Castle MCP by usefulapi

Working · 2.2 s

io.usefulapi/castlev1.20.0 Domain verified

Investigate security events and manage the allow/deny lists an analyst acts on.

Security

Source Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://castle.usefulapi.io/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

castle_archive_list_item Destructive

Archive a list entry so it stops matching. Reversible with castle_unarchive_list_item. Castle: DELETE /v1/lists/{list_id}/items/{id}/archive.

item_idstring, required

The item to archive.

list_idstring, required

The list holding the item.

The server marks this tool as destructive. Running it may delete or overwrite data on the server or in any account you connected with your headers.

I understand, run it anyway

Argument	Type	Description
item_id*	string	The item to archive.
list_id*	string	The list holding the item.

Argument	Type	Description
filters	array	Optional {field, op, value} filters over the items.
list_id*	string	The list to count.

Argument	Type	Description
name*	string	The list name.
color*	string	Dashboard colour label, e.g. $red, $green, $blue — Castle requires one.
description	string	What this list is for.
primary_field*	string	The event field entries match on, e.g. ip or user.email.
secondary_field	string	An optional second field entries also carry.

Argument	Type	Description
comment	string	Why this entry was added.
list_id*	string	The list to add to.
author_type*	string	What kind of actor is adding this entry.
primary_value*	string	The value to add, matching the list's primary_field.
secondary_value	string	Value for the list's secondary_field.
auto_archives_at	string	ISO-8601 time to archive the entry automatically.
author_identifier*	string	Who is adding it, e.g. the analyst's email address.

Argument	Type	Description
item_id*	string	The item's id.
list_id*	string	The list holding the item.

Argument	Type	Description
page	integer	1-based page number.
filters*	array	Castle query filters, ANDed together. Each is {field, op, value} — e.g. {"field":"user.email","op":"$eq","value":"[email protected]"}. Operators: $eq, $neq, $in, $nin, $like, $nlike, $contains, $ncontains, $starts_with, $nstarts_with, $ends_with, $nends_with, $matches, $nmatches, $ip_range, $nip_range, $relative_range (value {gt,gteq,lt,lteq} in seconds ago), $range, $exists. Call castle_get_events_schema first to see the available field names.
results_size	integer	Results per page, 1-100.
group_by_fields*	array	Fields to group by, e.g. ["ip", "user.email"]. Names come from the event schema.

Argument	Type	Description
item_id*	string	The item to restore.
list_id*	string	The list holding the item.

Argument	Type	Description
name	string	New name.
color	string	New colour label.
list_id*	string	The list to update.
description	string	New description.

Argument	Type	Description
comment*	string	The new comment.
item_id*	string	The item to update.
list_id*	string	The list holding the item.

Try it

castle_archive_list_item Destructive

Try it

castle_archive_list_item Destructive

Tools (14)