INDIVIDUAL MCP TOOL

castle_get_events_schema

List the event fields you can filter and group on, with their types.

usefulapi.ionone authenticationAvailability not checked

LIVE ENDPOINT

https://castle.usefulapi.io/mcp

No auth detected

Connect to this endpoint to inspect the live schema for castle_get_events_schema and invoke it with your own arguments.

{}

Inferred read-only · medium confidence · heuristic, not a guarantee.

No write-capable action terms were found; this is not proof that invocation has no side effects.

CONNECT WITH APPROVAL

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.castle-mcp]
url = "https://castle.usefulapi.io/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "castle-mcp": {
      "type": "http",
      "url": "https://castle.usefulapi.io/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: castle-mcp
Remote MCP URL: https://castle.usefulapi.io/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "castle-mcp": {
      "url": "https://castle.usefulapi.io/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "castle-mcp": {
      "type": "http",
      "url": "https://castle.usefulapi.io/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "castle-mcp",
  "transport": "streamable-http",
  "url": "https://castle.usefulapi.io/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

castle_search_events — Query the security event stream — logins, registrations, transactions and their risk verdicts.
castle_group_events — Aggregate matching events by one or more fields — the fast way to see which IPs, devices or countries dominate a spike.
castle_search_lists — Find the allow/deny lists defined in the environment.
castle_get_list — Fetch a single list with its primary and secondary field definitions.
castle_search_list_items — Search the entries of one list — the blocked IPs, emails or device ids it holds.
castle_count_list_items — Count the entries in one list, with the same optional filters as the search.
castle_get_list_item — Fetch a single list entry — its value, who added it, the comment and its archive time.
castle_create_list — Create a new allow or deny list.