{"id":300162,"recorded_at":"2026-10-26T22:21:43.082461Z","observed_at":"2026-10-26T22:21:43.082354Z","subject_kind":"endpoint","subject":"b9c42303-b597-4113-a60a-b4ca25cd2dce","kind":"mcp.tools","method":"probe.mcp/1","body":{"count":14,"tools":[{"description":"Archive a list entry so it stops matching. Reversible with castle_unarchive_list_item. Castle: DELETE /v1/lists/{list_id}/items/{id}/archive.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"item_id":{"description":"The item to archive.","type":"string"},"list_id":{"description":"The list holding the item.","type":"string"}},"required":["list_id","item_id"],"type":"object"},"name":"castle_archive_list_item"},{"description":"Count the entries in one list, with the same optional filters as the search. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/count.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"filters":{"description":"Optional {field, op, value} filters over the items.","items":{"additionalProperties":{},"propertyNames":{"type":"string"},"type":"object"},"type":"array"},"list_id":{"description":"The list to count.","type":"string"}},"required":["list_id"],"type":"object"},"name":"castle_count_list_items"},{"description":"Create a new allow or deny list. primary_field is the event field its entries match on, e.g. ip or user.email. Castle: POST /v1/lists.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"color":{"description":"Dashboard colour label, e.g. $red, $green, $blue — Castle requires one.","type":"string"},"description":{"description":"What this list is for.","type":"string"},"name":{"description":"The list name.","type":"string"},"primary_field":{"description":"The event field entries match on, e.g. ip or user.email.","type":"string"},"secondary_field":{"description":"An optional second field entries also carry.","type":"string"}},"required":["name","color","primary_field"],"type":"object"},"name":"castle_create_list"},{"description":"Add an entry to a list — for example block an IP or an email. This changes live policy behaviour. Castle: POST /v1/lists/{list_id}/items.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"author_identifier":{"description":"Who is adding it, e.g. the analyst's email address.","type":"string"},"author_type":{"description":"What kind of actor is adding this entry.","enum":["$analyst_email","$castle_dashboard_user","$castle_policy","$user","$user_email","$other"],"type":"string"},"auto_archives_at":{"description":"ISO-8601 time to archive the entry automatically.","type":"string"},"comment":{"description":"Why this entry was added.","type":"string"},"list_id":{"description":"The list to add to.","type":"string"},"primary_value":{"description":"The value to add, matching the list's primary_field.","type":"string"},"secondary_value":{"description":"Value for the list's secondary_field.","type":"string"}},"required":["list_id","primary_value","author_type","author_identifier"],"type":"object"},"name":"castle_create_list_item"},{"description":"List the event fields you can filter and group on, with their types. Read this first — the other query tools need real field names. Castle: GET /v1/events/schema.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"type":"object"},"name":"castle_get_events_schema"},{"description":"Fetch a single list with its primary and secondary field definitions. Castle: GET /v1/lists/{id}.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"list_id":{"description":"The list's id.","type":"string"}},"required":["list_id"],"type":"object"},"name":"castle_get_list"},{"description":"Fetch a single list entry — its value, who added it, the comment and its archive time. Castle: GET /v1/lists/{list_id}/items/{id}.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"item_id":{"description":"The item's id.","type":"string"},"list_id":{"description":"The list holding the item.","type":"string"}},"required":["list_id","item_id"],"type":"object"},"name":"castle_get_list_item"},{"description":"Aggregate matching events by one or more fields — the fast way to see which IPs, devices or countries dominate a spike. Read-only despite being a POST. Castle: POST /v1/events/group.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"filters":{"description":"Castle query filters, ANDed together. Each is {field, op, value} — e.g. {\"field\":\"user.email\",\"op\":\"$eq\",\"value\":\"a@example.com\"}. Operators: $eq, $neq, $in, $nin, $like, $nlike, $contains, $ncontains, $starts_with, $nstarts_with, $ends_with, $nends_with, $matches, $nmatches, $ip_range, $nip_range, $relative_range (value {gt,gteq,lt,lteq} in seconds ago), $range, $exists. Call castle_get_events_schema first to see the available field names.","items":{"additionalProperties":{},"propertyNames":{"type":"string"},"type":"object"},"type":"array"},"group_by_fields":{"description":"Fields to group by, e.g. [\"ip\", \"user.email\"]. Names come from the event schema.","items":{"type":"string"},"type":"array"},"page":{"description":"1-based page number.","maximum":9007199254740991,"minimum":1,"type":"integer"},"results_size":{"description":"Results per page, 1-100.","maximum":100,"minimum":1,"type":"integer"}},"required":["filters","group_by_fields"],"type":"object"},"name":"castle_group_events"},{"description":"Query the security event stream — logins, registrations, transactions and their risk verdicts. Read-only despite being a POST: Castle takes the query in the body. Castle: POST /v1/events/query.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"columns":{"description":"Only return these event fields.","items":{"type":"string"},"type":"array"},"filters":{"description":"Castle query filters, ANDed together. Each is {field, op, value} — e.g. {\"field\":\"user.email\",\"op\":\"$eq\",\"value\":\"a@example.com\"}. Operators: $eq, $neq, $in, $nin, $like, $nlike, $contains, $ncontains, $starts_with, $nstarts_with, $ends_with, $nends_with, $matches, $nmatches, $ip_range, $nip_range, $relative_range (value {gt,gteq,lt,lteq} in seconds ago), $range, $exists. Call castle_get_events_schema first to see the available field names.","items":{"additionalProperties":{},"propertyNames":{"type":"string"},"type":"object"},"type":"array"},"page":{"description":"1-based page number.","maximum":9007199254740991,"minimum":1,"type":"integer"},"query_type":{"description":"Return matching records, just a count, or both. Defaults to records.","enum":["$records","$count","$records_with_count"],"type":"string"},"results_size":{"description":"Results per page, 1-100.","maximum":100,"minimum":1,"type":"integer"}},"required":["filters"],"type":"object"},"name":"castle_search_events"},{"description":"Search the entries of one list — the blocked IPs, emails or device ids it holds. Read-only despite being a POST. Castle: POST /v1/lists/{list_id}/items/query.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"filters":{"description":"Optional {field, op, value} filters over the items.","items":{"additionalProperties":{},"propertyNames":{"type":"string"},"type":"object"},"type":"array"},"list_id":{"description":"The list to search.","type":"string"},"page":{"description":"1-based page number.","maximum":9007199254740991,"minimum":1,"type":"integer"},"results_size":{"description":"Results per page, 1-100.","maximum":100,"minimum":1,"type":"integer"}},"required":["list_id"],"type":"object"},"name":"castle_search_list_items"},{"description":"Find the allow/deny lists defined in the environment. Read-only despite being a POST. Castle: POST /v1/lists/query.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"filters":{"description":"Optional {field, op, value} filters over the lists themselves.","items":{"additionalProperties":{},"propertyNames":{"type":"string"},"type":"object"},"type":"array"},"page":{"description":"1-based page number.","maximum":9007199254740991,"minimum":1,"type":"integer"},"results_size":{"description":"Results per page, 1-100.","maximum":100,"minimum":1,"type":"integer"}},"type":"object"},"name":"castle_search_lists"},{"description":"Restore a previously archived list entry so it matches again. Castle: PUT /v1/lists/{list_id}/items/{id}/unarchive.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"item_id":{"description":"The item to restore.","type":"string"},"list_id":{"description":"The list holding the item.","type":"string"}},"required":["list_id","item_id"],"type":"object"},"name":"castle_unarchive_list_item"},{"description":"Rename a list or change its colour or description. Castle: PUT /v1/lists/{id}.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"color":{"description":"New colour label.","type":"string"},"description":{"description":"New description.","type":"string"},"list_id":{"description":"The list to update.","type":"string"},"name":{"description":"New name.","type":"string"}},"required":["list_id"],"type":"object"},"name":"castle_update_list"},{"description":"Change the comment on a list entry. Castle: PUT /v1/lists/{list_id}/items/{id}.","inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"comment":{"description":"The new comment.","type":"string"},"item_id":{"description":"The item to update.","type":"string"},"list_id":{"description":"The list holding the item.","type":"string"}},"required":["list_id","item_id","comment"],"type":"object"},"name":"castle_update_list_item"}]},"body_sha256":"fb106ba9e91df0c91ad802abba1dd0d1770b180ebc4780963c722087460d4fd7","prev_id":null,"leaf":"0xbf8ddaa607eec9f8026319de4097b7f9ec7b23b63ad97ee3e8b914f66b316d11","leaf_text":"{\"body\":\"fb106ba9e91df0c91ad802abba1dd0d1770b180ebc4780963c722087460d4fd7\",\"id\":300162,\"kind\":\"mcp.tools\",\"method\":\"probe.mcp/1\",\"observed_us\":1793053303082354,\"prev\":null,\"subject\":\"b9c42303-b597-4113-a60a-b4ca25cd2dce\",\"subject_kind\":\"endpoint\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0xbf8dbf423276b69555322129c1605b33c23c8038eae650d513b980f26924a70a","0xe752a7d2a90f11415ac41345403dd35327b0f0486aaae387cad4d132a1cc68ad","0x8fa2a4891468fe575b9847787a26118131c63e558a1d8ab8137352155e200673","0x2cfbfa1ea6724f8d34df42fd1c004e4ae018726fdc7119dfae7723c286bf13a7","0x27622a4af0b0c9b2932931aa8dbc1ddd4201aa76d3d67c92a694ccc0ab0c4a74","0xe2d6a886a4daf7f6c099fb4dff465bef9de2267cb3d4b0e0787b57478c73f8e5","0x1a3599463985dee4fa517d270fc900e54640f967fe4c8d616b25a85f5a4bd17d","0xa40caef605531919fff1a8fccf5f7453ee266234a3842eff0b8342aade4c73f2","0x2acb1759545dffd0f9d69f1505ae44a8b895f6571c40306d90c2f277ca0e6173","0x756a464688b460d8d275513c88e70a991307cf0931a5c4f982289e598f3c1b81","0x0decbdcd600e934c38d679c1b99f27ba6676644e856ed6ba36bca74feb432866","0xc520305226daa0caf1c2416854f726ec072c950c1903497b2a1e88b0c6f406da","0x96eae331a78c1c9248bc58130ff83d31b884760a51fe7191de2a39105ae7c072","0xdbe2e8dd65ea1248b2936612538f18268abd5cf27ebdab3737694571ad496004","0x9f68b5e15459cb62b8c0cd4c124fa61c74147b4a5755a200fbecd21a581635d1","0x123ec8bee20ddc55223eeef5a4f4d6c4b6416515adbb911c56759f5cde56e452","0xd0651cb9bc8155eb52b5247d506e74b8a935057dc190ba52091702ac25ed3a40","0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}