Investigate security events and manage the allow/deny lists an analyst acts on. Hosted by usefulapi: connect it to Claude, ChatGPT, Cursor or any MCP client.
Turn on the Castle connector, then ask in plain words. The AI picks the tools.
For fraud and security analysts who investigate login and sign-up events in Castle.
The AI reads the event fields, then groups matching events by IP, device or country. You see which values dominate, for example after a burst of failed logins.
The AI searches the security event stream for logins, registrations and transactions and shows each event with its risk verdict, so you can follow one device or user.
The AI finds the lists in the environment, shows their field definitions, counts the entries and searches the blocked IPs, emails or device ids a list holds.
The AI adds an IP, email or other value to a list, for example to block it, or edits the comment on an entry. Adding an entry changes live policy behaviour.
Changes dataThe AI archives an entry so it stops matching, or restores an archived entry so it matches again. You can find the entry first by searching the list.
Changes dataThe login page asks for your Castle API secret.
Find it in Castle → Settings → API. Your token is used only to call the API on your behalf and to derive a private account id; it is never shown to anyone.
Team and Enterprise: an Owner adds the connector for the organization first.
No Add custom MCP server option? It depends on your account or workspace settings: see OpenAI's guide.
Run this command, then run /mcp in Claude Code to log in:
Add to Cursor or add this to ~/.cursor/mcp.json:
{
"mcpServers": {
"castle": {
"url": "https://castle.usefulapi.io/mcp"
}
}
} Add to VS Code or add this to .vscode/mcp.json:
{
"servers": {
"castle": {
"type": "http",
"url": "https://castle.usefulapi.io/mcp"
}
}
} Run these commands. The second one opens the login page:
Windsurf, Cline, Zed and other MCP clients: add this URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser.
Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Castle API secret. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
| Plan | Price | Limit |
|---|---|---|
| Free | $0 | 50 tool calls / month |
| Pro | $9/mo · $90/yr | 10,000 tool calls / month |
| Pro+ | $39/mo · $390/yr | 100,000 tool calls / month |
Each paid plan covers this Castle server only. Ask your AI to run castle_upgrade and choose Pro or Pro+, billed monthly or yearly (it returns a Stripe Checkout link). If you already have Pro, ask to change it to Pro+. The change requires your confirmation, keeps your billing interval and charges the price difference for the rest of the period immediately. Cancel any time with castle_cancel_subscription: your paid plan continues to the end of the paid period, with no refund for the current period, and asking to resume the same plan with castle_upgrade before then undoes the cancel. Or write to [email protected].
castle_get_events_schemacastle_search_eventscastle_group_eventscastle_search_listscastle_get_listcastle_search_list_itemscastle_count_list_itemscastle_get_list_itemcastle_create_listcastle_update_listcastle_create_list_itemcastle_update_list_itemcastle_archive_list_itemcastle_unarchive_list_itemcastle_usage_statuscastle_request_featurecastle_upgradecastle_cancel_subscriptionFind which IPs, devices or countries drive a spike. Review recent logins, sign-ups and their risk verdicts. Review what is on an allow or deny list. Add an entry to a list or change its comment. Archive or restore a list entry. See what you can do for the details.
No. usefulapi is an independent service. It is not affiliated with or endorsed by Castle. The server calls the Castle API with your own Castle access, so it sees only the data that your account can see.
Yes. In Claude, add this server's URL as a custom connector. In ChatGPT, add it as a custom MCP server in Plugins. Then log in once. Cursor, VS Code, Claude Code and Codex work too. See the setup steps.
The login page asks for your Castle API secret. See Before you connect for where to find it.
No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Castle API secret. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
The login stores them encrypted in the authorization grant of your connection. The server uses them to call the Castle API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in Castle.
Yes, if you approve it. 6 of the 14 Castle tools can create or change data. The other 8 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.
The Free plan gives 50 tool calls / month. Pro costs $9/mo or $90/yr, with 10,000 tool calls / month. Pro+ costs $39/mo or $390/yr, with 100,000 tool calls / month. Each subscription covers this Castle server only. Cancel any time: your paid plan then runs to the end of the paid period. Run castle_usage_status to see how many calls you used.
Ask the AI to run castle_upgrade and choose Pro or Pro+, billed monthly or yearly: it returns a Stripe Checkout link. If you already have Pro, ask to change it to Pro+. After you confirm, your existing subscription changes in place, keeps its billing interval and charges the price difference for the rest of the period immediately. To cancel, run castle_cancel_subscription. Your paid plan continues to the end of the paid period.
Tell the AI what you wanted to do. It can send the request with castle_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.
Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, ChatGPT, Codex, Cursor, VS Code, Windsurf and others.
This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.
Need a tool this server does not have, or a connection to another system? We build custom integrations and MCP servers.