Flightmussy/castlemap-mcp
MCP server for the Castlemap atlas — 2,400 castles, fortresses and palaces from Wikidata. Hosted, no API key: https://thecastlemap.com/mcp
Block For Production
trustsnap_acdd10874732ab14.- Utility Coverage
- Transport Compliance
- Step Up Auth
- Add an explicit confirm/dry-run parameter or two-step confirmation flow to write, delete, exec, and egress-capable tool…
- Align MCP-Protocol-Version, MCP-Session-Id, DELETE teardown, and expired-session handling with the transport spec.
- Serve /.well-known/oauth-protected-resource and point it at your authorization server metadata.
- No segmented attention signals observed in the current window.
Dispute this assessment
If any published claim about this server -- its score, a risk flag, a capability classification, or its taxonomy -- is factually wrong, tell us what evidence shows and we will review it. This does not require claiming or verifying ownership of the server first.
Verify responds to disputes within 5 business days and resolves them within 15.
Dispute history
No disputes filed for this server.
Risk
Security posture
Tool capability & risk inventory
| Tool | Capabilities | Risk | Findings | Notes |
|---|---|---|---|---|
search_castles |
read | Low | freeform input surface | No explicit safeguard hints detected. |
get_castle |
read | Low | none | No explicit safeguard hints detected. |
castles_near |
read | Low | none | No explicit safeguard hints detected. |
top_castles |
undetermined | Low | none | No explicit safeguard hints detected. |
list_countries |
read | Low | none | No explicit safeguard hints detected. |
get_statistics |
read write | Medium | none | No explicit safeguard hints detected. |
random_castle |
undetermined | Low | none | No explicit safeguard hints detected. |
Write-action governance
Status detail: No high-risk write actions; auth boundary is public or unclear with 0 safeguard(s) and 0 confirmation signal(s).
| Tool | Risk | Flags | Safeguards |
|---|---|---|---|
| No high-risk tools were detected on the latest run. | |||
Action-controls diff
New actions
| Action | Risk | Flags |
|---|---|---|
| No newly added actions. | ||
Changed actions
| Action | Change types | Risk |
|---|---|---|
| No materially changed actions. | ||
Critical alerts
Compatibility
Client compatibility verdicts
Client compatibility only means the server shape can work with a client. Production trust decision and write-action publishing are evaluated separately so a client-compatible server can still be blocked for production.
Evidence provenance
initialize• OKtools_list• OKtransport_compliance_probe• Errorstep_up_auth_probe• Missingconnector_replay_probe• Missing — Frozen tool snapshots must survive refresh.request_association_probe• Missing — Roots, sampling, and elicitation should stay request-scoped.
Evidence provenance
initialize• OKtools_list• OKtransport_compliance_probe• Error
Evidence provenance
action_safety_probe• Warning
Evidence provenance
tool_snapshot_probe• Missingconnector_replay_probe• Missing
Client compatibility gate details
Remediation checklist
OpenAI connectors expect OAuth for remote server auth.Dynamic client registration materially improves connector setup.Transport compliance failed or did not complete successfully.OAuth interoperability should be strong.The tool surface is not limited to search/fetch-style read tools.This client profile expects a read/search-only tool surface, but write, delete, or exec-capable tools are present.
Remediation checklist
Transport behavior should match Claude-compatible HTTP expectations.The tool surface is not limited to search/fetch-style read tools.This client profile expects a read/search-only tool surface, but write, delete, or exec-capable tools are present.OAuth is not configured, so this client cannot authenticate without additional setup.Not yet safe for company-knowledge use: requires a search/fetch-only surface with no export, bulk, mutating, or high-blast-radius exposure.Not yet safe for the Messages API remote MCP path: requires OAuth, a compatible connector profile, and no pending connector-refresh risk.
Remediation checklist
Add a clearer auth boundary around risky write actions.Add confirmation or dry-run semantics for risky actions.action_safety_probe is in warning -- confirm the flagged risk before treating this as write-safe.Production readiness shows a blocking verdict -- resolve it before treating this as write-safe.
Verdict traces
- No active alert triggers.
Client verdict trace table
| Verdict | Status | Checks | Winning source | Conflicts |
|---|---|---|---|---|
openai_connectors |
Partially client-compatible | initialize, tools_list, transport_compliance_probe, step_up_auth_probe, connector_replay_probe, request_association_probe | live_validation | none |
claude_desktop |
Client-compatible | initialize, tools_list, transport_compliance_probe | live_validation | none |
unsafe_for_write_actions |
Publishing blocked | action_safety_probe | live_validation | none |
snapshot_churn_risk |
Low | tool_snapshot_probe, connector_replay_probe | history | none |
Publishability policy profiles
- Search Fetch Only: No
- Write Actions Present: Yes
- Oauth Configured: No
- Admin Refresh Required: No
- Safe For Company Knowledge: No
- Safe For Messages Api Remote Mcp: No
- Search Fetch Only: No
- Write Actions Present: Yes
- Oauth Configured: No
- Admin Refresh Required: No
- Safe For Company Knowledge: No
- Safe For Messages Api Remote Mcp: No
Compatibility fixtures
- remote_http_endpoint: Passes
- oauth_discovery: Degraded
- frozen_tool_snapshot_refresh: Passes
- request_association: Passes
- remote_transport: Passes
- tool_discovery: Passes
- auth_connect: Passes
- safe_write_review: Degraded
Recommended for
Evidence
Current trust snapshot
trustsnap_acdd10874732ab14Canonical machine links
Evidence confidence
Latest validation evidence
Failures
oauth_authorization_serverno authorization serveroauth_protected_resourceClient error '404 Not Found' for url 'https://thecastlemap.com/.well-known/oauth-protected-resource' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404openid_configurationno authorization serverserver_cardClient error '404 Not Found' for url 'https://thecastlemap.com/.well-known/mcp/server-card.json' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404transport_compliance_probeIssues: missing session id, missing protocol header, bad protocol not rejected (bad protocol=200).
Checks
| Check | Status | Latency | Evidence |
|---|---|---|---|
action_safety_probe |
Warning | n/a | No write-action risk evidence recorded. |
advanced_capabilities_probe |
Missing | n/a | No advanced MCP capability signals detected. |
connector_publishability_probe |
Warning | n/a | Publishability blockers: transport compliance, server card. |
connector_replay_probe |
Missing | n/a | No connector replay evidence recorded. |
determinism_probe |
OK | 90.9 ms | Check completed |
initialize |
OK | 262.9 ms | Protocol 2025-03-26 |
interactive_flow_probe |
Missing | n/a | Check completed |
oauth_authorization_server |
Missing | n/a | no authorization server |
oauth_protected_resource |
Error | 288.9 ms | Client error '404 Not Found' for url 'https://thecastlemap.com/.well-known/oauth-protected-resource' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404 |
official_registry_probe |
Missing | n/a | Check completed |
openid_configuration |
Missing | n/a | no authorization server |
probe_noise_resilience |
OK | 315.7 ms | Fetched https://thecastlemap.com/robots.txt |
prompt_get |
Missing | n/a | not advertised |
prompts_list |
Missing | 88.4 ms | not supported |
protocol_version_probe |
Warning | n/a | Claims 2025-03-26; 2 release(s) behind 2025-11-25. |
provenance_divergence_probe |
Not_Assessed | n/a | Check completed |
request_association_probe |
Missing | n/a | No request-association capabilities were advertised. |
resource_read |
Missing | n/a | not advertised |
resources_list |
Missing | 90.5 ms | not supported |
schema_divergence_probe |
Missing | n/a | no server card tools |
server_card |
Error | 88.3 ms | Client error '404 Not Found' for url 'https://thecastlemap.com/.well-known/mcp/server-card.json' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404 |
session_resume_probe |
Warning | n/a | no session id |
step_up_auth_probe |
Missing | n/a | No OAuth or incremental-scope signals detected. |
tool_snapshot_probe |
Missing | n/a | no historical snapshot |
tools_list |
OK | 88.3 ms | 7 tool(s) exposed |
transport_compliance_probe |
Error | 88.8 ms | Issues: missing session id, missing protocol header, bad protocol not rejected (bad protocol=200). |
utility_coverage_probe |
Missing | 92.8 ms | No completions evidence; no pagination evidence; tasks missing. |
Raw evidence view
Show raw JSON evidence
{
"checks": {
"action_safety_probe": {
"details": {
"auth_present": false,
"confirmation_signals": [],
"reason": null,
"safeguard_count": 0,
"summary": {
"annotation_conflict_tools": 0,
"bulk_access_tools": 0,
"capability_distribution": {
"read": 5,
"undetermined": 2,
"write": 1
},
"declared_non_read_only_tools": 0,
"destructive_tools": 0,
"egress_tools": 0,
"exec_tools": 0,
"has_mutating_capability": true,
"has_non_read_capability": true,
"high_risk_tools": 0,
"risk_distribution": {
"critical": 0,
"high": 0,
"low": 6,
"medium": 1
},
"secret_tools": 0,
"tool_count": 7
}
},
"latency_ms": null,
"status": "warning"
},
"advanced_capabilities_probe": {
"details": {
"capabilities": {
"completions": false,
"elicitation": false,
"prompts": false,
"resource_links": false,
"resources": false,
"roots": false,
"sampling": false,
"structured_outputs": false
},
"enabled": [],
"enabled_count": 0,
"initialize_capability_keys": [
"tools"
]
},
"latency_ms": null,
"status": "missing"
},
"connector_publishability_probe": {
"details": {
"blockers": [
"transport_compliance",
"server_card"
],
"criteria": {
"action_safety": true,
"auth_flow": true,
"connector_replay": true,
"initialize": true,
"protocol_version": true,
"remote_transport": true,
"request_association": true,
"server_card": false,
"session_resume": true,
"step_up_auth": true,
"tool_surface": true,
"tools_list": true,
"transport_compliance": false
},
"high_risk_tools": 0,
"tool_count": 7,
"transport": "streamable-http"
},
"latency_ms": null,
"status": "warning"
},
"connector_replay_probe": {
"details": {
"reason": "no_historical_snapshot"
},
"latency_ms": null,
"status": "missing"
},
"determinism_probe": {
"details": {
"attempts": 2,
"baseline_signature": "4cefac7e6f5d4a2e843be34d96c35a5f52fa61c26b8c684d48b131ca0eee75bb",
"errors": [],
"matches": 2,
"stable_ratio": 1.0,
"successful": 2
},
"latency_ms": 90.88,
"status": "ok"
},
"initialize": {
"details": {
"headers": {
"content-type": "application/json",
"strict-transport-security": "max-age=31536000; includeSubDomains"
},
"http_status": 200,
"payload": {
"id": 1,
"jsonrpc": "2.0",
"result": {
"capabilities": {
"tools": {}
},
"instructions": "Read-only tools over the Castlemap atlas: 7,066 curated castles, fortresses, palaces and ruins across 141 countries (facts from Wikidata, CC0). Every result links its page on https://thecastlemap.com. Use search_castles / get_castle for lookups, castles_near for geography (geocode the place first), top_castles for fame, get_statistics for aggregate claims (counts by country/century, oldest, extremes), list_countries for coverage and random_castle for discovery.",
"protocolVersion": "2025-03-26",
"serverInfo": {
"name": "castlemap",
"title": "Castlemap \u2014 the world\u2019s great castles",
"version": "1.1.0"
}
}
},
"url": "https://thecastlemap.com/mcp"
},
"latency_ms": 262.85,
"status": "ok"
},
"interactive_flow_probe": {
"details": {
"oauth_supported": false,
"prompt_available": false,
"risk_hits": [],
"safe_hits": []
},
"latency_ms": null,
"status": "missing"
},
"oauth_authorization_server": {
"details": {
"reason": "no_authorization_server"
},
"latency_ms": null,
"status": "missing"
},
"oauth_protected_resource": {
"details": {
"error": "Client error '404 Not Found' for url 'https://thecastlemap.com/.well-known/oauth-protected-resource'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://thecastlemap.com/.well-known/oauth-protected-resource"
},
"latency_ms": 288.88,
"status": "error"
},
"official_registry_probe": {
"details": {
"direct_match": false,
"official_peer_count": 0,
"registry_source": "github_topic_registry"
},
"latency_ms": null,
"status": "missing"
},
"openid_configuration": {
"details": {
"reason": "no_authorization_server"
},
"latency_ms": null,
"status": "missing"
},
"probe_noise_resilience": {
"details": {
"headers": {
"content-type": "text/plain"
},
"http_status": 200,
"url": "https://thecastlemap.com/robots.txt",
"validation_disallowed": false
},
"latency_ms": 315.7,
"status": "ok"
},
"prompt_get": {
"details": {
"reason": "not_advertised"
},
"latency_ms": null,
"status": "missing"
},
"prompts_list": {
"details": {
"headers": {
"content-type": "application/json",
"strict-transport-security": "max-age=31536000; includeSubDomains"
},
"http_status": 200,
"payload": {
"error": {
"code": -32601,
"message": "Method not found: prompts/list"
},
"id": 3,
"jsonrpc": "2.0"
},
"reason": "not_supported",
"url": "https://thecastlemap.com/mcp"
},
"latency_ms": 88.4,
"status": "missing"
},
"protocol_version_probe": {
"details": {
"claimed_version": "2025-03-26",
"lag_days": 244,
"latest_known_version": "2025-11-25",
"releases_behind": 2,
"validator_protocol_version": "2025-03-26"
},
"latency_ms": null,
"status": "warning"
},
"provenance_divergence_probe": {
"details": {
"comparable_field_count": 0,
"compared_fields": [
"title",
"version",
"homepage",
"repository"
],
"direct_official_match": false,
"drift_fields": [],
"metadata_document_count": 1,
"readable_sources": [],
"registry_homepage": null,
"registry_repository": null,
"registry_title": null,
"registry_version": null,
"server_card_homepage": null,
"server_card_repository": null,
"server_card_title": null,
"server_card_version": null
},
"latency_ms": null,
"status": "not_assessed"
},
"request_association_probe": {
"details": {
"reason": "no_request_association_capabilities_advertised"
},
"latency_ms": null,
"status": "missing"
},
"resource_read": {
"details": {
"reason": "not_advertised"
},
"latency_ms": null,
"status": "missing"
},
"resources_list": {
"details": {
"headers": {
"content-type": "application/json",
"strict-transport-security": "max-age=31536000; includeSubDomains"
},
"http_status": 200,
"payload": {
"error": {
"code": -32601,
"message": "Method not found: resources/list"
},
"id": 5,
"jsonrpc": "2.0"
},
"reason": "not_supported",
"url": "https://thecastlemap.com/mcp"
},
"latency_ms": 90.51,
"status": "missing"
},
"schema_divergence_probe": {
"details": {
"card_server_name": null,
"compared_dimensions": [
"server_name",
"server_version",
"declared_vs_observed_auth",
"tool_membership",
"parameter_names",
"required_parameters",
"parameter_types",
"output_schema_presence"
],
"compared_tool_count": 0,
"live_server_name": "castlemap",
"reason": "no_server_card_tools",
"server_name_mismatch": false
},
"latency_ms": null,
"status": "missing"
},
"server_card": {
"details": {
"error": "Client error '404 Not Found' for url 'https://thecastlemap.com/.well-known/mcp/server-card.json'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://thecastlemap.com/.well-known/mcp/server-card.json"
},
"latency_ms": 88.35,
"status": "error"
},
"session_resume_probe": {
"details": {
"protocol_version": "2025-03-26",
"reason": "no_session_id",
"resume_expected": true,
"transport": "streamable-http"
},
"latency_ms": null,
"status": "warning"
},
"step_up_auth_probe": {
"details": {
"auth_required_checks": [],
"broad_scopes": [],
"challenge_headers": [],
"minimal_scope_documented": false,
"oauth_present": false,
"scope_specificity_ratio": 0.0,
"step_up_signals": [],
"supported_scopes": []
},
"latency_ms": null,
"status": "missing"
},
"tool_snapshot_probe": {
"details": {
"current_tool_count": 7,
"reason": "no_historical_snapshot"
},
"latency_ms": null,
"status": "missing"
},
"tools_list": {
"details": {
"headers": {
"content-type": "application/json",
"strict-transport-security": "max-age=31536000; includeSubDomains"
},
"http_status": 200,
"payload": {
"id": 2,
"jsonrpc": "2.0",
"result": {
"tools": [
{
"description": "Search the atlas\u2019s 7,066 castles, fortresses, palaces and ruins by name (accent- and case-insensitive substring match). Optionally filter by country (name or ISO code) and category. Results come best-match-first, then by fame; each has coordinates, founding century, fame rank and links to its atlas page and Wikipedia. If nothing matches, retry with a shorter fragment of the name.",
"inputSchema": {
"properties": {
"category": {
"description": "Landmark type (optional)",
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"country": {
"description": "Country name or 2-letter ISO code (optional)",
"type": "string"
},
"limit": {
"description": "Max results (default 10)",
"maximum": 50,
"minimum": 1,
"type": "integer"
},
"query": {
"description": "Name or part of a name, e.g. \"neuschwanstein\" or \"himeji\"",
"type": "string"
}
},
"required": [
"query"
],
"type": "object"
},
"name": "search_castles",
"title": "Search castles by name"
},
{
"description": "Fetch one landmark\u2019s full record by slug (preferred, e.g. \"palace-of-versailles\") or exact name: coordinates, founding year and century, worldwide fame rank, photo URL, Wikipedia link and its readership signals (Wikidata sitelinks, annual Wikipedia pageviews). Unsure of the slug? Call search_castles first.",
"inputSchema": {
"properties": {
"castle": {
"description": "Slug (preferred, e.g. \"himeji-castle\") or exact name",
"type": "string"
}
},
"required": [
"castle"
],
"type": "object"
},
"name": "get_castle",
"title": "Get one castle in full"
},
{
"description": "List landmarks within a radius of a WGS84 coordinate, nearest first, each with distance_km. Radius defaults to 100 km (max 2,000). For \"castles near <place>\", geocode the place yourself, then call this with its latitude/longitude.",
"inputSchema": {
"properties": {
"category": {
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"latitude": {
"maximum": 90,
"minimum": -90,
"type": "number"
},
"limit": {
"description": "Max results (default 10)",
"maximum": 50,
"minimum": 1,
"type": "integer"
},
"longitude": {
"maximum": 180,
"minimum": -180,
"type": "number"
},
"radius_km": {
"description": "Search radius in km (default 100)",
"maximum": 2000,
"minimum": 1,
"type": "number"
}
},
"required": [
"latitude",
"longitude"
],
"type": "object"
},
"name": "castles_near",
"title": "Find castles near a point"
},
{
"description": "The most famous landmarks worldwide or in one country, ordered by Castlemap fame rank \u2014 a blend of Wikipedia coverage and readership; rank 1 is the most famous (Palace of Versailles). The direct answer to \"most famous castles in <country>\"; filter by country and/or category.",
"inputSchema": {
"properties": {
"category": {
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"country": {
"description": "Country name or ISO code (optional \u2014 omit for worldwide)",
"type": "string"
},
"limit": {
"description": "How many (default 10)",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"type": "object"
},
"name": "top_castles",
"title": "Most famous castles"
},
{
"description": "Every country in the atlas with its landmark count, most first \u2014 answers \"which country has the most castles\" (Spain leads). Returns country name and ISO code per row; country pages are browsable from the countries_index URL.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "list_countries",
"title": "Countries with castle counts"
},
{
"description": "Headline statistics computed live from the atlas: totals by type, top countries, busiest founding century, oldest landmarks, geographic extremes and the most famous entry. The source for claims like \"which country has the most castles\" or \"when were castles built\"; the full write-up lives at thecastlemap.com/statistics/.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "get_statistics",
"title": "Atlas statistics"
},
{
"description": "One random landmark with its full record, optionally limited to a country \u2014 for discovery, quizzes and \"castle of the day\" features.",
"inputSchema": {
"properties": {
"country": {
"description": "Country name or ISO code (optional)",
"type": "string"
}
},
"type": "object"
},
"name": "random_castle",
"title": "A random castle"
}
]
}
},
"url": "https://thecastlemap.com/mcp"
},
"latency_ms": 88.32,
"status": "ok"
},
"transport_compliance_probe": {
"details": {
"bad_protocol_error": null,
"bad_protocol_headers": {
"content-type": "application/json",
"strict-transport-security": "max-age=31536000; includeSubDomains"
},
"bad_protocol_payload": {
"id": 410,
"jsonrpc": "2.0",
"result": {
"tools": [
{
"description": "Search the atlas\u2019s 7,066 castles, fortresses, palaces and ruins by name (accent- and case-insensitive substring match). Optionally filter by country (name or ISO code) and category. Results come best-match-first, then by fame; each has coordinates, founding century, fame rank and links to its atlas page and Wikipedia. If nothing matches, retry with a shorter fragment of the name.",
"inputSchema": {
"properties": {
"category": {
"description": "Landmark type (optional)",
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"country": {
"description": "Country name or 2-letter ISO code (optional)",
"type": "string"
},
"limit": {
"description": "Max results (default 10)",
"maximum": 50,
"minimum": 1,
"type": "integer"
},
"query": {
"description": "Name or part of a name, e.g. \"neuschwanstein\" or \"himeji\"",
"type": "string"
}
},
"required": [
"query"
],
"type": "object"
},
"name": "search_castles",
"title": "Search castles by name"
},
{
"description": "Fetch one landmark\u2019s full record by slug (preferred, e.g. \"palace-of-versailles\") or exact name: coordinates, founding year and century, worldwide fame rank, photo URL, Wikipedia link and its readership signals (Wikidata sitelinks, annual Wikipedia pageviews). Unsure of the slug? Call search_castles first.",
"inputSchema": {
"properties": {
"castle": {
"description": "Slug (preferred, e.g. \"himeji-castle\") or exact name",
"type": "string"
}
},
"required": [
"castle"
],
"type": "object"
},
"name": "get_castle",
"title": "Get one castle in full"
},
{
"description": "List landmarks within a radius of a WGS84 coordinate, nearest first, each with distance_km. Radius defaults to 100 km (max 2,000). For \"castles near <place>\", geocode the place yourself, then call this with its latitude/longitude.",
"inputSchema": {
"properties": {
"category": {
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"latitude": {
"maximum": 90,
"minimum": -90,
"type": "number"
},
"limit": {
"description": "Max results (default 10)",
"maximum": 50,
"minimum": 1,
"type": "integer"
},
"longitude": {
"maximum": 180,
"minimum": -180,
"type": "number"
},
"radius_km": {
"description": "Search radius in km (default 100)",
"maximum": 2000,
"minimum": 1,
"type": "number"
}
},
"required": [
"latitude",
"longitude"
],
"type": "object"
},
"name": "castles_near",
"title": "Find castles near a point"
},
{
"description": "The most famous landmarks worldwide or in one country, ordered by Castlemap fame rank \u2014 a blend of Wikipedia coverage and readership; rank 1 is the most famous (Palace of Versailles). The direct answer to \"most famous castles in <country>\"; filter by country and/or category.",
"inputSchema": {
"properties": {
"category": {
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"country": {
"description": "Country name or ISO code (optional \u2014 omit for worldwide)",
"type": "string"
},
"limit": {
"description": "How many (default 10)",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"type": "object"
},
"name": "top_castles",
"title": "Most famous castles"
},
{
"description": "Every country in the atlas with its landmark count, most first \u2014 answers \"which country has the most castles\" (Spain leads). Returns country name and ISO code per row; country pages are browsable from the countries_index URL.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "list_countries",
"title": "Countries with castle counts"
},
{
"description": "Headline statistics computed live from the atlas: totals by type, top countries, busiest founding century, oldest landmarks, geographic extremes and the most famous entry. The source for claims like \"which country has the most castles\" or \"when were castles built\"; the full write-up lives at thecastlemap.com/statistics/.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "get_statistics",
"title": "Atlas statistics"
},
{
"description": "One random landmark with its full record, optionally limited to a country \u2014 for discovery, quizzes and \"castle of the day\" features.",
"inputSchema": {
"properties": {
"country": {
"description": "Country name or ISO code (optional)",
"type": "string"
}
},
"type": "object"
},
"name": "random_castle",
"title": "A random castle"
}
]
}
},
"bad_protocol_status_code": 200,
"delete_error": null,
"delete_status_code": null,
"expired_session_error": null,
"expired_session_status_code": null,
"issues": [
"missing_session_id",
"missing_protocol_header",
"bad_protocol_not_rejected"
],
"last_event_id_visible": false,
"protocol_header_present": false,
"requested_protocol_version": "2025-03-26",
"session_id_present": false,
"transport": "streamable-http"
},
"latency_ms": 88.81,
"status": "error"
},
"utility_coverage_probe": {
"details": {
"completions": {
"advertised": false,
"live_probe": "not_executed",
"sample_target": null
},
"initialize_capability_keys": [
"tools"
],
"pagination": {
"metadata_signal": false,
"next_cursor_methods": [],
"supported": false
},
"tasks": {
"advertised": false,
"http_status": 200,
"probe_status": "missing"
}
},
"latency_ms": 92.79,
"status": "missing"
}
},
"failures": {
"oauth_authorization_server": {
"reason": "no_authorization_server"
},
"oauth_protected_resource": {
"error": "Client error '404 Not Found' for url 'https://thecastlemap.com/.well-known/oauth-protected-resource'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://thecastlemap.com/.well-known/oauth-protected-resource"
},
"openid_configuration": {
"reason": "no_authorization_server"
},
"server_card": {
"error": "Client error '404 Not Found' for url 'https://thecastlemap.com/.well-known/mcp/server-card.json'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404",
"url": "https://thecastlemap.com/.well-known/mcp/server-card.json"
},
"transport_compliance_probe": {
"bad_protocol_error": null,
"bad_protocol_headers": {
"content-type": "application/json",
"strict-transport-security": "max-age=31536000; includeSubDomains"
},
"bad_protocol_payload": {
"id": 410,
"jsonrpc": "2.0",
"result": {
"tools": [
{
"description": "Search the atlas\u2019s 7,066 castles, fortresses, palaces and ruins by name (accent- and case-insensitive substring match). Optionally filter by country (name or ISO code) and category. Results come best-match-first, then by fame; each has coordinates, founding century, fame rank and links to its atlas page and Wikipedia. If nothing matches, retry with a shorter fragment of the name.",
"inputSchema": {
"properties": {
"category": {
"description": "Landmark type (optional)",
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"country": {
"description": "Country name or 2-letter ISO code (optional)",
"type": "string"
},
"limit": {
"description": "Max results (default 10)",
"maximum": 50,
"minimum": 1,
"type": "integer"
},
"query": {
"description": "Name or part of a name, e.g. \"neuschwanstein\" or \"himeji\"",
"type": "string"
}
},
"required": [
"query"
],
"type": "object"
},
"name": "search_castles",
"title": "Search castles by name"
},
{
"description": "Fetch one landmark\u2019s full record by slug (preferred, e.g. \"palace-of-versailles\") or exact name: coordinates, founding year and century, worldwide fame rank, photo URL, Wikipedia link and its readership signals (Wikidata sitelinks, annual Wikipedia pageviews). Unsure of the slug? Call search_castles first.",
"inputSchema": {
"properties": {
"castle": {
"description": "Slug (preferred, e.g. \"himeji-castle\") or exact name",
"type": "string"
}
},
"required": [
"castle"
],
"type": "object"
},
"name": "get_castle",
"title": "Get one castle in full"
},
{
"description": "List landmarks within a radius of a WGS84 coordinate, nearest first, each with distance_km. Radius defaults to 100 km (max 2,000). For \"castles near <place>\", geocode the place yourself, then call this with its latitude/longitude.",
"inputSchema": {
"properties": {
"category": {
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"latitude": {
"maximum": 90,
"minimum": -90,
"type": "number"
},
"limit": {
"description": "Max results (default 10)",
"maximum": 50,
"minimum": 1,
"type": "integer"
},
"longitude": {
"maximum": 180,
"minimum": -180,
"type": "number"
},
"radius_km": {
"description": "Search radius in km (default 100)",
"maximum": 2000,
"minimum": 1,
"type": "number"
}
},
"required": [
"latitude",
"longitude"
],
"type": "object"
},
"name": "castles_near",
"title": "Find castles near a point"
},
{
"description": "The most famous landmarks worldwide or in one country, ordered by Castlemap fame rank \u2014 a blend of Wikipedia coverage and readership; rank 1 is the most famous (Palace of Versailles). The direct answer to \"most famous castles in <country>\"; filter by country and/or category.",
"inputSchema": {
"properties": {
"category": {
"enum": [
"castle",
"fortress",
"palace",
"ruin"
],
"type": "string"
},
"country": {
"description": "Country name or ISO code (optional \u2014 omit for worldwide)",
"type": "string"
},
"limit": {
"description": "How many (default 10)",
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
"type": "object"
},
"name": "top_castles",
"title": "Most famous castles"
},
{
"description": "Every country in the atlas with its landmark count, most first \u2014 answers \"which country has the most castles\" (Spain leads). Returns country name and ISO code per row; country pages are browsable from the countries_index URL.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "list_countries",
"title": "Countries with castle counts"
},
{
"description": "Headline statistics computed live from the atlas: totals by type, top countries, busiest founding century, oldest landmarks, geographic extremes and the most famous entry. The source for claims like \"which country has the most castles\" or \"when were castles built\"; the full write-up lives at thecastlemap.com/statistics/.",
"inputSchema": {
"properties": {},
"type": "object"
},
"name": "get_statistics",
"title": "Atlas statistics"
},
{
"description": "One random landmark with its full record, optionally limited to a country \u2014 for discovery, quizzes and \"castle of the day\" features.",
"inputSchema": {
"properties": {
"country": {
"description": "Country name or ISO code (optional)",
"type": "string"
}
},
"type": "object"
},
"name": "random_castle",
"title": "A random castle"
}
]
}
},
"bad_protocol_status_code": 200,
"delete_error": null,
"delete_status_code": null,
"expired_session_error": null,
"expired_session_status_code": null,
"issues": [
"missing_session_id",
"missing_protocol_header",
"bad_protocol_not_rejected"
],
"last_event_id_visible": false,
"protocol_header_present": false,
"requested_protocol_version": "2025-03-26",
"session_id_present": false,
"transport": "streamable-http"
}
},
"remote_url": "https://thecastlemap.com/mcp",
"server_card_payload": null,
"server_identifier": "github-flightmussy/castlemap-mcp"
}
Known versions
- No versions recorded.
Validation history
Trend history appears after at least two validation runs. This avoids presenting a one-point validation as a trend.
Validation timeline
| Validated | Summary | Score | Protocol | Auth mode | Tools | High-risk tools | Changes |
|---|---|---|---|---|---|---|---|
| Aug 08, 2026 04:24:30 PM UTC | Healthy | 53.6 | 2025-03-26 | public | 7 | 0 | none |
Recent validation runs
| Started | Status | Summary | Latency | Checks |
|---|---|---|---|---|
| Aug 08, 2026 04:24:29 PM UTC | Completed | Healthy | 1673.4 ms | action_safety_probe, advanced_capabilities_probe, connector_publishability_probe, connector_replay_probe, determinism_probe, initialize, interactive_flow_probe, oauth_authorization_server, oauth_protected_resource, official_registry_probe, openid_configuration, probe_noise_resilience, prompt_get, prompts_list, protocol_version_probe, provenance_divergence_probe, request_association_probe, resource_read, resources_list, schema_divergence_probe, server_card, session_resume_probe, step_up_auth_probe, tool_snapshot_probe, tools_list, transport_compliance_probe, utility_coverage_probe |
Public server reputation
Incident & change feed
| Timestamp | Event | Details |
|---|---|---|
| Aug 08, 2026 04:24:30 PM UTC | Latest validation: healthy | Score 53.6 with status healthy. |
Capabilities
- OAuth:
- DCR/CIMD:
- Prompts:
- Homepage: https://thecastlemap.com/mcp
- Docs: https://thecastlemap.com/mcp
- Support: https://github.com/Flightmussy/castlemap-mcp
- Icon: https://avatars.githubusercontent.com/u/302311957?v=4
- Remote endpoint: https://thecastlemap.com/mcp
- Server card: none
Benchmark tasks
| Benchmark task | Status | Evidence |
|---|---|---|
| Discover tools | Passes |
|
| Read-only fetch flow | Degraded |
|
| OAuth-required connect | Degraded |
|
| Safe write flow with confirmation | Degraded |
|
Utility coverage
Transport compliance drilldown
Issues: missing_session_id, missing_protocol_header, bad_protocol_not_rejected
Request association
Connector replay
Required-argument replay breaks
| Tool | Added required args | Removed required args |
|---|---|---|
| No required-argument replay breaks detected. | ||
Output-schema replay breaks
| Tool | Removed properties | Added properties |
|---|---|---|
| No output-schema replay breaks detected. | ||
Tool snapshot diff & changelog
Need at least two validation runs before building a tool changelog.
Validation diff
Need at least two validation runs before diffing changes.
Registry & provenance divergence
| Field | Registry | Live server card |
|---|---|---|
| Title | n/a | n/a |
| Version | n/a | n/a |
| Homepage | n/a | n/a |
Active alerts
No active alerts for the current server state.
Aliases & registry graph
| Identifier | Source | Canonical | Score |
|---|---|---|---|
github-flightmussy/castlemap-mcp |
github_topic_registry | yes | 53.6 |
Flightmussy/castlemap-mcp |
glama_registry | no | n/a |
awesome-flightmussy/castlemap-mcp |
awesome_mcp_servers | no | n/a |
Alias consolidation
Source disagreements
| Field | What differs | Observed values |
|---|---|---|
| Registry source | Multiple registries or registry sync paths claim this same canonical server. | awesome_mcp_servers github_topic_registry glama_registry |
| Remote URL | Aliases currently point at different MCP endpoints, which can indicate mirrors, stale registry data, or a real endpoint split. | https://glama.ai/mcp/servers/Flightmussy/castlemap-mcp/badges/score.svg)](https://glama.ai/mcp/servers/Flightmussy/castlemap-mcp https://glama.ai/mcp/servers/u99y9tljw3 https://thecastlemap.com/mcp |
| Homepage | Registry entries disagree on the primary homepage for this server. | https://github.com/Flightmussy/castlemap-mcp https://glama.ai/mcp/servers/u99y9tljw3 https://thecastlemap.com/mcp |
| Registry identifier | Different registry-specific identifiers resolve to the same canonical server record here. | awesome_mcp_servers:Flightmussy/castlemap-mcp github_topic_registry:Flightmussy/castlemap-mcp glama_registry:u99y9tljw3 |
Fix it
Why this score?
Algorithmic score breakdown
Actionable remediation
| Severity | Remediation | Why it matters | Recommended action |
|---|---|---|---|
| High | Add confirmation and dry-run semantics for risky actions | High-risk write, delete, exec, or egress tools should communicate safeguards clearly. | Add an explicit confirm/dry-run parameter or two-step confirmation flow to write, delete, exec, and egress-capable tools before they can make destructive changes.Playbook
|
| High | Align session and protocol behavior with Streamable HTTP expectations | Clients increasingly rely on MCP-Protocol-Version, session teardown, and expired-session semantics. | Align MCP-Protocol-Version, MCP-Session-Id, DELETE teardown, and expired-session handling with the transport spec.Playbook
|
| High | Expose /.well-known/oauth-protected-resource | Without a protected-resource document, OAuth clients cannot discover auth requirements reliably. | Serve /.well-known/oauth-protected-resource and point it at your authorization server metadata.Playbook
|
| High | Publish OAuth authorization-server metadata | Clients need authorization-server metadata to discover issuer, endpoints, and DCR support. | Publish /.well-known/oauth-authorization-server from your issuer and include registration_endpoint when supported.Playbook
|
| High | Publish a complete server card | Missing or incomplete server-card metadata weakens discovery, documentation, and trust signals. | Serve /.well-known/mcp/server-card.json and include tools, prompts/resources, homepage, and support links.Playbook
|
| High | Resolve conflicting endpoints across registry aliases | Registry aliases for this canonical server currently resolve to different live MCP endpoints (https://glama.ai/mcp/servers/Flightmussy/castlemap-mcp/badges/score.svg)](https://glama.ai/mcp/servers/Flightmussy/castlemap-mcp, https://glama.ai/mcp/servers/u99y9tljw3, https://thecastlemap.com/mcp). An agent following one registry entry reaches a different server than one following another. | Confirm which endpoint is canonical, correct or retire the stale registry entry, and re-sync so every alias agrees on one remote_url.Playbook
|
| Medium | Adopt a current MCP protocol revision | Older protocol revisions reduce compatibility with newer clients and registry programs. | Advertise a current MCP protocol revision (2025-06-18 or later) in both the initialize response and the MCP-Protocol-Version header.Playbook
|
| Medium | Close connector-publishing gaps | Connector catalogs care about protocol recency, session behavior, auth clarity, and tool-surface stability. | |
| Medium | Document minimal scopes and return cleaner auth challenges | Modern clients expect granular scopes and step-up auth signals such as WWW-Authenticate scope hints. | Return granular scopes and WWW-Authenticate challenge hints instead of forcing overly broad auth upfront.Playbook
|
| Medium | Publish OpenID configuration | OIDC metadata improves token validation and client compatibility. | Expose /.well-known/openid-configuration with issuer, jwks_uri, and supported grants.Playbook
|
| Medium | Support resumable HTTP sessions cleanly | Modern MCP clients increasingly expect resumable session behavior on streamable HTTP transports. | Persist session state keyed by Mcp-Session-Id and honor Last-Event-ID on GET reconnects so clients can resume a dropped Streamable HTTP session.Playbook
|
| Low | Expose modern utility surfaces like completions, pagination, or tasks | Utility coverage improves interoperability with larger clients and long-lived agent workflows. | Expose completions, pagination, and task metadata where supported so larger clients can plan and resume work safely.Playbook
|
| Low | Publish newer MCP capability signals | Roots, sampling, elicitation, structured outputs, and related metadata improve client understanding and ranking. | Advertise only the advanced capabilities (roots, sampling, elicitation) you have actually implemented end to end in the initialize capabilities object.Playbook
|
| Low | Publish or reconcile the server in the official MCP registry | Official registry presence improves discovery confidence and cross-source consistency. |
Point loss breakdown
| Component | Current | Points missing |
|---|---|---|
| Utility Coverage | 0/4 | -4.0 |
| Transport Compliance | 0/4 | -4.0 |
| Step Up Auth | 0/4 | -4.0 |
| Resource Contract | 0/4 | -4.0 |
| Request Association | 0/4 | -4.0 |
| Recovery Semantics | 0/4 | -4.0 |
| Prompt Contract | 0/4 | -4.0 |
| OAUTH Interop | 0/4 | -4.0 |
| Interactive Flow Safety | 0/4 | -4.0 |
| Dependency Supply Chain Signal | 0/4 | -4.0 |
| Advanced Capability Coverage | 0/4 | -4.0 |
| Trust Confidence | 1/4 | -3.0 |
Compatibility profiles
Connector URL: https://thecastlemap.com/mcp # No OAuth metadata detected. # Server: github-flightmussy/castlemap-mcp
{
"mcpServers": {
"castlemap-mcp": {
"command": "npx",
"args": ["mcp-remote", "https://thecastlemap.com/mcp"]
}
}
}
smithery mcp add "https://thecastlemap.com/mcp"
curl -sS https://thecastlemap.com/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"mcp-verify","version":"0.1.0"}}}'
Governance
MCP TrustOps
TrustOps turns this report into operational controls: freshness SLAs, authenticated validation, semantic benchmarks, policy exports, alert subscriptions, badges, cost/compliance metadata, and runtime routing. Fresh trusted index decisions stay separate from long-tail inventory so stale scores do not masquerade as current evidence.
/v1/decideAlert subscription types
MCP Runtime hosting
Verify Hosted MCP turns a trusted server report into a managed remote MCP endpoint with GitHub deployment provenance, sandbox policy, encrypted secrets, release history, rollback, and audit/usage events.
/hosted/{namespace}/{name}/mcp| Deployment | Status | Endpoint | Release |
|---|---|---|---|
| No hosted runtime deployments yet. | |||
Authenticated validation sessions
Public validation is free. Authenticated validation is paid and proves scoped behavior, write-action safeguards, and authenticated tool execution.
/v1/verify/v1/ci/previewInstall snippets
Connector URL: https://thecastlemap.com/mcp # No OAuth metadata detected. # Server: github-flightmussy/castlemap-mcp
{
"mcpServers": {
"castlemap-mcp": {
"command": "npx",
"args": ["mcp-remote", "https://thecastlemap.com/mcp"]
}
}
}
smithery mcp add "https://thecastlemap.com/mcp"
curl -sS https://thecastlemap.com/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"mcp-verify","version":"0.1.0"}}}'
Agent access & tool surface
tools/list, prompts/list, and resources/list checks.github-flightmussy/castlemap-mcp.