io/mcp"
}
}
}14 tools, verified live
castle_get_events_schemaread-onlyList the event fields you can filter and group on, with their types. Read this first — the other query tools need real field names. Castle: GET /v1/events/schema.
castle_search_eventsread-onlyQuery the security event stream — logins, registrations, transactions and their risk verdicts. Read-only despite being a POST: Castle takes the query in the body. Castle: POST /v1/events/query.
castle_group_eventsread-onlyAggregate matching events by one or more fields — the fast way to see which IPs, devices or countries dominate a spike. Read-only despite being a POST. Castle: POST /v1/events/group.
castle_search_listsread-onlyFind the allow/deny lists defined in the environment. Read-only despite being a POST. Castle: POST /v1/lists/query.
castle_get_listread-onlyFetch a single list with its primary and secondary field definitions. Castle: GET /v1/lists/{id}.
castle_search_list_itemsread-onlySearch the entries of one list — the blocked IPs, emails or device ids it holds. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/query.
castle_count_list_itemsread-onlyCount the entries in one list, with the same optional filters as the search. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/count.
castle_get_list_itemread-onlyFetch a single list entry — its value, who added it, the comment and its archive time. Castle: GET /v1/lists/{list_id}/items/{id}.
castle_create_listcan modifyCreate a new allow or deny list. primary_field is the event field its entries match on, e.g. ip or user.email. Castle: POST /v1/lists.
castle_update_listcan modifyRename a list or change its colour or description. Castle: PUT /v1/lists/{id}.
castle_create_list_itemcan modifyAdd an entry to a list — for example block an IP or an email. This changes live policy behaviour. Castle: POST /v1/lists/{list_id}/items.
castle_update_list_itemcan modifyChange the comment on a list entry. Castle: PUT /v1/lists/{list_id}/items/{id}.
castle_archive_list_itemcan modifyArchive a list entry so it stops matching. Reversible with castle_unarchive_list_item. Castle: DELETE /v1/lists/{list_id}/items/{id}/archive.
castle_unarchive_list_itemcan modifyRestore a previously archived list entry so it matches again. Castle: PUT /v1/lists/{list_id}/items/{id}/unarchive.
Alternatives in Security
Compare →CPContinueOps Public MCPB
BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA.
QuizBaseB
MCP server for trivia: 1.4M+ questions (EN+PL), 24 categories, 12 tools + 4 prompts, OAuth 2.1.
HSHelixar SecurityB
Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.
PTPentest ToolsB
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
SkycloakB
Managed Keycloak from any MCP client: clusters, realms, apps, SSO, users, domains, audit events.
Tektolo Rental PropertyB
Rental property tools for agents: turnover cost estimates and security deposit rules by US state.